# Flog Txt Version 1
# Analyzer Version: 3.2.2
# Analyzer Build Date: Mar  3 2020 14:14:30
# Log Creation Date: 25.03.2020 11:30:45.370

Process:
	id = "1"
	image_name = "kekw.exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kekw.exe"
	page_root = "0x4d1f3000"
	os_pid = "0x6fc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x454"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KEKW.exe\" "
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0x7b4

	[0054.102] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0056.175] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x26f304 | out: pfEnabled=0x26f304) returned 0x0
	[0056.328] GetLogicalDrives () returned 0x4
	[0056.350] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x26ed74, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0056.356] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x26edf8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0056.358] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x26ed8c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0056.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f23c) returned 1
	[0056.466] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x26ed44, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0056.468] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x26ed18, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0056.475] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x26ef64 | out: lpFindFileData=0x26ef64*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5f5ab0
	[0056.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0056.480] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf
	[0056.481] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\", lpFilePart=0x0) returned 0x10
	[0056.481] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0056.482] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.482] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0056.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.483] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x3e
	[0056.483] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x3f
	[0056.483] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.484] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.485] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0056.486] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0056.487] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.492] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x3e
	[0056.492] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x3f
	[0056.492] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.493] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.493] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0056.515] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.515] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.524] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0056.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.525] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Decrypt.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.527] GetFileType (hFile=0x1f0) returned 0x1
	[0056.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.527] GetFileType (hFile=0x1f0) returned 0x1
	[0056.545] WriteFile (in: hFile=0x1f0, lpBuffer=0x25dea9c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x25dea9c*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.549] CloseHandle (hObject=0x1f0) returned 1
	[0056.553] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.553] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0056.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0056.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0056.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0056.554] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf
	[0056.554] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\", lpFilePart=0x0) returned 0x10
	[0056.554] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0056.555] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.555] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf2b1a7f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2b1a7f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0056.556] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf2b1a7f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2b1a7f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0056.557] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0056.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0056.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0056.557] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb68, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\Decrypt.txt", lpFilePart=0x0) returned 0x1b
	[0056.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0056.557] CreateFileW (lpFileName="C:\\$Recycle.Bin\\Decrypt.txt" (normalized: "c:\\$recycle.bin\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f8
	[0056.564] GetFileType (hFile=0x1f8) returned 0x1
	[0056.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f058) returned 1
	[0056.564] GetFileType (hFile=0x1f8) returned 0x1
	[0056.565] WriteFile (in: hFile=0x1f8, lpBuffer=0x25e1780*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f0f4, lpOverlapped=0x0 | out: lpBuffer=0x25e1780*, lpNumberOfBytesWritten=0x26f0f4*=0xa5, lpOverlapped=0x0) returned 1
	[0056.569] CloseHandle (hObject=0x1f8) returned 1
	[0056.570] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0056.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0056.571] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7
	[0056.571] GetFullPathNameW (in: lpFileName="C:\\Boot\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\", lpFilePart=0x0) returned 0x8
	[0056.571] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0056.572] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.572] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0056.573] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0056.573] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0056.574] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0056.575] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0056.575] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0056.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.576] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd
	[0056.576] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\", lpFilePart=0x0) returned 0xe
	[0056.576] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.578] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.579] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.580] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.580] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.581] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd
	[0056.581] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\", lpFilePart=0x0) returned 0xe
	[0056.581] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.582] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.582] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.584] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.585] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.585] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.585] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\Decrypt.txt" (normalized: "c:\\boot\\cs-cz\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.587] GetFileType (hFile=0x1f0) returned 0x1
	[0056.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.588] GetFileType (hFile=0x1f0) returned 0x1
	[0056.588] WriteFile (in: hFile=0x1f0, lpBuffer=0x25e51f8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x25e51f8*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.592] CloseHandle (hObject=0x1f0) returned 1
	[0056.593] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0056.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.594] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd
	[0056.594] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\", lpFilePart=0x0) returned 0xe
	[0056.594] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.595] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.596] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.596] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.597] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.597] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd
	[0056.597] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\", lpFilePart=0x0) returned 0xe
	[0056.597] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.598] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.599] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.599] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.600] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.600] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.600] CreateFileW (lpFileName="C:\\Boot\\da-DK\\Decrypt.txt" (normalized: "c:\\boot\\da-dk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.602] GetFileType (hFile=0x1f0) returned 0x1
	[0056.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.602] GetFileType (hFile=0x1f0) returned 0x1
	[0056.603] WriteFile (in: hFile=0x1f0, lpBuffer=0x25e8508*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x25e8508*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.606] CloseHandle (hObject=0x1f0) returned 1
	[0056.607] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0056.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.607] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd
	[0056.608] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\", lpFilePart=0x0) returned 0xe
	[0056.608] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.610] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.611] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.611] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.612] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.612] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd
	[0056.612] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\", lpFilePart=0x0) returned 0xe
	[0056.613] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.613] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.614] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.614] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.615] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.615] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.616] CreateFileW (lpFileName="C:\\Boot\\de-DE\\Decrypt.txt" (normalized: "c:\\boot\\de-de\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.618] GetFileType (hFile=0x1f0) returned 0x1
	[0056.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.619] GetFileType (hFile=0x1f0) returned 0x1
	[0056.619] WriteFile (in: hFile=0x1f0, lpBuffer=0x25eb818*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x25eb818*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.623] CloseHandle (hObject=0x1f0) returned 1
	[0056.624] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0056.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.625] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd
	[0056.625] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\", lpFilePart=0x0) returned 0xe
	[0056.625] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.626] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.626] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.627] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.627] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.628] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd
	[0056.628] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\", lpFilePart=0x0) returned 0xe
	[0056.628] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.629] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.629] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.630] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.630] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.631] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.631] CreateFileW (lpFileName="C:\\Boot\\el-GR\\Decrypt.txt" (normalized: "c:\\boot\\el-gr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.633] GetFileType (hFile=0x1f0) returned 0x1
	[0056.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.633] GetFileType (hFile=0x1f0) returned 0x1
	[0056.634] WriteFile (in: hFile=0x1f0, lpBuffer=0x25eeb28*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x25eeb28*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.637] CloseHandle (hObject=0x1f0) returned 1
	[0056.638] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0056.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.639] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd
	[0056.639] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\", lpFilePart=0x0) returned 0xe
	[0056.639] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.642] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.642] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.643] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0056.644] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0056.644] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.644] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd
	[0056.645] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\", lpFilePart=0x0) returned 0xe
	[0056.645] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.646] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.646] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.647] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0056.648] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.648] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.648] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.649] CreateFileW (lpFileName="C:\\Boot\\en-US\\Decrypt.txt" (normalized: "c:\\boot\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.650] GetFileType (hFile=0x1f0) returned 0x1
	[0056.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.650] GetFileType (hFile=0x1f0) returned 0x1
	[0056.651] WriteFile (in: hFile=0x1f0, lpBuffer=0x25f2180*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x25f2180*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.655] CloseHandle (hObject=0x1f0) returned 1
	[0056.656] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0056.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.657] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd
	[0056.657] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\", lpFilePart=0x0) returned 0xe
	[0056.657] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.659] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.660] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.661] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.661] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.662] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd
	[0056.662] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\", lpFilePart=0x0) returned 0xe
	[0056.662] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.663] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.664] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.664] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.665] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.665] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.666] CreateFileW (lpFileName="C:\\Boot\\es-ES\\Decrypt.txt" (normalized: "c:\\boot\\es-es\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.667] GetFileType (hFile=0x1f0) returned 0x1
	[0056.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.667] GetFileType (hFile=0x1f0) returned 0x1
	[0056.668] WriteFile (in: hFile=0x1f0, lpBuffer=0x25f5490*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x25f5490*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.671] CloseHandle (hObject=0x1f0) returned 1
	[0056.673] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0056.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.673] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd
	[0056.673] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\", lpFilePart=0x0) returned 0xe
	[0056.673] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.674] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.675] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.675] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.676] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.676] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd
	[0056.676] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\", lpFilePart=0x0) returned 0xe
	[0056.676] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.677] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.678] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.678] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.678] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.679] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.679] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\Decrypt.txt" (normalized: "c:\\boot\\fi-fi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.682] GetFileType (hFile=0x1f0) returned 0x1
	[0056.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.682] GetFileType (hFile=0x1f0) returned 0x1
	[0056.683] WriteFile (in: hFile=0x1f0, lpBuffer=0x25f87a0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x25f87a0*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.686] CloseHandle (hObject=0x1f0) returned 1
	[0056.687] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0056.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.688] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd
	[0056.688] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\", lpFilePart=0x0) returned 0xe
	[0056.688] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.690] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.691] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0056.691] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0056.692] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0056.693] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0056.693] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0056.694] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0056.694] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.695] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd
	[0056.695] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\", lpFilePart=0x0) returned 0xe
	[0056.695] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.696] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.696] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0056.697] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0056.697] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0056.698] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0056.698] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0056.699] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.699] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.699] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.700] CreateFileW (lpFileName="C:\\Boot\\Fonts\\Decrypt.txt" (normalized: "c:\\boot\\fonts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.705] GetFileType (hFile=0x1f0) returned 0x1
	[0056.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.705] GetFileType (hFile=0x1f0) returned 0x1
	[0056.706] WriteFile (in: hFile=0x1f0, lpBuffer=0x25fc578*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x25fc578*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.710] CloseHandle (hObject=0x1f0) returned 1
	[0056.711] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0056.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.711] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd
	[0056.712] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\", lpFilePart=0x0) returned 0xe
	[0056.712] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.714] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.714] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.715] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.715] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.716] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd
	[0056.716] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\", lpFilePart=0x0) returned 0xe
	[0056.716] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.717] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.717] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.718] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.718] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.718] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.719] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\Decrypt.txt" (normalized: "c:\\boot\\fr-fr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.720] GetFileType (hFile=0x1f0) returned 0x1
	[0056.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.720] GetFileType (hFile=0x1f0) returned 0x1
	[0056.720] WriteFile (in: hFile=0x1f0, lpBuffer=0x25ff888*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x25ff888*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.729] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0056.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.729] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd
	[0056.729] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\", lpFilePart=0x0) returned 0xe
	[0056.729] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.730] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.731] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.731] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.732] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.732] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd
	[0056.733] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\", lpFilePart=0x0) returned 0xe
	[0056.733] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.733] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.734] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.734] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.735] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.735] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.735] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\Decrypt.txt" (normalized: "c:\\boot\\hu-hu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.737] GetFileType (hFile=0x1f0) returned 0x1
	[0056.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.737] GetFileType (hFile=0x1f0) returned 0x1
	[0056.738] WriteFile (in: hFile=0x1f0, lpBuffer=0x2602b98*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x2602b98*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.743] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0056.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.743] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd
	[0056.744] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\", lpFilePart=0x0) returned 0xe
	[0056.744] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.746] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.747] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.747] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.749] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.749] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd
	[0056.749] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\", lpFilePart=0x0) returned 0xe
	[0056.749] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.750] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.750] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.751] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.751] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.752] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.752] CreateFileW (lpFileName="C:\\Boot\\it-IT\\Decrypt.txt" (normalized: "c:\\boot\\it-it\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.753] GetFileType (hFile=0x1f0) returned 0x1
	[0056.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.753] GetFileType (hFile=0x1f0) returned 0x1
	[0056.754] WriteFile (in: hFile=0x1f0, lpBuffer=0x2605ea8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x2605ea8*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.766] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0056.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.767] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd
	[0056.767] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\", lpFilePart=0x0) returned 0xe
	[0056.767] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.768] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.768] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.769] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.769] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.770] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd
	[0056.770] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\", lpFilePart=0x0) returned 0xe
	[0056.770] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.770] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.771] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.771] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.772] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.773] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.773] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\Decrypt.txt" (normalized: "c:\\boot\\ja-jp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.774] GetFileType (hFile=0x1f0) returned 0x1
	[0056.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.774] GetFileType (hFile=0x1f0) returned 0x1
	[0056.775] WriteFile (in: hFile=0x1f0, lpBuffer=0x26091b8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x26091b8*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.779] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0056.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.780] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd
	[0056.780] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\", lpFilePart=0x0) returned 0xe
	[0056.780] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.782] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.783] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.783] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.784] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.784] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd
	[0056.784] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\", lpFilePart=0x0) returned 0xe
	[0056.784] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.785] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.785] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.786] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.786] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.786] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.786] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\Decrypt.txt" (normalized: "c:\\boot\\ko-kr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.787] GetFileType (hFile=0x1f0) returned 0x1
	[0056.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.788] GetFileType (hFile=0x1f0) returned 0x1
	[0056.788] WriteFile (in: hFile=0x1f0, lpBuffer=0x260c4c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x260c4c8*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.792] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0056.793] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0056.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.793] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd
	[0056.793] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\", lpFilePart=0x0) returned 0xe
	[0056.793] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.794] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.795] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.795] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.795] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.796] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd
	[0056.796] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\", lpFilePart=0x0) returned 0xe
	[0056.796] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.797] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.797] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.798] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.798] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.798] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.798] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\Decrypt.txt" (normalized: "c:\\boot\\nb-no\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.800] GetFileType (hFile=0x1f0) returned 0x1
	[0056.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.800] GetFileType (hFile=0x1f0) returned 0x1
	[0056.800] WriteFile (in: hFile=0x1f0, lpBuffer=0x260f878*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x260f878*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.805] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0056.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.806] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd
	[0056.806] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\", lpFilePart=0x0) returned 0xe
	[0056.806] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.810] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.810] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.811] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.811] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.812] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd
	[0056.812] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\", lpFilePart=0x0) returned 0xe
	[0056.812] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.812] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.813] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.813] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.813] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.814] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.814] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\Decrypt.txt" (normalized: "c:\\boot\\nl-nl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.815] GetFileType (hFile=0x1f0) returned 0x1
	[0056.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.815] GetFileType (hFile=0x1f0) returned 0x1
	[0056.816] WriteFile (in: hFile=0x1f0, lpBuffer=0x2612b88*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x2612b88*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.822] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0056.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.823] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd
	[0056.823] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\", lpFilePart=0x0) returned 0xe
	[0056.823] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.824] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.824] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.825] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.825] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.826] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd
	[0056.826] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\", lpFilePart=0x0) returned 0xe
	[0056.826] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.826] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.827] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.827] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.828] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.828] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.828] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\Decrypt.txt" (normalized: "c:\\boot\\pl-pl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.829] GetFileType (hFile=0x1f0) returned 0x1
	[0056.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.830] GetFileType (hFile=0x1f0) returned 0x1
	[0056.830] WriteFile (in: hFile=0x1f0, lpBuffer=0x2615e98*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x2615e98*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.835] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0056.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.836] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd
	[0056.836] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\", lpFilePart=0x0) returned 0xe
	[0056.836] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.839] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.839] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.840] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.840] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.841] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd
	[0056.841] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\", lpFilePart=0x0) returned 0xe
	[0056.841] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.842] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.842] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.842] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.843] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.843] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.843] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\Decrypt.txt" (normalized: "c:\\boot\\pt-br\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.845] GetFileType (hFile=0x1f0) returned 0x1
	[0056.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.845] GetFileType (hFile=0x1f0) returned 0x1
	[0056.845] WriteFile (in: hFile=0x1f0, lpBuffer=0x26191a8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x26191a8*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.850] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0056.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.851] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd
	[0056.851] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\", lpFilePart=0x0) returned 0xe
	[0056.851] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.852] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.852] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.853] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.853] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.854] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd
	[0056.854] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\", lpFilePart=0x0) returned 0xe
	[0056.854] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.854] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.855] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.855] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.855] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.856] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.856] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\Decrypt.txt" (normalized: "c:\\boot\\pt-pt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.857] GetFileType (hFile=0x1f0) returned 0x1
	[0056.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.857] GetFileType (hFile=0x1f0) returned 0x1
	[0056.858] WriteFile (in: hFile=0x1f0, lpBuffer=0x261c4b8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x261c4b8*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.862] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0056.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.863] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd
	[0056.863] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\", lpFilePart=0x0) returned 0xe
	[0056.863] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.865] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.866] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.866] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.867] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.867] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd
	[0056.867] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\", lpFilePart=0x0) returned 0xe
	[0056.867] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.868] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.868] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.869] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.869] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.869] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.870] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\Decrypt.txt" (normalized: "c:\\boot\\ru-ru\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.871] GetFileType (hFile=0x1f0) returned 0x1
	[0056.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.871] GetFileType (hFile=0x1f0) returned 0x1
	[0056.871] WriteFile (in: hFile=0x1f0, lpBuffer=0x261f7c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x261f7c8*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.875] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0056.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.876] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd
	[0056.876] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\", lpFilePart=0x0) returned 0xe
	[0056.876] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.877] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.877] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.877] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.878] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.878] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd
	[0056.878] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\", lpFilePart=0x0) returned 0xe
	[0056.879] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.879] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.879] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.880] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.880] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.881] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.881] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\Decrypt.txt" (normalized: "c:\\boot\\sv-se\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.882] GetFileType (hFile=0x1f0) returned 0x1
	[0056.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.882] GetFileType (hFile=0x1f0) returned 0x1
	[0056.883] WriteFile (in: hFile=0x1f0, lpBuffer=0x2622ad8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x2622ad8*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.888] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0056.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.888] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd
	[0056.888] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\", lpFilePart=0x0) returned 0xe
	[0056.888] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.890] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.891] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.891] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.891] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.892] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd
	[0056.892] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\", lpFilePart=0x0) returned 0xe
	[0056.892] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.892] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.892] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.893] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.893] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.893] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.893] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\Decrypt.txt" (normalized: "c:\\boot\\tr-tr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.894] GetFileType (hFile=0x1f0) returned 0x1
	[0056.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.895] GetFileType (hFile=0x1f0) returned 0x1
	[0056.902] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0056.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.902] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd
	[0056.902] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\", lpFilePart=0x0) returned 0xe
	[0056.902] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.903] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.903] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.903] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.903] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.904] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd
	[0056.904] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\", lpFilePart=0x0) returned 0xe
	[0056.904] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.904] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.904] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.905] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.905] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.905] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.906] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\Decrypt.txt" (normalized: "c:\\boot\\zh-cn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.907] GetFileType (hFile=0x1f0) returned 0x1
	[0056.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.907] GetFileType (hFile=0x1f0) returned 0x1
	[0056.908] WriteFile (in: hFile=0x1f0, lpBuffer=0x26290f8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x26290f8*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.912] CloseHandle (hObject=0x1f0) returned 1
	[0056.913] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0056.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.914] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd
	[0056.914] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\", lpFilePart=0x0) returned 0xe
	[0056.914] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.916] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.917] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.917] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.918] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.918] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd
	[0056.918] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\", lpFilePart=0x0) returned 0xe
	[0056.919] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.919] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.920] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.920] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.921] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.921] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.921] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\Decrypt.txt" (normalized: "c:\\boot\\zh-hk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.923] GetFileType (hFile=0x1f0) returned 0x1
	[0056.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.923] GetFileType (hFile=0x1f0) returned 0x1
	[0056.924] WriteFile (in: hFile=0x1f0, lpBuffer=0x262c408*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x262c408*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.928] CloseHandle (hObject=0x1f0) returned 1
	[0056.929] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0056.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.929] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd
	[0056.929] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\", lpFilePart=0x0) returned 0xe
	[0056.929] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.930] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.931] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.931] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0056.932] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0056.933] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd
	[0056.933] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\", lpFilePart=0x0) returned 0xe
	[0056.933] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0056.934] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.934] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0056.935] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.935] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0056.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0056.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0056.936] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0056.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0056.936] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\Decrypt.txt" (normalized: "c:\\boot\\zh-tw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0056.938] GetFileType (hFile=0x1f0) returned 0x1
	[0056.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0056.938] GetFileType (hFile=0x1f0) returned 0x1
	[0056.939] WriteFile (in: hFile=0x1f0, lpBuffer=0x262f718*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x262f718*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0056.942] CloseHandle (hObject=0x1f0) returned 1
	[0056.943] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0056.944] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0056.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0056.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0056.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0056.944] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7
	[0056.944] GetFullPathNameW (in: lpFileName="C:\\Boot\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\", lpFilePart=0x0) returned 0x8
	[0056.945] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0056.945] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0056.946] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0056.946] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0056.947] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0056.947] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0056.948] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0056.994] GetFullPathNameW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT", nBufferLength=0x105, lpBuffer=0x26eb5c, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BOOTSTAT.DAT", lpFilePart=0x0) returned 0x14
	[0056.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f050) returned 1
	[0056.994] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1f0
	[0056.995] GetFileType (hFile=0x1f0) returned 0x1
	[0056.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f04c) returned 1
	[0056.995] GetFileType (hFile=0x1f0) returned 0x1
	[0056.996] GetFileSize (in: hFile=0x1f0, lpFileSizeHigh=0x26f158 | out: lpFileSizeHigh=0x26f158*=0x0) returned 0x10000
	[0056.998] ReadFile (in: hFile=0x1f0, lpBuffer=0x26313b4, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x26f104, lpOverlapped=0x0 | out: lpBuffer=0x26313b4*, lpNumberOfBytesRead=0x26f104*=0x10000, lpOverlapped=0x0) returned 1
	[0057.007] CloseHandle (hObject=0x1f0) returned 1
	[0057.010] GetFullPathNameW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT.KEKW", nBufferLength=0x105, lpBuffer=0x26eb90, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BOOTSTAT.DAT.KEKW", lpFilePart=0x0) returned 0x19
	[0057.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f084) returned 1
	[0057.011] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.KEKW" (normalized: "c:\\boot\\bootstat.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1f0
	[0057.011] GetFileType (hFile=0x1f0) returned 0x1
	[0057.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f080) returned 1
	[0057.012] GetFileType (hFile=0x1f0) returned 0x1
	[0057.034] WriteFile (in: hFile=0x1f0, lpBuffer=0x2642a8c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26f0a8, lpOverlapped=0x0 | out: lpBuffer=0x2642a8c*, lpNumberOfBytesWritten=0x26f0a8*=0x10, lpOverlapped=0x0) returned 1
	[0057.039] CloseHandle (hObject=0x1f0) returned 1
	[0057.045] GetFullPathNameW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT", nBufferLength=0x105, lpBuffer=0x26ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\BOOTSTAT.DAT", lpFilePart=0x0) returned 0x14
	[0057.046] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1
	[0057.050] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2bb2d70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2bb2d70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0057.050] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2bd8ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2bd8ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0057.051] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2bff030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2bff030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0057.051] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2c25190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2c25190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0057.059] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2c4b2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2c4b2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0057.060] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2c71450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2c71450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0057.060] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2c975b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2c975b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0057.061] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2cbd710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2cbd710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0057.061] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2ce3870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2ce3870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0057.062] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2d099d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2d099d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0057.062] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2d2fb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2d2fb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0057.063] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2d7bdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2d7bdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0057.063] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2d7bdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2d7bdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0057.064] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0057.064] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2da1f50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2da1f50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0057.064] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2dc80b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2dc80b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0057.065] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2dee210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2dee210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0057.065] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2e14370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2e14370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0057.066] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2e3a4d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2e3a4d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0057.066] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2e60630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2e60630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0057.066] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2e86790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2e86790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0057.067] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2e86790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2e86790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0057.068] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2eac8f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2eac8f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0057.068] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2ed2a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2ed2a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0057.069] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2ef8bb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2ef8bb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0057.069] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf2ef8bb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2ef8bb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0057.070] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0057.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0057.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0057.070] GetFullPathNameW (in: lpFileName="C:\\Boot\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb68, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Decrypt.txt", lpFilePart=0x0) returned 0x13
	[0057.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.071] CreateFileW (lpFileName="C:\\Boot\\Decrypt.txt" (normalized: "c:\\boot\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f8
	[0057.072] GetFileType (hFile=0x1f8) returned 0x1
	[0057.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f058) returned 1
	[0057.072] GetFileType (hFile=0x1f8) returned 0x1
	[0057.073] WriteFile (in: hFile=0x1f8, lpBuffer=0x2645de0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f0f4, lpOverlapped=0x0 | out: lpBuffer=0x2645de0*, lpNumberOfBytesWritten=0x26f0f4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.077] CloseHandle (hObject=0x1f8) returned 1
	[0057.078] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0057.079] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1
	[0057.079] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1
	[0057.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0057.080] GetFullPathNameW (in: lpFileName="C:\\Config.Msi", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi", lpFilePart=0x0) returned 0xd
	[0057.080] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\", lpFilePart=0x0) returned 0xe
	[0057.080] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0057.082] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.082] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0057.083] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0057.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0057.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0057.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0057.084] GetFullPathNameW (in: lpFileName="C:\\Config.Msi", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi", lpFilePart=0x0) returned 0xd
	[0057.084] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\", lpFilePart=0x0) returned 0xe
	[0057.084] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0057.085] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.086] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0057.086] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0057.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0057.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0057.087] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb68, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\Decrypt.txt", lpFilePart=0x0) returned 0x19
	[0057.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.087] CreateFileW (lpFileName="C:\\Config.Msi\\Decrypt.txt" (normalized: "c:\\config.msi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f8
	[0057.089] GetFileType (hFile=0x1f8) returned 0x1
	[0057.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f058) returned 1
	[0057.089] GetFileType (hFile=0x1f8) returned 0x1
	[0057.089] WriteFile (in: hFile=0x1f8, lpBuffer=0x2648e94*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f0f4, lpOverlapped=0x0 | out: lpBuffer=0x2648e94*, lpNumberOfBytesWritten=0x26f0f4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.093] CloseHandle (hObject=0x1f8) returned 1
	[0057.094] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0057.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0057.095] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings", lpFilePart=0x0) returned 0x19
	[0057.095] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\", lpFilePart=0x0) returned 0x1a
	[0057.095] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0057.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f160) returned 1
	[0057.164] EtwEventRegister () returned 0x0
	[0057.234] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0057.235] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1
	[0057.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0057.235] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb
	[0057.235] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\", lpFilePart=0x0) returned 0xc
	[0057.236] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0057.237] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.237] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1
	[0057.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0057.238] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15
	[0057.238] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\", lpFilePart=0x0) returned 0x16
	[0057.238] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0057.246] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.248] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1
	[0057.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.248] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.249] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.249] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.252] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.252] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1
	[0057.253] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1
	[0057.253] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1
	[0057.254] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.255] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0
	[0057.255] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.256] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.256] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.256] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.257] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.257] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1
	[0057.258] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1
	[0057.258] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1
	[0057.259] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.259] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.260] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.260] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.260] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.268] GetFileType (hFile=0x200) returned 0x1
	[0057.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.269] GetFileType (hFile=0x200) returned 0x1
	[0057.270] WriteFile (in: hFile=0x200, lpBuffer=0x2652880*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2652880*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.274] CloseHandle (hObject=0x200) returned 1
	[0057.274] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1
	[0057.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.275] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.275] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.275] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.282] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.282] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1
	[0057.283] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1
	[0057.283] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1
	[0057.284] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.284] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0
	[0057.285] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.288] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.288] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.288] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.291] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.292] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1
	[0057.292] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1
	[0057.293] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1
	[0057.293] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.293] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.294] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.297] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.297] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.300] GetFileType (hFile=0x200) returned 0x1
	[0057.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.301] GetFileType (hFile=0x200) returned 0x1
	[0057.301] WriteFile (in: hFile=0x200, lpBuffer=0x2657aa4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2657aa4*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.304] CloseHandle (hObject=0x200) returned 1
	[0057.304] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1
	[0057.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.305] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.305] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.306] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.312] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.313] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1
	[0057.313] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1
	[0057.314] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1
	[0057.315] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.315] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0
	[0057.315] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.319] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.319] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.319] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.322] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.323] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1
	[0057.323] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1
	[0057.323] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1
	[0057.324] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.324] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.325] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.328] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.328] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.331] GetFileType (hFile=0x200) returned 0x1
	[0057.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.332] GetFileType (hFile=0x200) returned 0x1
	[0057.332] WriteFile (in: hFile=0x200, lpBuffer=0x265cc98*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x265cc98*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.336] CloseHandle (hObject=0x200) returned 1
	[0057.336] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1
	[0057.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.337] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.337] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.337] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.351] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.352] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1
	[0057.352] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1
	[0057.353] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1
	[0057.353] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.354] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0
	[0057.354] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.357] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.357] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.357] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.360] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.361] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1
	[0057.361] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1
	[0057.362] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1
	[0057.362] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.363] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.363] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.391] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.395] GetFileType (hFile=0x200) returned 0x1
	[0057.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.396] GetFileType (hFile=0x200) returned 0x1
	[0057.396] WriteFile (in: hFile=0x200, lpBuffer=0x2661e68*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2661e68*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.400] CloseHandle (hObject=0x200) returned 1
	[0057.401] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1
	[0057.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.403] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.403] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.403] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.406] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.406] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.407] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1
	[0057.407] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1
	[0057.408] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1
	[0057.408] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0
	[0057.409] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.409] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.409] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.410] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.410] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.411] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.412] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1
	[0057.412] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1
	[0057.413] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1
	[0057.413] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.414] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.414] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.414] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.419] GetFileType (hFile=0x200) returned 0x1
	[0057.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.419] GetFileType (hFile=0x200) returned 0x1
	[0057.420] WriteFile (in: hFile=0x200, lpBuffer=0x2666f24*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2666f24*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.422] CloseHandle (hObject=0x200) returned 1
	[0057.423] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1
	[0057.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.424] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.424] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.424] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.430] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.431] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1
	[0057.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0057.431] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFilePart=0x0) returned 0x47
	[0057.431] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpFilePart=0x0) returned 0x48
	[0057.432] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0057.433] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.433] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1
	[0057.434] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1
	[0057.434] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1
	[0057.435] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0
	[0057.435] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0057.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0057.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0057.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0057.436] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFilePart=0x0) returned 0x47
	[0057.436] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpFilePart=0x0) returned 0x48
	[0057.436] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0057.437] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.437] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1
	[0057.438] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1
	[0057.438] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1
	[0057.439] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.439] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0057.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0057.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0057.440] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0057.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0057.440] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0057.442] GetFileType (hFile=0x204) returned 0x1
	[0057.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0057.458] GetFileType (hFile=0x204) returned 0x1
	[0057.459] WriteFile (in: hFile=0x204, lpBuffer=0x266c8d0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x266c8d0*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0057.462] CloseHandle (hObject=0x204) returned 1
	[0057.463] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1
	[0057.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0057.464] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFilePart=0x0) returned 0x47
	[0057.464] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpFilePart=0x0) returned 0x48
	[0057.464] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0057.466] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.467] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1
	[0057.468] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1
	[0057.468] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1
	[0057.469] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0
	[0057.469] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0057.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0057.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0057.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0057.470] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFilePart=0x0) returned 0x47
	[0057.470] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpFilePart=0x0) returned 0x48
	[0057.470] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0057.471] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.472] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1
	[0057.472] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1
	[0057.472] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1
	[0057.473] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.473] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0057.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0057.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0057.474] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0057.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0057.474] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0057.475] GetFileType (hFile=0x204) returned 0x1
	[0057.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0057.475] GetFileType (hFile=0x204) returned 0x1
	[0057.475] WriteFile (in: hFile=0x204, lpBuffer=0x2671738*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2671738*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0057.478] CloseHandle (hObject=0x204) returned 1
	[0057.479] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1
	[0057.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0057.479] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFilePart=0x0) returned 0x47
	[0057.480] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpFilePart=0x0) returned 0x48
	[0057.480] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0057.481] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.482] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1
	[0057.482] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1
	[0057.483] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1
	[0057.483] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0
	[0057.484] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0057.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0057.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0057.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0057.484] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFilePart=0x0) returned 0x47
	[0057.485] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpFilePart=0x0) returned 0x48
	[0057.485] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0057.485] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.486] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1
	[0057.486] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1
	[0057.487] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1
	[0057.487] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.488] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0057.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0057.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0057.488] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0057.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0057.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0057.490] GetFileType (hFile=0x204) returned 0x1
	[0057.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0057.490] GetFileType (hFile=0x204) returned 0x1
	[0057.491] WriteFile (in: hFile=0x204, lpBuffer=0x26765a0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26765a0*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0057.497] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1
	[0057.497] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1
	[0057.497] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.498] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0
	[0057.498] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.499] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.499] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.499] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.500] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.500] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf33bb7b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf33bb7b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1
	[0057.500] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf342dbd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf342dbd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1
	[0057.501] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf3453d30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3453d30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1
	[0057.501] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1
	[0057.501] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1
	[0057.502] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.502] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.503] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.503] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.503] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.504] GetFileType (hFile=0x200) returned 0x1
	[0057.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.504] GetFileType (hFile=0x200) returned 0x1
	[0057.504] WriteFile (in: hFile=0x200, lpBuffer=0x267aa30*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x267aa30*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.507] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1
	[0057.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.508] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.508] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.508] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.514] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.515] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1
	[0057.515] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0057.515] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1
	[0057.516] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.516] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0
	[0057.516] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.519] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.519] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.520] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.523] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.523] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1
	[0057.524] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0057.524] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1
	[0057.524] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.525] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.525] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.527] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.528] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.532] GetFileType (hFile=0x200) returned 0x1
	[0057.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.532] GetFileType (hFile=0x200) returned 0x1
	[0057.533] WriteFile (in: hFile=0x200, lpBuffer=0x267fc3c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x267fc3c*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.549] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1
	[0057.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.550] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.550] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.550] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.555] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.556] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1
	[0057.556] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1
	[0057.557] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1
	[0057.557] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.557] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0
	[0057.558] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.560] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.560] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.560] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.563] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.564] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1
	[0057.564] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1
	[0057.565] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1
	[0057.566] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.566] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.566] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.570] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.573] GetFileType (hFile=0x200) returned 0x1
	[0057.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.573] GetFileType (hFile=0x200) returned 0x1
	[0057.574] WriteFile (in: hFile=0x200, lpBuffer=0x2684e18*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2684e18*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.577] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1
	[0057.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.577] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.578] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.578] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.578] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.579] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.579] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1
	[0057.580] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1
	[0057.580] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1
	[0057.580] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0
	[0057.581] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.581] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.582] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.582] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.583] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.584] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.584] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1
	[0057.584] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1
	[0057.585] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1
	[0057.585] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.585] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.586] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.594] GetFileType (hFile=0x200) returned 0x1
	[0057.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.594] GetFileType (hFile=0x200) returned 0x1
	[0057.594] WriteFile (in: hFile=0x200, lpBuffer=0x2689f08*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2689f08*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.597] CloseHandle (hObject=0x200) returned 1
	[0057.598] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1
	[0057.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.599] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.599] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.599] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.605] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.606] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1
	[0057.606] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1
	[0057.607] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1
	[0057.608] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.608] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0
	[0057.609] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.612] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.612] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.612] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.615] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.616] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1
	[0057.616] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1
	[0057.617] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1
	[0057.617] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.618] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.618] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.621] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.621] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.624] GetFileType (hFile=0x200) returned 0x1
	[0057.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.625] GetFileType (hFile=0x200) returned 0x1
	[0057.625] WriteFile (in: hFile=0x200, lpBuffer=0x268f0d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x268f0d8*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.628] CloseHandle (hObject=0x200) returned 1
	[0057.629] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1
	[0057.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.629] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.630] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.630] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.638] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.639] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1
	[0057.639] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1
	[0057.640] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1
	[0057.641] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.641] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0
	[0057.641] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.644] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.645] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.645] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.648] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.649] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1
	[0057.649] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1
	[0057.650] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1
	[0057.650] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.650] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.651] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.655] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.659] GetFileType (hFile=0x200) returned 0x1
	[0057.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.659] GetFileType (hFile=0x200) returned 0x1
	[0057.660] WriteFile (in: hFile=0x200, lpBuffer=0x2694290*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2694290*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.663] CloseHandle (hObject=0x200) returned 1
	[0057.664] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1
	[0057.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.664] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.664] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.665] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.671] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.672] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1
	[0057.672] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1
	[0057.673] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1
	[0057.673] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.674] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0
	[0057.674] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.677] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.677] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.678] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.681] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.681] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1
	[0057.682] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1
	[0057.682] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1
	[0057.682] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.683] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.683] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.685] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.686] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.689] GetFileType (hFile=0x200) returned 0x1
	[0057.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.689] GetFileType (hFile=0x200) returned 0x1
	[0057.690] WriteFile (in: hFile=0x200, lpBuffer=0x2699454*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2699454*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.693] CloseHandle (hObject=0x200) returned 1
	[0057.693] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1
	[0057.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.694] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.694] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.694] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.700] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.700] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0057.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0057.701] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpFilePart=0x0) returned 0x43
	[0057.701] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpFilePart=0x0) returned 0x44
	[0057.701] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0057.703] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.704] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1
	[0057.704] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0
	[0057.704] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0057.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0057.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0057.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0057.705] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpFilePart=0x0) returned 0x43
	[0057.705] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpFilePart=0x0) returned 0x44
	[0057.705] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0057.706] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.706] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1
	[0057.706] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.707] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0057.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0057.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0057.708] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0057.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0057.708] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0057.709] GetFileType (hFile=0x204) returned 0x1
	[0057.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0057.709] GetFileType (hFile=0x204) returned 0x1
	[0057.710] WriteFile (in: hFile=0x204, lpBuffer=0x269e190*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x269e190*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0057.713] CloseHandle (hObject=0x204) returned 1
	[0057.713] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1
	[0057.713] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1
	[0057.714] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1
	[0057.714] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1
	[0057.714] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1
	[0057.715] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1
	[0057.715] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1
	[0057.715] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1
	[0057.716] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1
	[0057.716] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1
	[0057.716] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0057.717] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1
	[0057.717] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1
	[0057.717] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1
	[0057.718] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.718] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1
	[0057.718] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0
	[0057.719] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.719] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.719] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.720] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.720] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.721] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf3669070, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3669070, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0057.721] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1
	[0057.721] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1
	[0057.722] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1
	[0057.722] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1
	[0057.722] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1
	[0057.723] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1
	[0057.724] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1
	[0057.725] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1
	[0057.725] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1
	[0057.726] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1
	[0057.726] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0057.726] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1
	[0057.727] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1
	[0057.727] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1
	[0057.727] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1
	[0057.728] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1
	[0057.728] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0057.728] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.729] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.729] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.730] GetFileType (hFile=0x200) returned 0x1
	[0057.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.730] GetFileType (hFile=0x200) returned 0x1
	[0057.730] WriteFile (in: hFile=0x200, lpBuffer=0x26a6c1c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x26a6c1c*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.733] CloseHandle (hObject=0x200) returned 1
	[0057.734] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1
	[0057.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.734] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.734] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.735] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.740] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.741] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1
	[0057.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0057.741] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFilePart=0x0) returned 0x4b
	[0057.741] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpFilePart=0x0) returned 0x4c
	[0057.742] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0057.749] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.750] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1
	[0057.750] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1
	[0057.750] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1
	[0057.751] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1
	[0057.751] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0
	[0057.752] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0057.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0057.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0057.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0057.754] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFilePart=0x0) returned 0x4b
	[0057.754] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpFilePart=0x0) returned 0x4c
	[0057.755] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0057.761] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0057.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0057.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0057.764] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Decrypt.txt", lpFilePart=0x0) returned 0x57
	[0057.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0057.764] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0057.767] GetFileType (hFile=0x204) returned 0x1
	[0057.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0057.767] GetFileType (hFile=0x204) returned 0x1
	[0057.767] WriteFile (in: hFile=0x204, lpBuffer=0x26acef0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26acef0*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0057.864] CloseHandle (hObject=0x204) returned 1
	[0057.866] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.866] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.867] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.867] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.868] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.869] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.869] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.870] GetFileType (hFile=0x200) returned 0x1
	[0057.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.870] GetFileType (hFile=0x200) returned 0x1
	[0057.870] WriteFile (in: hFile=0x200, lpBuffer=0x26b1218*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x26b1218*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0057.873] CloseHandle (hObject=0x200) returned 1
	[0057.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.874] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.874] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.874] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.889] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.891] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.891] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.892] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.895] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.898] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.901] GetFileType (hFile=0x200) returned 0x1
	[0057.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.901] GetFileType (hFile=0x200) returned 0x1
	[0057.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.907] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.908] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.908] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.924] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.928] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.928] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.928] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.931] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.934] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.934] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.937] GetFileType (hFile=0x200) returned 0x1
	[0057.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.938] GetFileType (hFile=0x200) returned 0x1
	[0057.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.941] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.941] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.941] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.949] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.952] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e
	[0057.952] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f
	[0057.952] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0057.955] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0057.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0057.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0057.958] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0057.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0057.958] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0057.961] GetFileType (hFile=0x200) returned 0x1
	[0057.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0057.962] GetFileType (hFile=0x200) returned 0x1
	[0057.965] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0057.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0057.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0057.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0057.965] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15
	[0057.966] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\", lpFilePart=0x0) returned 0x16
	[0057.966] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0057.966] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0057.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0057.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0057.967] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\Decrypt.txt", lpFilePart=0x0) returned 0x21
	[0057.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0057.967] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\Decrypt.txt" (normalized: "c:\\msocache\\all users\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0057.982] GetFileType (hFile=0x1fc) returned 0x1
	[0057.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0057.982] GetFileType (hFile=0x1fc) returned 0x1
	[0057.985] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0057.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0057.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0057.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0057.989] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb
	[0057.989] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\", lpFilePart=0x0) returned 0xc
	[0057.989] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0057.990] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0057.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0057.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0057.990] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb68, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\Decrypt.txt", lpFilePart=0x0) returned 0x17
	[0057.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0057.990] CreateFileW (lpFileName="C:\\MSOCache\\Decrypt.txt" (normalized: "c:\\msocache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0057.991] GetFileType (hFile=0x1f0) returned 0x1
	[0057.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f058) returned 1
	[0057.991] GetFileType (hFile=0x1f0) returned 0x1
	[0057.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0057.994] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb
	[0057.994] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\", lpFilePart=0x0) returned 0xc
	[0057.994] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0057.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0057.995] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin", lpFilePart=0x0) returned 0x11
	[0057.995] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\", lpFilePart=0x0) returned 0x12
	[0057.995] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0057.995] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0057.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0057.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0057.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0057.996] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin", lpFilePart=0x0) returned 0x11
	[0057.996] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\", lpFilePart=0x0) returned 0x12
	[0057.997] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0057.997] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0057.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0057.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0057.997] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\Decrypt.txt", lpFilePart=0x0) returned 0x1d
	[0057.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0057.998] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\Decrypt.txt" (normalized: "c:\\perflogs\\admin\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0057.998] GetFileType (hFile=0x1fc) returned 0x1
	[0057.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0057.998] GetFileType (hFile=0x1fc) returned 0x1
	[0058.003] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0058.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0058.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0058.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0058.003] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb
	[0058.004] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\", lpFilePart=0x0) returned 0xc
	[0058.004] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0058.005] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0058.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0058.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0058.005] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb68, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Decrypt.txt", lpFilePart=0x0) returned 0x17
	[0058.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.005] CreateFileW (lpFileName="C:\\PerfLogs\\Decrypt.txt" (normalized: "c:\\perflogs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0058.006] GetFileType (hFile=0x1f0) returned 0x1
	[0058.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f058) returned 1
	[0058.006] GetFileType (hFile=0x1f0) returned 0x1
	[0058.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0058.009] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe
	[0058.009] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\", lpFilePart=0x0) returned 0xf
	[0058.009] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0058.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0058.010] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe", lpFilePart=0x0) returned 0x14
	[0058.010] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\", lpFilePart=0x0) returned 0x15
	[0058.010] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0058.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.011] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x1c
	[0058.011] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x1d
	[0058.011] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.012] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x21
	[0058.012] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x22
	[0058.012] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.013] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2b
	[0058.013] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x2c
	[0058.013] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x34
	[0058.015] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x35
	[0058.015] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0058.016] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0058.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0058.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0058.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x34
	[0058.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x35
	[0058.017] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0058.017] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0058.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0058.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0058.017] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0058.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0058.018] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x20c
	[0058.018] GetFileType (hFile=0x20c) returned 0x1
	[0058.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0058.019] GetFileType (hFile=0x20c) returned 0x1
	[0058.022] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2b
	[0058.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x2c
	[0058.023] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.023] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0058.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0058.024] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0058.024] GetFileType (hFile=0x208) returned 0x1
	[0058.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0058.024] GetFileType (hFile=0x208) returned 0x1
	[0058.027] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.028] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x21
	[0058.028] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x22
	[0058.028] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.028] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.029] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0058.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.029] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Decrypt.txt" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.029] GetFileType (hFile=0x204) returned 0x1
	[0058.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.030] GetFileType (hFile=0x204) returned 0x1
	[0058.033] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.034] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x1c
	[0058.034] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x1d
	[0058.034] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.034] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.034] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0058.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.035] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\Decrypt.txt" (normalized: "c:\\programdata\\adobe\\acrobat\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.035] GetFileType (hFile=0x200) returned 0x1
	[0058.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.036] GetFileType (hFile=0x200) returned 0x1
	[0058.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.038] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM", lpFilePart=0x0) returned 0x18
	[0058.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x19
	[0058.039] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x26
	[0058.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\", lpFilePart=0x0) returned 0x27
	[0058.040] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.047] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.050] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x26
	[0058.050] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\", lpFilePart=0x0) returned 0x27
	[0058.050] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.052] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.055] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt", lpFilePart=0x0) returned 0x32
	[0058.055] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.059] GetFileType (hFile=0x204) returned 0x1
	[0058.059] GetFileType (hFile=0x204) returned 0x1
	[0058.063] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.063] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM", lpFilePart=0x0) returned 0x18
	[0058.063] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x19
	[0058.063] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.063] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.064] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0058.064] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Decrypt.txt" (normalized: "c:\\programdata\\adobe\\arm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.064] GetFileType (hFile=0x200) returned 0x1
	[0058.064] GetFileType (hFile=0x200) returned 0x1
	[0058.068] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0058.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe", lpFilePart=0x0) returned 0x14
	[0058.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\", lpFilePart=0x0) returned 0x15
	[0058.069] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0058.069] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0058.070] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Decrypt.txt", lpFilePart=0x0) returned 0x20
	[0058.070] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Decrypt.txt" (normalized: "c:\\programdata\\adobe\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0058.070] GetFileType (hFile=0x1fc) returned 0x1
	[0058.070] GetFileType (hFile=0x1fc) returned 0x1
	[0058.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data", lpFilePart=0x0) returned 0x1f
	[0058.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data\\", lpFilePart=0x0) returned 0x20
	[0058.074] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0058.079] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0058.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0058.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop", lpFilePart=0x0) returned 0x16
	[0058.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop\\", lpFilePart=0x0) returned 0x17
	[0058.080] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0058.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0c0) returned 1
	[0058.085] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0058.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0058.086] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents", lpFilePart=0x0) returned 0x18
	[0058.086] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents\\", lpFilePart=0x0) returned 0x19
	[0058.086] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0058.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0c0) returned 1
	[0058.089] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0058.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0058.090] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites", lpFilePart=0x0) returned 0x18
	[0058.090] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites\\", lpFilePart=0x0) returned 0x19
	[0058.090] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Favorites\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0058.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0c0) returned 1
	[0058.094] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0058.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0058.094] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18
	[0058.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\", lpFilePart=0x0) returned 0x19
	[0058.096] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0058.096] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.097] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1
	[0058.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.098] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23
	[0058.098] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x24
	[0058.098] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.099] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.099] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1
	[0058.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.100] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a
	[0058.100] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2b
	[0058.100] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.101] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.101] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1
	[0058.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.102] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e
	[0058.102] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x2f
	[0058.102] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.103] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.103] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0058.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.103] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34
	[0058.104] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x35
	[0058.104] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0058.112] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.114] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 1
	[0058.114] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 1
	[0058.115] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 1
	[0058.115] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 1
	[0058.116] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 1
	[0058.116] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 1
	[0058.117] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 1
	[0058.117] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 0
	[0058.118] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0058.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0058.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0058.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34
	[0058.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x35
	[0058.121] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0058.123] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.124] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 1
	[0058.124] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 1
	[0058.125] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 1
	[0058.125] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 1
	[0058.126] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 1
	[0058.126] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 1
	[0058.127] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 1
	[0058.127] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.128] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0058.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0058.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0058.130] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0058.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0058.131] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x20c
	[0058.135] GetFileType (hFile=0x20c) returned 0x1
	[0058.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0058.135] GetFileType (hFile=0x20c) returned 0x1
	[0058.136] WriteFile (in: hFile=0x20c, lpBuffer=0x26f9f00*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26f9f00*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.139] CloseHandle (hObject=0x20c) returned 1
	[0058.139] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.139] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e
	[0058.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x2f
	[0058.140] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.141] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.141] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0058.142] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0058.142] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0058.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0058.143] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0058.143] GetFileType (hFile=0x208) returned 0x1
	[0058.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0058.144] GetFileType (hFile=0x208) returned 0x1
	[0058.144] WriteFile (in: hFile=0x208, lpBuffer=0x26fce84*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26fce84*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0058.147] CloseHandle (hObject=0x208) returned 1
	[0058.147] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.148] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a
	[0058.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2b
	[0058.148] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.149] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.149] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1
	[0058.150] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0
	[0058.150] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.151] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0058.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.151] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.151] GetFileType (hFile=0x204) returned 0x1
	[0058.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.152] GetFileType (hFile=0x204) returned 0x1
	[0058.152] WriteFile (in: hFile=0x204, lpBuffer=0x26ffd70*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26ffd70*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0058.155] CloseHandle (hObject=0x204) returned 1
	[0058.155] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.156] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.156] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23
	[0058.157] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x24
	[0058.157] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.158] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.158] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a936f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a936f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1
	[0058.159] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a936f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a936f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 0
	[0058.159] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.160] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0058.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.160] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\assistance\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.161] GetFileType (hFile=0x200) returned 0x1
	[0058.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.161] GetFileType (hFile=0x200) returned 0x1
	[0058.162] WriteFile (in: hFile=0x200, lpBuffer=0x2702b7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2702b7c*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.165] CloseHandle (hObject=0x200) returned 1
	[0058.165] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0058.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f
	[0058.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x20
	[0058.165] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.166] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.167] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1
	[0058.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23
	[0058.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x24
	[0058.168] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.168] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.169] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0058.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f
	[0058.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x30
	[0058.170] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.171] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.171] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.172] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.172] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f
	[0058.172] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x30
	[0058.173] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.173] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.174] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.174] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.175] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0058.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0058.175] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\machinekeys\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0058.178] GetFileType (hFile=0x208) returned 0x1
	[0058.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0058.178] GetFileType (hFile=0x208) returned 0x1
	[0058.178] WriteFile (in: hFile=0x208, lpBuffer=0x270720c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x270720c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0058.181] CloseHandle (hObject=0x208) returned 1
	[0058.182] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.182] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.183] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23
	[0058.183] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x24
	[0058.183] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.184] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.184] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0058.185] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0
	[0058.185] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.186] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0058.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.186] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.187] GetFileType (hFile=0x204) returned 0x1
	[0058.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.187] GetFileType (hFile=0x204) returned 0x1
	[0058.187] WriteFile (in: hFile=0x204, lpBuffer=0x270a078*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x270a078*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0058.190] CloseHandle (hObject=0x204) returned 1
	[0058.191] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1
	[0058.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.191] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24
	[0058.192] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x25
	[0058.192] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.194] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.195] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.195] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.196] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24
	[0058.196] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x25
	[0058.196] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.197] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.197] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.198] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.198] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0058.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.199] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\keys\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.199] GetFileType (hFile=0x204) returned 0x1
	[0058.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.200] GetFileType (hFile=0x204) returned 0x1
	[0058.200] WriteFile (in: hFile=0x204, lpBuffer=0x270d594*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x270d594*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0058.203] CloseHandle (hObject=0x204) returned 1
	[0058.204] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0058.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.204] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23
	[0058.204] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x24
	[0058.204] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.205] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.206] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0058.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.206] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f
	[0058.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x30
	[0058.207] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.208] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.208] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.209] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f
	[0058.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x30
	[0058.210] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.210] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.211] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.211] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0058.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0058.212] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0058.213] GetFileType (hFile=0x208) returned 0x1
	[0058.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0058.213] GetFileType (hFile=0x208) returned 0x1
	[0058.213] WriteFile (in: hFile=0x208, lpBuffer=0x27114f4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27114f4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0058.216] CloseHandle (hObject=0x208) returned 1
	[0058.216] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0058.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c
	[0058.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x2d
	[0058.217] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.219] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.220] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1
	[0058.222] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 1
	[0058.223] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 0
	[0058.223] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c
	[0058.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x2d
	[0058.224] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.225] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.225] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1
	[0058.226] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 1
	[0058.226] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.227] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.227] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt", lpFilePart=0x0) returned 0x38
	[0058.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0058.227] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0058.233] GetFileType (hFile=0x208) returned 0x1
	[0058.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0058.233] GetFileType (hFile=0x208) returned 0x1
	[0058.234] WriteFile (in: hFile=0x208, lpBuffer=0x2715da0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2715da0*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0058.236] CloseHandle (hObject=0x208) returned 1
	[0058.237] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.237] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.238] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23
	[0058.238] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x24
	[0058.238] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.239] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.239] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b2bc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b2bc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0058.240] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf3b51dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b51dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0058.241] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf3b51dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b51dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0
	[0058.241] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.241] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0058.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.241] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.242] GetFileType (hFile=0x204) returned 0x1
	[0058.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.242] GetFileType (hFile=0x204) returned 0x1
	[0058.243] WriteFile (in: hFile=0x204, lpBuffer=0x2718cec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2718cec*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0058.248] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.249] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.249] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f
	[0058.250] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x20
	[0058.250] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.250] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.251] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1
	[0058.251] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b05b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b05b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1
	[0058.252] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0058.252] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0
	[0058.253] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.253] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0058.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.253] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\crypto\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.255] GetFileType (hFile=0x200) returned 0x1
	[0058.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.255] GetFileType (hFile=0x200) returned 0x1
	[0058.255] WriteFile (in: hFile=0x200, lpBuffer=0x271bbfc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x271bbfc*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.259] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1
	[0058.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.259] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25
	[0058.259] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x26
	[0058.260] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.260] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.261] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1
	[0058.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c
	[0058.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x2d
	[0058.262] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.264] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.264] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1
	[0058.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53
	[0058.265] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x54
	[0058.265] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.269] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.270] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0058.270] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0058.271] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1
	[0058.272] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1
	[0058.272] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1
	[0058.273] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0
	[0058.273] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.276] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53
	[0058.276] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x54
	[0058.276] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.279] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.279] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0058.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x62
	[0058.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0058.280] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c
	[0058.280] GetFileType (hFile=0x20c) returned 0x1
	[0058.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0058.280] GetFileType (hFile=0x20c) returned 0x1
	[0058.281] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x1fad1
	[0058.282] ReadFile (in: hFile=0x20c, lpBuffer=0x35d54d0, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x35d54d0*, lpNumberOfBytesRead=0x26ee84*=0x1fad1, lpOverlapped=0x0) returned 1
	[0058.293] CloseHandle (hObject=0x20c) returned 1
	[0058.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.KEKW", lpFilePart=0x0) returned 0x67
	[0058.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0058.293] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.KEKW" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c
	[0058.296] GetFileType (hFile=0x20c) returned 0x1
	[0058.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0058.296] GetFileType (hFile=0x20c) returned 0x1
	[0058.297] WriteFile (in: hFile=0x20c, lpBuffer=0x2721d38*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2721d38*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0058.300] CloseHandle (hObject=0x20c) returned 1
	[0058.300] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x62
	[0058.301] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0
	[0058.306] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0058.306] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1
	[0058.307] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x5e
	[0058.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0058.307] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c
	[0058.309] GetFileType (hFile=0x20c) returned 0x1
	[0058.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0058.309] GetFileType (hFile=0x20c) returned 0x1
	[0058.310] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xadc8
	[0058.311] ReadFile (in: hFile=0x20c, lpBuffer=0x2723d24, nNumberOfBytesToRead=0xadc8, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2723d24*, lpNumberOfBytesRead=0x26ee84*=0xadc8, lpOverlapped=0x0) returned 1
	[0058.316] CloseHandle (hObject=0x20c) returned 1
	[0058.316] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.KEKW", lpFilePart=0x0) returned 0x63
	[0058.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0058.317] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.KEKW" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c
	[0058.317] GetFileType (hFile=0x20c) returned 0x1
	[0058.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0058.318] GetFileType (hFile=0x20c) returned 0x1
	[0058.318] WriteFile (in: hFile=0x20c, lpBuffer=0x2730250*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2730250*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0058.321] CloseHandle (hObject=0x20c) returned 1
	[0058.351] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x5e
	[0058.351] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0
	[0058.355] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1
	[0058.355] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x5f
	[0058.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0058.355] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c
	[0058.356] GetFileType (hFile=0x20c) returned 0x1
	[0058.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0058.356] GetFileType (hFile=0x20c) returned 0x1
	[0058.356] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x70c1
	[0058.358] ReadFile (in: hFile=0x20c, lpBuffer=0x2731e08, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2731e08*, lpNumberOfBytesRead=0x26ee84*=0x70c1, lpOverlapped=0x0) returned 1
	[0058.382] CloseHandle (hObject=0x20c) returned 1
	[0058.382] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.KEKW", lpFilePart=0x0) returned 0x64
	[0058.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0058.383] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.KEKW" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c
	[0058.383] GetFileType (hFile=0x20c) returned 0x1
	[0058.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0058.384] GetFileType (hFile=0x20c) returned 0x1
	[0058.384] WriteFile (in: hFile=0x20c, lpBuffer=0x273a63c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x273a63c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0058.388] CloseHandle (hObject=0x20c) returned 1
	[0058.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x5f
	[0058.389] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0
	[0058.393] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1
	[0058.394] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x60
	[0058.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0058.394] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c
	[0058.397] GetFileType (hFile=0x20c) returned 0x1
	[0058.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0058.397] GetFileType (hFile=0x20c) returned 0x1
	[0058.397] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x99d3
	[0058.399] ReadFile (in: hFile=0x20c, lpBuffer=0x273c0ac, nNumberOfBytesToRead=0x99d3, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x273c0ac*, lpNumberOfBytesRead=0x26ee84*=0x99d3, lpOverlapped=0x0) returned 1
	[0058.405] CloseHandle (hObject=0x20c) returned 1
	[0058.406] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.KEKW", lpFilePart=0x0) returned 0x65
	[0058.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0058.406] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.KEKW" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c
	[0058.409] GetFileType (hFile=0x20c) returned 0x1
	[0058.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0058.410] GetFileType (hFile=0x20c) returned 0x1
	[0058.410] WriteFile (in: hFile=0x20c, lpBuffer=0x27471f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27471f0*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0058.413] CloseHandle (hObject=0x20c) returned 1
	[0058.414] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x60
	[0058.414] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0
	[0058.418] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.418] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0058.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0058.419] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0058.421] GetFileType (hFile=0x208) returned 0x1
	[0058.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0058.421] GetFileType (hFile=0x208) returned 0x1
	[0058.422] WriteFile (in: hFile=0x208, lpBuffer=0x2749d38*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2749d38*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0058.426] CloseHandle (hObject=0x208) returned 1
	[0058.427] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1
	[0058.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53
	[0058.428] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x54
	[0058.428] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.428] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.429] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0058.430] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0058.430] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1
	[0058.431] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0
	[0058.431] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53
	[0058.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x54
	[0058.432] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.432] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.433] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0058.433] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x62
	[0058.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0058.434] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c
	[0058.434] GetFileType (hFile=0x20c) returned 0x1
	[0058.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0058.434] GetFileType (hFile=0x20c) returned 0x1
	[0058.435] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x1fad1
	[0058.436] ReadFile (in: hFile=0x20c, lpBuffer=0x35f4fc0, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x35f4fc0*, lpNumberOfBytesRead=0x26ee84*=0x1fad1, lpOverlapped=0x0) returned 1
	[0058.447] CloseHandle (hObject=0x20c) returned 1
	[0058.447] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.KEKW", lpFilePart=0x0) returned 0x67
	[0058.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0058.448] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.KEKW" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c
	[0058.452] GetFileType (hFile=0x20c) returned 0x1
	[0058.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0058.453] GetFileType (hFile=0x20c) returned 0x1
	[0058.453] WriteFile (in: hFile=0x20c, lpBuffer=0x274ea00*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x274ea00*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0058.456] CloseHandle (hObject=0x20c) returned 1
	[0058.456] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x62
	[0058.457] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0
	[0058.460] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0058.461] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1
	[0058.461] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x61
	[0058.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0058.461] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c
	[0058.462] GetFileType (hFile=0x20c) returned 0x1
	[0058.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0058.462] GetFileType (hFile=0x20c) returned 0x1
	[0058.462] GetFileSize (in: hFile=0x20c, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x70c1
	[0058.464] ReadFile (in: hFile=0x20c, lpBuffer=0x275093c, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x275093c*, lpNumberOfBytesRead=0x26ee84*=0x70c1, lpOverlapped=0x0) returned 1
	[0058.469] CloseHandle (hObject=0x20c) returned 1
	[0058.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.KEKW", lpFilePart=0x0) returned 0x66
	[0058.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0058.469] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.KEKW" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x20c
	[0058.471] GetFileType (hFile=0x20c) returned 0x1
	[0058.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0058.471] GetFileType (hFile=0x20c) returned 0x1
	[0058.471] WriteFile (in: hFile=0x20c, lpBuffer=0x275917c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x275917c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0058.475] CloseHandle (hObject=0x20c) returned 1
	[0058.475] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x61
	[0058.475] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0
	[0058.478] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.479] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.479] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0058.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0058.480] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0058.480] GetFileType (hFile=0x208) returned 0x1
	[0058.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0058.480] GetFileType (hFile=0x208) returned 0x1
	[0058.481] WriteFile (in: hFile=0x208, lpBuffer=0x275bcc4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x275bcc4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0058.484] CloseHandle (hObject=0x208) returned 1
	[0058.485] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.485] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.485] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c
	[0058.486] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x2d
	[0058.486] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.486] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.487] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3d1ae50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d1ae50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1
	[0058.488] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3db33d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3db33d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1
	[0058.488] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3db33d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3db33d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0
	[0058.489] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.489] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Decrypt.txt", lpFilePart=0x0) returned 0x38
	[0058.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.489] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.491] GetFileType (hFile=0x204) returned 0x1
	[0058.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.491] GetFileType (hFile=0x204) returned 0x1
	[0058.492] WriteFile (in: hFile=0x204, lpBuffer=0x275ef44*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x275ef44*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0058.495] CloseHandle (hObject=0x204) returned 1
	[0058.495] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1
	[0058.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.496] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2a
	[0058.496] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2b
	[0058.496] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.497] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.497] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1
	[0058.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x51
	[0058.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x52
	[0058.499] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.507] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.507] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0058.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.508] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpFilePart=0x0) returned 0x57
	[0058.508] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", lpFilePart=0x0) returned 0x58
	[0058.508] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0058.509] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.509] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0058.510] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0
	[0058.510] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0058.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0058.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0058.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.510] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpFilePart=0x0) returned 0x57
	[0058.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", lpFilePart=0x0) returned 0x58
	[0058.511] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0058.512] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.513] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0058.513] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.513] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0058.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0058.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0058.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0058.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0058.514] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x20c
	[0058.515] GetFileType (hFile=0x20c) returned 0x1
	[0058.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0058.515] GetFileType (hFile=0x20c) returned 0x1
	[0058.516] WriteFile (in: hFile=0x20c, lpBuffer=0x2764cf4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2764cf4*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.518] CloseHandle (hObject=0x20c) returned 1
	[0058.519] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0058.520] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1
	[0058.520] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1
	[0058.520] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0058.521] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1
	[0058.521] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1
	[0058.522] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1
	[0058.522] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0058.523] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1
	[0058.523] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0
	[0058.524] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x51
	[0058.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x52
	[0058.525] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.525] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.526] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3dff690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dff690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0058.526] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0058.526] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1
	[0058.527] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1
	[0058.527] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0058.528] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1
	[0058.528] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1
	[0058.529] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1
	[0058.529] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0058.529] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1
	[0058.530] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.530] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.530] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0058.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0058.531] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0058.531] GetFileType (hFile=0x208) returned 0x1
	[0058.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0058.532] GetFileType (hFile=0x208) returned 0x1
	[0058.532] WriteFile (in: hFile=0x208, lpBuffer=0x276ba10*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x276ba10*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0058.535] CloseHandle (hObject=0x208) returned 1
	[0058.546] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1
	[0058.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.547] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x51
	[0058.547] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x52
	[0058.548] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.553] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.554] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0058.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.555] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpFilePart=0x0) returned 0x57
	[0058.555] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", lpFilePart=0x0) returned 0x58
	[0058.555] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0058.556] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.557] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0058.557] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0
	[0058.558] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0058.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0058.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0058.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.558] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpFilePart=0x0) returned 0x57
	[0058.558] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", lpFilePart=0x0) returned 0x58
	[0058.559] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0058.560] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.561] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0058.561] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.561] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0058.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0058.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0058.562] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0058.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0058.562] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x20c
	[0058.567] GetFileType (hFile=0x20c) returned 0x1
	[0058.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0058.567] GetFileType (hFile=0x20c) returned 0x1
	[0058.568] WriteFile (in: hFile=0x20c, lpBuffer=0x2770f3c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2770f3c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.571] CloseHandle (hObject=0x20c) returned 1
	[0058.571] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0058.572] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1
	[0058.572] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1
	[0058.573] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1
	[0058.573] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1
	[0058.574] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1
	[0058.574] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1
	[0058.575] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0058.575] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0
	[0058.576] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.576] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x51
	[0058.578] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x52
	[0058.578] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.578] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.579] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3e97c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e97c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0058.579] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0058.580] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1
	[0058.580] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1
	[0058.581] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1
	[0058.581] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1
	[0058.582] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1
	[0058.582] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1
	[0058.583] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0058.583] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.584] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.584] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0058.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0058.584] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0058.585] GetFileType (hFile=0x208) returned 0x1
	[0058.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0058.585] GetFileType (hFile=0x208) returned 0x1
	[0058.585] WriteFile (in: hFile=0x208, lpBuffer=0x27777c0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27777c0*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0058.588] CloseHandle (hObject=0x208) returned 1
	[0058.589] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.589] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.590] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2a
	[0058.590] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2b
	[0058.590] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.591] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.591] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3e257f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e257f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1
	[0058.592] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1
	[0058.592] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0
	[0058.593] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.593] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0058.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.594] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.594] GetFileType (hFile=0x204) returned 0x1
	[0058.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.594] GetFileType (hFile=0x204) returned 0x1
	[0058.595] WriteFile (in: hFile=0x204, lpBuffer=0x277a9f4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x277a9f4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0058.601] CloseHandle (hObject=0x204) returned 1
	[0058.601] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.602] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.602] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25
	[0058.602] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x26
	[0058.603] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.603] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.604] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3dd9530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dd9530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1
	[0058.604] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1
	[0058.605] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0
	[0058.605] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0058.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.606] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\device stage\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.608] GetFileType (hFile=0x200) returned 0x1
	[0058.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.608] GetFileType (hFile=0x200) returned 0x1
	[0058.609] WriteFile (in: hFile=0x200, lpBuffer=0x277d934*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x277d934*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.612] CloseHandle (hObject=0x200) returned 1
	[0058.613] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1
	[0058.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x23
	[0058.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x24
	[0058.613] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.616] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.617] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.617] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.618] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x23
	[0058.618] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x24
	[0058.618] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.619] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.619] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.620] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.620] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0058.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.621] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\devicesync\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.621] GetFileType (hFile=0x200) returned 0x1
	[0058.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.622] GetFileType (hFile=0x200) returned 0x1
	[0058.622] WriteFile (in: hFile=0x200, lpBuffer=0x2780e24*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2780e24*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.625] CloseHandle (hObject=0x200) returned 1
	[0058.626] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1
	[0058.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.626] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM", lpFilePart=0x0) returned 0x1c
	[0058.626] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x1d
	[0058.626] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.628] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.628] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1
	[0058.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.629] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x23
	[0058.629] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x24
	[0058.629] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.630] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.631] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.631] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.632] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x23
	[0058.632] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x24
	[0058.633] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.633] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.634] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.634] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.635] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0058.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.635] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\drm\\server\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.635] GetFileType (hFile=0x204) returned 0x1
	[0058.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.636] GetFileType (hFile=0x204) returned 0x1
	[0058.636] WriteFile (in: hFile=0x204, lpBuffer=0x27849c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27849c8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0058.642] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.642] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.643] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM", lpFilePart=0x0) returned 0x1c
	[0058.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x1d
	[0058.644] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.644] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.645] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f30190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f30190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1
	[0058.645] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f30190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f30190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0
	[0058.646] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0058.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.646] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\drm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.648] GetFileType (hFile=0x200) returned 0x1
	[0058.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.648] GetFileType (hFile=0x200) returned 0x1
	[0058.648] WriteFile (in: hFile=0x200, lpBuffer=0x27876f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27876f0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.652] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1
	[0058.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.652] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome", lpFilePart=0x0) returned 0x1e
	[0058.652] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x1f
	[0058.652] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.653] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.654] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1
	[0058.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.654] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x23
	[0058.654] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x24
	[0058.655] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.656] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.656] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.656] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.657] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x23
	[0058.657] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x24
	[0058.657] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.658] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.658] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.659] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.659] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0058.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.660] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\ehome\\logs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.660] GetFileType (hFile=0x204) returned 0x1
	[0058.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.660] GetFileType (hFile=0x204) returned 0x1
	[0058.661] WriteFile (in: hFile=0x204, lpBuffer=0x278b2d0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x278b2d0*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0058.664] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.664] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.665] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome", lpFilePart=0x0) returned 0x1e
	[0058.665] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x1f
	[0058.665] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.665] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.666] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1
	[0058.666] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0
	[0058.667] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\Decrypt.txt", lpFilePart=0x0) returned 0x2a
	[0058.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.667] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\ehome\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.668] GetFileType (hFile=0x200) returned 0x1
	[0058.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.668] GetFileType (hFile=0x200) returned 0x1
	[0058.669] WriteFile (in: hFile=0x200, lpBuffer=0x278e02c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x278e02c*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.671] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0058.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x25
	[0058.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x26
	[0058.672] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.675] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.676] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1
	[0058.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2b
	[0058.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x2c
	[0058.676] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.677] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.677] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1
	[0058.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x44
	[0058.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x45
	[0058.678] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.679] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.679] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.679] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x44
	[0058.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x45
	[0058.681] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0058.681] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.681] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.682] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0058.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0058.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0058.682] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0058.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0058.683] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\applicationviewsrootnode\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0058.685] GetFileType (hFile=0x208) returned 0x1
	[0058.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0058.686] GetFileType (hFile=0x208) returned 0x1
	[0058.687] WriteFile (in: hFile=0x208, lpBuffer=0x2792db4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2792db4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0058.689] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.690] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.690] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2b
	[0058.690] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x2c
	[0058.690] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.691] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.691] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fa25b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fa25b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1
	[0058.692] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fa25b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fa25b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0
	[0058.692] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.692] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0058.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.692] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.693] GetFileType (hFile=0x204) returned 0x1
	[0058.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.693] GetFileType (hFile=0x204) returned 0x1
	[0058.694] WriteFile (in: hFile=0x204, lpBuffer=0x2795da0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2795da0*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0058.700] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.700] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.700] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x25
	[0058.700] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x26
	[0058.701] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.701] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.702] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1
	[0058.702] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0
	[0058.702] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.703] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0058.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.703] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\event viewer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.704] GetFileType (hFile=0x200) returned 0x1
	[0058.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.704] GetFileType (hFile=0x200) returned 0x1
	[0058.704] WriteFile (in: hFile=0x200, lpBuffer=0x2798be0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2798be0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.708] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1
	[0058.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x24
	[0058.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x25
	[0058.708] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.709] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.710] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1
	[0058.710] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1
	[0058.710] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0
	[0058.711] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.711] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x24
	[0058.711] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x25
	[0058.712] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.712] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.712] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1
	[0058.713] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1
	[0058.713] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.714] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0058.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.714] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\identitycrl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.717] GetFileType (hFile=0x200) returned 0x1
	[0058.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.717] GetFileType (hFile=0x200) returned 0x1
	[0058.718] WriteFile (in: hFile=0x200, lpBuffer=0x279c994*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x279c994*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.721] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0058.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x25
	[0058.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x26
	[0058.722] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.723] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.724] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.724] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x25
	[0058.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x26
	[0058.725] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.725] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.726] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.726] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0058.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.727] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\media player\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.727] GetFileType (hFile=0x200) returned 0x1
	[0058.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.728] GetFileType (hFile=0x200) returned 0x1
	[0058.728] WriteFile (in: hFile=0x200, lpBuffer=0x279ff00*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x279ff00*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.731] CloseHandle (hObject=0x200) returned 1
	[0058.731] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1
	[0058.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.732] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF", lpFilePart=0x0) returned 0x1b
	[0058.732] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x1c
	[0058.732] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.733] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.734] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1
	[0058.735] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1
	[0058.735] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 0
	[0058.736] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.736] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF", lpFilePart=0x0) returned 0x1b
	[0058.736] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x1c
	[0058.736] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.737] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.738] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1
	[0058.738] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1
	[0058.738] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.739] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Decrypt.txt", lpFilePart=0x0) returned 0x27
	[0058.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.739] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\mf\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.740] GetFileType (hFile=0x200) returned 0x1
	[0058.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.740] GetFileType (hFile=0x200) returned 0x1
	[0058.741] WriteFile (in: hFile=0x200, lpBuffer=0x27a38a0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27a38a0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.744] CloseHandle (hObject=0x200) returned 1
	[0058.745] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1
	[0058.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.745] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x1d
	[0058.745] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x1e
	[0058.745] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.746] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.747] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1
	[0058.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.749] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x21
	[0058.749] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x22
	[0058.750] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.750] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.751] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.751] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x21
	[0058.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x22
	[0058.752] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.753] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.754] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.754] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0058.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.755] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\msdn\\8.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.758] GetFileType (hFile=0x204) returned 0x1
	[0058.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.758] GetFileType (hFile=0x204) returned 0x1
	[0058.758] WriteFile (in: hFile=0x204, lpBuffer=0x27a73d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27a73d8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0058.761] CloseHandle (hObject=0x204) returned 1
	[0058.762] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.762] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.763] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x1d
	[0058.763] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x1e
	[0058.763] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.764] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.764] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1
	[0058.765] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 0
	[0058.765] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\Decrypt.txt", lpFilePart=0x0) returned 0x29
	[0058.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.766] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\msdn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.766] GetFileType (hFile=0x200) returned 0x1
	[0058.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.767] GetFileType (hFile=0x200) returned 0x1
	[0058.767] WriteFile (in: hFile=0x200, lpBuffer=0x27aa0f8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27aa0f8*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.771] CloseHandle (hObject=0x200) returned 1
	[0058.772] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1
	[0058.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.772] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x25
	[0058.773] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x26
	[0058.773] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.777] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.778] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1
	[0058.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.778] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x35
	[0058.778] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x36
	[0058.778] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.780] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.780] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.780] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.781] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x35
	[0058.781] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x36
	[0058.781] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.782] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.782] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.783] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.783] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0058.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.784] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\netframework\\breadcrumbstore\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.787] GetFileType (hFile=0x204) returned 0x1
	[0058.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.787] GetFileType (hFile=0x204) returned 0x1
	[0058.788] WriteFile (in: hFile=0x204, lpBuffer=0x27ae238*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27ae238*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0058.790] CloseHandle (hObject=0x204) returned 1
	[0058.791] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0058.791] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.792] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x25
	[0058.792] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x26
	[0058.792] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.793] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.794] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1
	[0058.794] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0
	[0058.795] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0058.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0058.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0058.795] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0058.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0058.795] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\netframework\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0058.798] GetFileType (hFile=0x200) returned 0x1
	[0058.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0058.798] GetFileType (hFile=0x200) returned 0x1
	[0058.799] WriteFile (in: hFile=0x200, lpBuffer=0x27b1108*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27b1108*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0058.802] CloseHandle (hObject=0x200) returned 1
	[0058.802] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1
	[0058.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0058.803] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network", lpFilePart=0x0) returned 0x20
	[0058.803] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x21
	[0058.803] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0058.804] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.805] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1
	[0058.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x2c
	[0058.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x2d
	[0058.805] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.807] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.808] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.808] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.809] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x2c
	[0058.809] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x2d
	[0058.809] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.810] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.810] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0058.811] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.811] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\Decrypt.txt", lpFilePart=0x0) returned 0x38
	[0058.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0058.811] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\network\\connections\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0058.812] GetFileType (hFile=0x204) returned 0x1
	[0058.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0058.812] GetFileType (hFile=0x204) returned 0x1
	[0058.813] WriteFile (in: hFile=0x204, lpBuffer=0x27b4f8c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27b4f8c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0058.816] CloseHandle (hObject=0x204) returned 1
	[0058.816] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1
	[0058.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.817] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2b
	[0058.817] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x2c
	[0058.817] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.818] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.819] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr0.dat", cAlternateFileName="")) returned 1
	[0058.819] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 1
	[0058.820] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0
	[0058.820] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0058.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0058.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0058.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0058.821] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2b
	[0058.821] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x2c
	[0058.821] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0058.822] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.823] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr0.dat", cAlternateFileName="")) returned 1
	[0058.823] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat", lpFilePart=0x0) returned 0x35
	[0058.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0058.823] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr0.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0058.824] GetFileType (hFile=0x208) returned 0x1
	[0058.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0058.824] GetFileType (hFile=0x208) returned 0x1
	[0058.824] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x400000
	[0058.859] ReadFile (in: hFile=0x208, lpBuffer=0x3614ab0, nNumberOfBytesToRead=0x400000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x3614ab0*, lpNumberOfBytesRead=0x26ef24*=0x400000, lpOverlapped=0x0) returned 1
	[0059.185] CloseHandle (hObject=0x208) returned 1
	[0059.185] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat.KEKW", lpFilePart=0x0) returned 0x3a
	[0059.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0059.186] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat.KEKW" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr0.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0059.188] GetFileType (hFile=0x208) returned 0x1
	[0059.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0059.188] GetFileType (hFile=0x208) returned 0x1
	[0059.189] WriteFile (in: hFile=0x208, lpBuffer=0x27b8d08*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27b8d08*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0059.192] CloseHandle (hObject=0x208) returned 1
	[0059.192] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat", lpFilePart=0x0) returned 0x35
	[0059.193] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr0.dat")) returned 1
	[0059.218] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 1
	[0059.219] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat", lpFilePart=0x0) returned 0x35
	[0059.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0059.219] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr1.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0059.219] GetFileType (hFile=0x208) returned 0x1
	[0059.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0059.220] GetFileType (hFile=0x208) returned 0x1
	[0059.220] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x400000
	[0059.347] ReadFile (in: hFile=0x208, lpBuffer=0x3a14ad0, nNumberOfBytesToRead=0x400000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x3a14ad0*, lpNumberOfBytesRead=0x26ef24*=0x400000, lpOverlapped=0x0) returned 1
	[0059.951] CloseHandle (hObject=0x208) returned 1
	[0059.951] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat.KEKW", lpFilePart=0x0) returned 0x3a
	[0059.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0059.951] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat.KEKW" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr1.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0059.952] GetFileType (hFile=0x208) returned 0x1
	[0059.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0059.952] GetFileType (hFile=0x208) returned 0x1
	[0059.954] WriteFile (in: hFile=0x208, lpBuffer=0x25dd57c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25dd57c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0059.957] CloseHandle (hObject=0x208) returned 1
	[0059.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat", lpFilePart=0x0) returned 0x35
	[0059.958] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr1.dat")) returned 1
	[0059.988] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0059.988] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0059.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0059.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0059.989] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0059.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0059.989] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0059.990] GetFileType (hFile=0x204) returned 0x1
	[0059.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0059.990] GetFileType (hFile=0x204) returned 0x1
	[0059.991] WriteFile (in: hFile=0x204, lpBuffer=0x25dfeb8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x25dfeb8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0059.994] CloseHandle (hObject=0x204) returned 1
	[0059.995] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0059.995] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0059.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0059.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0059.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0059.996] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network", lpFilePart=0x0) returned 0x20
	[0059.996] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x21
	[0059.996] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0059.997] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.997] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf40d30b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40d30b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1
	[0059.998] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1
	[0059.998] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0
	[0059.999] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0059.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0059.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0059.999] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0059.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0059.999] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\network\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0060.000] GetFileType (hFile=0x200) returned 0x1
	[0060.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0060.000] GetFileType (hFile=0x200) returned 0x1
	[0060.001] WriteFile (in: hFile=0x200, lpBuffer=0x25e2df0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25e2df0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0060.004] CloseHandle (hObject=0x200) returned 1
	[0060.005] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1
	[0060.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0060.005] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x1f
	[0060.005] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x20
	[0060.005] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0060.013] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.014] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1
	[0060.014] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1
	[0060.015] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1
	[0060.015] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySite.ico", cAlternateFileName="")) returned 1
	[0060.016] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1
	[0060.017] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1
	[0060.017] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1
	[0060.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.018] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2a
	[0060.018] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2b
	[0060.018] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.020] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.021] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1
	[0060.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0060.021] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x2f
	[0060.022] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x30
	[0060.022] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0060.028] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.031] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1
	[0060.031] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1
	[0060.032] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1
	[0060.033] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1
	[0060.033] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1
	[0060.034] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1
	[0060.034] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1
	[0060.035] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1
	[0060.036] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1
	[0060.036] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1
	[0060.037] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1
	[0060.037] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1
	[0060.038] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1
	[0060.039] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1
	[0060.039] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1
	[0060.040] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1
	[0060.040] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1
	[0060.041] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1
	[0060.041] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1
	[0060.042] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1
	[0060.043] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1
	[0060.043] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1
	[0060.044] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1
	[0060.044] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1
	[0060.045] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1
	[0060.046] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1
	[0060.046] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1
	[0060.047] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0
	[0060.047] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0060.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0060.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0060.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0060.051] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x2f
	[0060.051] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x30
	[0060.051] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0060.054] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.055] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1
	[0060.055] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1
	[0060.055] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1
	[0060.056] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1
	[0060.056] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1
	[0060.057] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1
	[0060.057] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1
	[0060.058] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1
	[0060.058] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1
	[0060.059] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1
	[0060.059] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1
	[0060.060] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1
	[0060.060] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1
	[0060.061] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1
	[0060.061] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1
	[0060.062] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1
	[0060.062] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1
	[0060.063] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1
	[0060.063] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1
	[0060.064] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1
	[0060.064] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1
	[0060.065] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1
	[0060.065] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1
	[0060.066] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1
	[0060.066] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1
	[0060.066] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1
	[0060.067] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1
	[0060.067] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.068] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0060.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0060.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0060.070] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0060.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0060.071] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0060.078] GetFileType (hFile=0x208) returned 0x1
	[0060.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0060.078] GetFileType (hFile=0x208) returned 0x1
	[0060.083] WriteFile (in: hFile=0x208, lpBuffer=0x25de344*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x25de344*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0060.086] CloseHandle (hObject=0x208) returned 1
	[0060.087] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1
	[0060.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0060.088] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x2f
	[0060.088] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x30
	[0060.088] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0060.094] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.097] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1
	[0060.098] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xb960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1
	[0060.099] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x39960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1
	[0060.099] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x47d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1
	[0060.100] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1
	[0060.101] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x248aaf00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x248aaf00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x16f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1
	[0060.101] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25bbdc00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25bbdc00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2b2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1
	[0060.102] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3564d600, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3564d600, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1
	[0060.102] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63b88300, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63b88300, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1
	[0060.103] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62875600, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62875600, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1
	[0060.104] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x35960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1
	[0060.104] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x9f560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1
	[0060.105] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x315ed100, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x315ed100, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1
	[0060.106] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a4a9400, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1a4a9400, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0xd160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1
	[0060.106] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19196700, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x19196700, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0x43560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1
	[0060.107] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1
	[0060.107] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57655500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57655500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x87f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1
	[0060.108] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2720b500, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2720b500, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x57f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1
	[0060.109] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x94d0df00, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x94d0df00, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1
	[0060.109] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca190500, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xca190500, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1
	[0060.110] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1
	[0060.110] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70273800, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x70273800, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x73960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1
	[0060.111] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1789a00, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa1789a00, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x24360, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1
	[0060.111] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a9c700, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2a9c700, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x110b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1
	[0060.112] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x23960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1
	[0060.113] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x126760, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1
	[0060.113] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1
	[0060.114] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0
	[0060.115] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0060.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0060.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0060.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0060.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x2f
	[0060.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x30
	[0060.119] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0060.122] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.122] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1
	[0060.123] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xb960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1
	[0060.123] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x39960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1
	[0060.124] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x47d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1
	[0060.124] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1
	[0060.125] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x248aaf00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x248aaf00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x16f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1
	[0060.126] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25bbdc00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25bbdc00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2b2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1
	[0060.126] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3564d600, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3564d600, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1
	[0060.127] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63b88300, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63b88300, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1
	[0060.127] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62875600, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62875600, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1
	[0060.128] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x35960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1
	[0060.128] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x9f560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1
	[0060.129] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x315ed100, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x315ed100, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1
	[0060.129] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a4a9400, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1a4a9400, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0xd160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1
	[0060.130] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19196700, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x19196700, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0x43560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1
	[0060.130] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1
	[0060.131] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57655500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57655500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x87f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1
	[0060.131] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2720b500, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2720b500, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x57f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1
	[0060.132] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x94d0df00, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x94d0df00, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1
	[0060.132] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca190500, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xca190500, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1
	[0060.133] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1
	[0060.133] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70273800, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x70273800, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x73960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1
	[0060.134] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1789a00, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa1789a00, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x24360, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1
	[0060.134] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a9c700, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2a9c700, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x110b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1
	[0060.135] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x23960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1
	[0060.135] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x126760, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1
	[0060.136] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1
	[0060.136] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.137] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0060.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0060.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0060.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0060.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0060.140] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0060.146] GetFileType (hFile=0x208) returned 0x1
	[0060.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0060.147] GetFileType (hFile=0x208) returned 0x1
	[0060.147] WriteFile (in: hFile=0x208, lpBuffer=0x25eafe8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x25eafe8*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0060.150] CloseHandle (hObject=0x208) returned 1
	[0060.151] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.151] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0060.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0060.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0060.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.152] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2a
	[0060.152] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2b
	[0060.152] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.153] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.153] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4ce0010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4ce0010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1
	[0060.154] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1
	[0060.154] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 0
	[0060.155] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0060.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0060.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0060.155] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0060.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0060.156] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0060.157] GetFileType (hFile=0x204) returned 0x1
	[0060.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0060.157] GetFileType (hFile=0x204) returned 0x1
	[0060.157] WriteFile (in: hFile=0x204, lpBuffer=0x25edfe0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x25edfe0*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0060.161] CloseHandle (hObject=0x204) returned 1
	[0060.161] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.161] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0060.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0060.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0060.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0060.162] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x1f
	[0060.162] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x20
	[0060.162] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0060.163] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.164] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1
	[0060.164] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1
	[0060.165] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1
	[0060.165] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySite.ico", cAlternateFileName="")) returned 1
	[0060.166] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1
	[0060.166] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1
	[0060.167] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1
	[0060.167] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 0
	[0060.168] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0060.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0060.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0060.168] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0060.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0060.168] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\office\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0060.169] GetFileType (hFile=0x200) returned 0x1
	[0060.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0060.169] GetFileType (hFile=0x200) returned 0x1
	[0060.170] WriteFile (in: hFile=0x200, lpBuffer=0x25f2078*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25f2078*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0060.173] CloseHandle (hObject=0x200) returned 1
	[0060.173] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1
	[0060.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0060.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x39
	[0060.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3a
	[0060.174] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0060.175] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.176] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0060.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x3f
	[0060.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x40
	[0060.177] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.180] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.180] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache.dat", cAlternateFileName="")) returned 1
	[0060.181] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache.dat", cAlternateFileName="")) returned 0
	[0060.182] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0060.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0060.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0060.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.182] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x3f
	[0060.182] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x40
	[0060.183] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.183] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.184] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache.dat", cAlternateFileName="")) returned 1
	[0060.185] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat", lpFilePart=0x0) returned 0x49
	[0060.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0060.185] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0060.186] GetFileType (hFile=0x208) returned 0x1
	[0060.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0060.186] GetFileType (hFile=0x208) returned 0x1
	[0060.186] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x40270
	[0060.189] ReadFile (in: hFile=0x208, lpBuffer=0x35d54d0, nNumberOfBytesToRead=0x40270, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x35d54d0*, lpNumberOfBytesRead=0x26ef24*=0x40270, lpOverlapped=0x0) returned 1
	[0060.205] CloseHandle (hObject=0x208) returned 1
	[0060.205] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat.KEKW", lpFilePart=0x0) returned 0x4e
	[0060.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0060.205] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat.KEKW" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0060.206] GetFileType (hFile=0x208) returned 0x1
	[0060.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0060.206] GetFileType (hFile=0x208) returned 0x1
	[0060.207] WriteFile (in: hFile=0x208, lpBuffer=0x25f6da0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25f6da0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0060.210] CloseHandle (hObject=0x208) returned 1
	[0060.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat", lpFilePart=0x0) returned 0x49
	[0060.211] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat")) returned 1
	[0060.221] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.221] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0060.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0060.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0060.222] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0060.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0060.222] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0060.223] GetFileType (hFile=0x204) returned 0x1
	[0060.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0060.223] GetFileType (hFile=0x204) returned 0x1
	[0060.223] WriteFile (in: hFile=0x204, lpBuffer=0x25f94d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x25f94d8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0060.226] CloseHandle (hObject=0x204) returned 1
	[0060.227] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 1
	[0060.227] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 0
	[0060.228] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0060.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0060.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0060.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0060.228] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x39
	[0060.229] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3a
	[0060.229] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0060.229] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.230] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4e5cdd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4e5cdd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0060.230] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 1
	[0060.231] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat", lpFilePart=0x0) returned 0x44
	[0060.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0060.231] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0060.234] GetFileType (hFile=0x204) returned 0x1
	[0060.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0060.234] GetFileType (hFile=0x204) returned 0x1
	[0060.234] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x469bd5
	[0060.273] ReadFile (in: hFile=0x204, lpBuffer=0x3e14af0, nNumberOfBytesToRead=0x469bd5, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x3e14af0*, lpNumberOfBytesRead=0x26efc4*=0x469bd5, lpOverlapped=0x0) returned 1
	[0060.720] CloseHandle (hObject=0x204) returned 1
	[0060.720] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.KEKW", lpFilePart=0x0) returned 0x49
	[0060.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0060.720] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.KEKW" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0060.727] GetFileType (hFile=0x204) returned 0x1
	[0060.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0060.728] GetFileType (hFile=0x204) returned 0x1
	[0060.728] WriteFile (in: hFile=0x204, lpBuffer=0x25fcc64*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x25fcc64*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0060.731] CloseHandle (hObject=0x204) returned 1
	[0060.731] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat", lpFilePart=0x0) returned 0x44
	[0060.732] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat")) returned 1
	[0060.744] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.745] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0060.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0060.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0060.745] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0060.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0060.745] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0060.746] GetFileType (hFile=0x200) returned 0x1
	[0060.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0060.746] GetFileType (hFile=0x200) returned 0x1
	[0060.747] WriteFile (in: hFile=0x200, lpBuffer=0x25ff37c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25ff37c*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0060.751] CloseHandle (hObject=0x200) returned 1
	[0060.752] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1
	[0060.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0060.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC", lpFilePart=0x0) returned 0x1c
	[0060.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x1d
	[0060.753] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0060.753] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.754] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outbound", cAlternateFileName="")) returned 1
	[0060.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.754] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x25
	[0060.754] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x26
	[0060.755] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.756] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.756] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0060.757] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0060.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0060.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0060.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.757] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x25
	[0060.757] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x26
	[0060.758] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.758] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.759] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0060.759] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0060.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0060.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0060.759] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0060.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0060.760] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\rac\\outbound\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0060.760] GetFileType (hFile=0x204) returned 0x1
	[0060.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0060.760] GetFileType (hFile=0x204) returned 0x1
	[0060.761] WriteFile (in: hFile=0x204, lpBuffer=0x2602f9c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2602f9c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0060.764] CloseHandle (hObject=0x204) returned 1
	[0060.764] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed601570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1
	[0060.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2a
	[0060.767] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2b
	[0060.767] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed601570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.768] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed601570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.768] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed673990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 1
	[0060.769] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed673990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0
	[0060.769] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0060.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0060.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0060.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2a
	[0060.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2b
	[0060.770] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed601570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.771] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed601570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.771] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed673990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 1
	[0060.772] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.772] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0060.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0060.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0060.772] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0060.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0060.773] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\rac\\publisheddata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0060.773] GetFileType (hFile=0x204) returned 0x1
	[0060.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0060.773] GetFileType (hFile=0x204) returned 0x1
	[0060.774] WriteFile (in: hFile=0x204, lpBuffer=0x2606b8c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2606b8c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0060.779] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xed5db410, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed5db410, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1
	[0060.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.779] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x26
	[0060.779] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x27
	[0060.779] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xed5db410, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed601570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.780] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xed5db410, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed601570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.781] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb35800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xecb35800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xbddb7d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 1
	[0060.781] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 1
	[0060.782] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 0
	[0060.782] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0060.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0060.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0060.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.783] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x26
	[0060.783] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x27
	[0060.783] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed601570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.783] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed601570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.784] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb35800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xecb35800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xbddb7d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 1
	[0060.784] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 1
	[0060.785] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat", lpFilePart=0x0) returned 0x36
	[0060.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0060.785] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racmetadata.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0060.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dca8) returned 1
	[0060.801] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.802] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0060.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0060.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0060.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\Decrypt.txt", lpFilePart=0x0) returned 0x32
	[0060.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0060.803] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0060.803] GetFileType (hFile=0x204) returned 0x1
	[0060.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0060.804] GetFileType (hFile=0x204) returned 0x1
	[0060.804] WriteFile (in: hFile=0x204, lpBuffer=0x260b1fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x260b1fc*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0060.806] CloseHandle (hObject=0x204) returned 1
	[0060.807] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xef0eee50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xef0eee50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0060.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.808] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x21
	[0060.808] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x22
	[0060.808] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xef0eee50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xef0eee50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.808] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xef0eee50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xef0eee50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.809] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeedcf170, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xeedcf170, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xeef72090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlD9E9.tmp", cAlternateFileName="")) returned 1
	[0060.809] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef0eee50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xef0eee50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xef0eee50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlDB32.tmp", cAlternateFileName="")) returned 1
	[0060.810] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef0eee50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xef0eee50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xef0eee50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlDB32.tmp", cAlternateFileName="")) returned 0
	[0060.810] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0060.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0060.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0060.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.811] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x21
	[0060.811] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x22
	[0060.811] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xef0eee50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xef0eee50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.813] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xef0eee50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xef0eee50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.814] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeedcf170, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xeedcf170, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xeef72090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlD9E9.tmp", cAlternateFileName="")) returned 1
	[0060.814] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef0eee50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xef0eee50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xef0eee50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlDB32.tmp", cAlternateFileName="")) returned 1
	[0060.814] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.815] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0060.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0060.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0060.815] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0060.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0060.815] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0060.822] GetFileType (hFile=0x204) returned 0x1
	[0060.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0060.822] GetFileType (hFile=0x204) returned 0x1
	[0060.823] WriteFile (in: hFile=0x204, lpBuffer=0x260edb4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x260edb4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0060.826] CloseHandle (hObject=0x204) returned 1
	[0060.826] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.827] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0060.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0060.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0060.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0060.828] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC", lpFilePart=0x0) returned 0x1c
	[0060.828] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x1d
	[0060.828] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0060.829] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.829] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf536bc90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf536bc90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outbound", cAlternateFileName="")) returned 1
	[0060.830] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5391df0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5391df0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1
	[0060.831] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53de0b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf53de0b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1
	[0060.831] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5404210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5404210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0060.832] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5404210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5404210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0060.832] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0060.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0060.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0060.832] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0060.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0060.833] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\rac\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0060.838] GetFileType (hFile=0x200) returned 0x1
	[0060.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0060.838] GetFileType (hFile=0x200) returned 0x1
	[0060.839] WriteFile (in: hFile=0x200, lpBuffer=0x2611de0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2611de0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0060.841] CloseHandle (hObject=0x200) returned 1
	[0060.842] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1
	[0060.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0060.842] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search", lpFilePart=0x0) returned 0x1f
	[0060.843] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x20
	[0060.843] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0060.846] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.846] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0060.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0060.847] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x24
	[0060.847] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\", lpFilePart=0x0) returned 0x25
	[0060.847] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0060.848] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.848] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1
	[0060.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0060.849] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x31
	[0060.849] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\", lpFilePart=0x0) returned 0x32
	[0060.849] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0060.859] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.859] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0060.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0060.860] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows", lpFilePart=0x0) returned 0x39
	[0060.860] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\", lpFilePart=0x0) returned 0x3a
	[0060.860] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0060.868] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.869] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config", cAlternateFileName="")) returned 1
	[0060.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0060.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config", lpFilePart=0x0) returned 0x40
	[0060.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\", lpFilePart=0x0) returned 0x41
	[0060.870] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0060.870] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.871] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0060.871] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0060.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0060.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0060.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0060.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config", lpFilePart=0x0) returned 0x40
	[0060.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\", lpFilePart=0x0) returned 0x41
	[0060.872] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0060.873] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.873] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0060.874] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0060.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0060.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0060.875] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0060.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0060.875] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\config\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0060.877] GetFileType (hFile=0x224) returned 0x1
	[0060.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0060.878] GetFileType (hFile=0x224) returned 0x1
	[0060.878] WriteFile (in: hFile=0x224, lpBuffer=0x2617c44*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2617c44*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0060.881] CloseHandle (hObject=0x224) returned 1
	[0060.881] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherLogs", cAlternateFileName="GATHER~1")) returned 1
	[0060.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0060.882] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs", lpFilePart=0x0) returned 0x44
	[0060.882] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\", lpFilePart=0x0) returned 0x45
	[0060.882] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0060.884] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.885] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1
	[0060.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0060.885] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex", lpFilePart=0x0) returned 0x50
	[0060.885] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\", lpFilePart=0x0) returned 0x51
	[0060.886] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0060.888] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.889] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.Crwl", cAlternateFileName="SYSTEM~1.CRW")) returned 1
	[0060.890] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 1
	[0060.890] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 0
	[0060.891] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0060.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0060.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0060.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0060.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex", lpFilePart=0x0) returned 0x50
	[0060.892] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\", lpFilePart=0x0) returned 0x51
	[0060.892] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0060.892] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.893] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.Crwl", cAlternateFileName="SYSTEM~1.CRW")) returned 1
	[0060.893] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 1
	[0060.894] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.894] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0060.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0060.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0060.894] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt", lpFilePart=0x0) returned 0x5c
	[0060.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0060.895] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0060.899] GetFileType (hFile=0x228) returned 0x1
	[0060.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0060.899] GetFileType (hFile=0x228) returned 0x1
	[0060.899] WriteFile (in: hFile=0x228, lpBuffer=0x261d634*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x261d634*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0060.902] CloseHandle (hObject=0x228) returned 1
	[0060.903] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.903] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0060.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0060.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0060.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0060.904] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs", lpFilePart=0x0) returned 0x44
	[0060.904] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\", lpFilePart=0x0) returned 0x45
	[0060.904] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0060.905] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.906] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54c28f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54c28f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1
	[0060.906] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54c28f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54c28f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0
	[0060.907] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0060.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0060.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0060.907] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0060.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0060.908] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0060.909] GetFileType (hFile=0x224) returned 0x1
	[0060.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0060.910] GetFileType (hFile=0x224) returned 0x1
	[0060.910] WriteFile (in: hFile=0x224, lpBuffer=0x2620914*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2620914*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0060.913] CloseHandle (hObject=0x224) returned 1
	[0060.913] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.chk", cAlternateFileName="")) returned 1
	[0060.914] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295a0600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295a0600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.log", cAlternateFileName="")) returned 1
	[0060.914] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295c6760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295c6760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00001.jrs", cAlternateFileName="MSSRES~1.JRS")) returned 1
	[0060.915] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295ec8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295ec8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00002.jrs", cAlternateFileName="MSSRES~2.JRS")) returned 1
	[0060.916] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects", cAlternateFileName="")) returned 1
	[0060.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0060.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects", lpFilePart=0x0) returned 0x42
	[0060.916] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\", lpFilePart=0x0) returned 0x43
	[0060.916] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0060.917] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.918] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1
	[0060.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0060.918] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex", lpFilePart=0x0) returned 0x4e
	[0060.918] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\", lpFilePart=0x0) returned 0x4f
	[0060.919] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0060.924] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.924] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexer", cAlternateFileName="")) returned 1
	[0060.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0060.925] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer", lpFilePart=0x0) returned 0x56
	[0060.925] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\", lpFilePart=0x0) returned 0x57
	[0060.925] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0060.927] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.927] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiFiles", cAlternateFileName="")) returned 1
	[0060.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0060.928] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles", lpFilePart=0x0) returned 0x5e
	[0060.928] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\", lpFilePart=0x0) returned 0x5f
	[0060.928] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0060.934] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.935] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299f0de0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299f0de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.000", cAlternateFileName="")) returned 1
	[0060.935] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.001", cAlternateFileName="")) returned 1
	[0060.936] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.002", cAlternateFileName="")) returned 1
	[0060.936] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.000", cAlternateFileName="")) returned 1
	[0060.937] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.001", cAlternateFileName="")) returned 1
	[0060.937] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.002", cAlternateFileName="")) returned 1
	[0060.938] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299f0de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.000", cAlternateFileName="")) returned 1
	[0060.938] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.001", cAlternateFileName="")) returned 1
	[0060.939] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.002", cAlternateFileName="")) returned 1
	[0060.939] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.000", cAlternateFileName="")) returned 1
	[0060.940] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.001", cAlternateFileName="")) returned 1
	[0060.941] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.002", cAlternateFileName="")) returned 1
	[0060.941] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 1
	[0060.942] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 0
	[0060.942] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0060.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0060.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0060.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0060.945] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles", lpFilePart=0x0) returned 0x5e
	[0060.945] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\", lpFilePart=0x0) returned 0x5f
	[0060.945] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0060.948] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.949] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299f0de0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299f0de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.000", cAlternateFileName="")) returned 1
	[0060.949] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.001", cAlternateFileName="")) returned 1
	[0060.950] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.002", cAlternateFileName="")) returned 1
	[0060.950] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.000", cAlternateFileName="")) returned 1
	[0060.950] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.001", cAlternateFileName="")) returned 1
	[0060.951] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.002", cAlternateFileName="")) returned 1
	[0060.951] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299f0de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.000", cAlternateFileName="")) returned 1
	[0060.951] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.001", cAlternateFileName="")) returned 1
	[0060.953] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.002", cAlternateFileName="")) returned 1
	[0060.953] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.000", cAlternateFileName="")) returned 1
	[0060.954] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.001", cAlternateFileName="")) returned 1
	[0060.954] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.002", cAlternateFileName="")) returned 1
	[0060.954] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 1
	[0060.955] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.955] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0060.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0060.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0060.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0060.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0060.958] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0060.961] GetFileType (hFile=0x230) returned 0x1
	[0060.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0060.962] GetFileType (hFile=0x230) returned 0x1
	[0060.962] WriteFile (in: hFile=0x230, lpBuffer=0x262d3f4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x262d3f4*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0060.965] CloseHandle (hObject=0x230) returned 1
	[0060.966] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.966] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0060.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0060.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0060.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0060.967] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer", lpFilePart=0x0) returned 0x56
	[0060.967] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\", lpFilePart=0x0) returned 0x57
	[0060.967] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0060.968] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.969] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf555ae70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf555ae70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiFiles", cAlternateFileName="")) returned 1
	[0060.969] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf555ae70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf555ae70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiFiles", cAlternateFileName="")) returned 0
	[0060.969] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0060.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0060.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0060.970] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0060.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0060.970] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0060.971] GetFileType (hFile=0x22c) returned 0x1
	[0060.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0060.971] GetFileType (hFile=0x22c) returned 0x1
	[0060.971] WriteFile (in: hFile=0x22c, lpBuffer=0x26308d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26308d8*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0060.974] CloseHandle (hObject=0x22c) returned 1
	[0060.975] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PropMap", cAlternateFileName="")) returned 1
	[0060.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0060.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap", lpFilePart=0x0) returned 0x56
	[0060.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\", lpFilePart=0x0) returned 0x57
	[0060.976] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0060.976] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.977] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.000", cAlternateFileName="")) returned 1
	[0060.977] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.001", cAlternateFileName="")) returned 1
	[0060.978] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.002", cAlternateFileName="")) returned 1
	[0060.978] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.002", cAlternateFileName="")) returned 0
	[0060.979] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0060.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0060.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0060.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0060.979] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap", lpFilePart=0x0) returned 0x56
	[0060.979] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\", lpFilePart=0x0) returned 0x57
	[0060.979] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0060.980] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.981] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.000", cAlternateFileName="")) returned 1
	[0060.981] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.001", cAlternateFileName="")) returned 1
	[0060.981] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.002", cAlternateFileName="")) returned 1
	[0060.982] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0060.982] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0060.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0060.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0060.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0060.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0060.983] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0060.985] GetFileType (hFile=0x22c) returned 0x1
	[0060.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0060.985] GetFileType (hFile=0x22c) returned 0x1
	[0060.986] WriteFile (in: hFile=0x22c, lpBuffer=0x2635dcc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2635dcc*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0060.994] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecStore", cAlternateFileName="")) returned 1
	[0060.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0060.995] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore", lpFilePart=0x0) returned 0x57
	[0060.995] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\", lpFilePart=0x0) returned 0x58
	[0060.995] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0060.996] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.997] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.000", cAlternateFileName="")) returned 1
	[0060.997] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.001", cAlternateFileName="")) returned 1
	[0060.998] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.002", cAlternateFileName="")) returned 1
	[0060.998] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.002", cAlternateFileName="")) returned 0
	[0060.998] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0061.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0061.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0061.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0061.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore", lpFilePart=0x0) returned 0x57
	[0061.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\", lpFilePart=0x0) returned 0x58
	[0061.001] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0061.002] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.002] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.000", cAlternateFileName="")) returned 1
	[0061.002] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.001", cAlternateFileName="")) returned 1
	[0061.003] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.002", cAlternateFileName="")) returned 1
	[0061.003] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0061.003] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0061.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0061.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0061.003] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0061.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0061.004] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0061.004] GetFileType (hFile=0x22c) returned 0x1
	[0061.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0061.005] GetFileType (hFile=0x22c) returned 0x1
	[0061.005] WriteFile (in: hFile=0x22c, lpBuffer=0x263b32c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x263b32c*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0061.008] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0061.008] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0061.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0061.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0061.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0061.012] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex", lpFilePart=0x0) returned 0x4e
	[0061.012] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\", lpFilePart=0x0) returned 0x4f
	[0061.012] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0061.013] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.013] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5580fd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5580fd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexer", cAlternateFileName="")) returned 1
	[0061.013] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55a7130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55a7130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PropMap", cAlternateFileName="")) returned 1
	[0061.014] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55cd290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55cd290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecStore", cAlternateFileName="")) returned 1
	[0061.014] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55cd290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55cd290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecStore", cAlternateFileName="")) returned 0
	[0061.016] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0061.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0061.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0061.016] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0061.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0061.016] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0061.017] GetFileType (hFile=0x228) returned 0x1
	[0061.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0061.017] GetFileType (hFile=0x228) returned 0x1
	[0061.017] WriteFile (in: hFile=0x228, lpBuffer=0x263ea58*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x263ea58*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0061.021] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0061.021] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0061.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0061.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0061.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0061.022] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects", lpFilePart=0x0) returned 0x42
	[0061.022] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\", lpFilePart=0x0) returned 0x43
	[0061.022] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0061.023] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.023] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1
	[0061.024] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0
	[0061.024] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0061.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0061.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0061.025] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0061.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0061.025] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\projects\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0061.028] GetFileType (hFile=0x224) returned 0x1
	[0061.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0061.029] GetFileType (hFile=0x224) returned 0x1
	[0061.029] WriteFile (in: hFile=0x224, lpBuffer=0x2641cf4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2641cf4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0061.032] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.edb", cAlternateFileName="")) returned 1
	[0061.032] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.edb", cAlternateFileName="")) returned 0
	[0061.032] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0061.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0061.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0061.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0061.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows", lpFilePart=0x0) returned 0x39
	[0061.033] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\", lpFilePart=0x0) returned 0x3a
	[0061.033] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0061.034] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.034] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf549c790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf549c790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config", cAlternateFileName="")) returned 1
	[0061.035] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54e8a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54e8a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherLogs", cAlternateFileName="GATHER~1")) returned 1
	[0061.035] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.chk", cAlternateFileName="")) returned 1
	[0061.035] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295a0600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295a0600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.log", cAlternateFileName="")) returned 1
	[0061.035] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295c6760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295c6760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00001.jrs", cAlternateFileName="MSSRES~1.JRS")) returned 1
	[0061.036] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295ec8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295ec8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00002.jrs", cAlternateFileName="MSSRES~2.JRS")) returned 1
	[0061.036] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects", cAlternateFileName="")) returned 1
	[0061.037] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.edb", cAlternateFileName="")) returned 1
	[0061.037] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0061.037] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0061.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0061.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0061.037] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0061.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0061.038] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\windows\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0061.038] GetFileType (hFile=0x220) returned 0x1
	[0061.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0061.038] GetFileType (hFile=0x220) returned 0x1
	[0061.039] WriteFile (in: hFile=0x220, lpBuffer=0x26464b0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26464b0*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0061.041] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0061.041] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0061.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0061.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0061.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0061.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x31
	[0061.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\", lpFilePart=0x0) returned 0x32
	[0061.042] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0061.042] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.043] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0061.043] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0
	[0061.044] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0061.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0061.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0061.044] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0061.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0061.044] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0061.045] GetFileType (hFile=0x208) returned 0x1
	[0061.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0061.045] GetFileType (hFile=0x208) returned 0x1
	[0061.046] WriteFile (in: hFile=0x208, lpBuffer=0x2649498*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2649498*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0061.057] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e1ecc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0061.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0061.057] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x29
	[0061.057] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2a
	[0061.057] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0061.058] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.058] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0061.059] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0061.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0061.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0061.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0061.059] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x29
	[0061.059] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2a
	[0061.059] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0061.060] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.061] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0061.061] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0061.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0061.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0061.062] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0061.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0061.062] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\temp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0061.063] GetFileType (hFile=0x208) returned 0x1
	[0061.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0061.063] GetFileType (hFile=0x208) returned 0x1
	[0061.063] WriteFile (in: hFile=0x208, lpBuffer=0x264cac4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x264cac4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0061.066] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0061.066] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0061.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0061.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0061.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0061.067] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x24
	[0061.067] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\", lpFilePart=0x0) returned 0x25
	[0061.067] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0061.067] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.068] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1
	[0061.068] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0061.069] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0061.069] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0061.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0061.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0061.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0061.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0061.069] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\data\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0061.071] GetFileType (hFile=0x204) returned 0x1
	[0061.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0061.071] GetFileType (hFile=0x204) returned 0x1
	[0061.072] WriteFile (in: hFile=0x204, lpBuffer=0x264fa28*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x264fa28*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0061.075] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0061.075] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0061.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0061.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0061.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0061.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search", lpFilePart=0x0) returned 0x1f
	[0061.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x20
	[0061.075] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0061.076] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.076] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0061.077] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0
	[0061.077] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0061.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0061.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0061.078] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0061.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0061.078] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\search\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0061.078] GetFileType (hFile=0x200) returned 0x1
	[0061.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0061.079] GetFileType (hFile=0x200) returned 0x1
	[0061.079] WriteFile (in: hFile=0x200, lpBuffer=0x265279c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x265279c*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0061.082] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1
	[0061.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0061.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x2e
	[0061.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x2f
	[0061.082] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0061.083] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.083] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 1
	[0061.084] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1
	[0061.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0061.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x3f
	[0061.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x40
	[0061.084] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0061.089] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.089] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile10.bmp", cAlternateFileName="")) returned 1
	[0061.090] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile11.bmp", cAlternateFileName="")) returned 1
	[0061.090] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile12.bmp", cAlternateFileName="")) returned 1
	[0061.091] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile13.bmp", cAlternateFileName="")) returned 1
	[0061.091] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile14.bmp", cAlternateFileName="")) returned 1
	[0061.091] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile15.bmp", cAlternateFileName="")) returned 1
	[0061.092] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile16.bmp", cAlternateFileName="")) returned 1
	[0061.092] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile17.bmp", cAlternateFileName="")) returned 1
	[0061.092] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile18.bmp", cAlternateFileName="")) returned 1
	[0061.093] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile19.bmp", cAlternateFileName="")) returned 1
	[0061.093] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile20.bmp", cAlternateFileName="")) returned 1
	[0061.094] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile21.bmp", cAlternateFileName="")) returned 1
	[0061.094] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile22.bmp", cAlternateFileName="")) returned 1
	[0061.094] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile23.bmp", cAlternateFileName="")) returned 1
	[0061.095] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile24.bmp", cAlternateFileName="")) returned 1
	[0061.095] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile25.bmp", cAlternateFileName="")) returned 1
	[0061.095] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile26.bmp", cAlternateFileName="")) returned 1
	[0061.096] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile27.bmp", cAlternateFileName="")) returned 1
	[0061.096] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile28.bmp", cAlternateFileName="")) returned 1
	[0061.096] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile29.bmp", cAlternateFileName="")) returned 1
	[0061.097] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile30.bmp", cAlternateFileName="")) returned 1
	[0061.097] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile31.bmp", cAlternateFileName="")) returned 1
	[0061.097] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile32.bmp", cAlternateFileName="")) returned 1
	[0061.098] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile33.bmp", cAlternateFileName="")) returned 1
	[0061.098] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile34.bmp", cAlternateFileName="")) returned 1
	[0061.099] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile35.bmp", cAlternateFileName="")) returned 1
	[0061.099] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile36.bmp", cAlternateFileName="")) returned 1
	[0061.099] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile37.bmp", cAlternateFileName="")) returned 1
	[0061.100] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile38.bmp", cAlternateFileName="")) returned 1
	[0061.100] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile39.bmp", cAlternateFileName="")) returned 1
	[0061.100] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae607689, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae607689, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc50c9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile40.bmp", cAlternateFileName="")) returned 1
	[0061.100] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae62d7e6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae62d7e6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddcc30b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile41.bmp", cAlternateFileName="")) returned 1
	[0061.101] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddce9217, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile42.bmp", cAlternateFileName="")) returned 1
	[0061.101] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd0f375, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile43.bmp", cAlternateFileName="")) returned 1
	[0061.101] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 1
	[0061.102] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 0
	[0061.102] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0061.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0061.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0061.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0061.105] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x3f
	[0061.105] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x40
	[0061.105] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0061.108] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.108] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile10.bmp", cAlternateFileName="")) returned 1
	[0061.109] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", lpFilePart=0x0) returned 0x4e
	[0061.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.109] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.110] GetFileType (hFile=0x208) returned 0x1
	[0061.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.110] GetFileType (hFile=0x208) returned 0x1
	[0061.111] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.111] ReadFile (in: hFile=0x208, lpBuffer=0x2659494, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2659494*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.117] CloseHandle (hObject=0x208) returned 1
	[0061.117] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.117] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile10.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.120] GetFileType (hFile=0x208) returned 0x1
	[0061.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.120] GetFileType (hFile=0x208) returned 0x1
	[0061.121] WriteFile (in: hFile=0x208, lpBuffer=0x2666bf8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2666bf8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.124] CloseHandle (hObject=0x208) returned 1
	[0061.126] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", lpFilePart=0x0) returned 0x4e
	[0061.126] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile10.bmp")) returned 0
	[0061.131] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile11.bmp", cAlternateFileName="")) returned 1
	[0061.131] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", lpFilePart=0x0) returned 0x4e
	[0061.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.131] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile11.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.132] GetFileType (hFile=0x208) returned 0x1
	[0061.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.132] GetFileType (hFile=0x208) returned 0x1
	[0061.132] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.133] ReadFile (in: hFile=0x208, lpBuffer=0x2668558, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2668558*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.138] CloseHandle (hObject=0x208) returned 1
	[0061.139] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.139] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile11.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.140] GetFileType (hFile=0x208) returned 0x1
	[0061.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.140] GetFileType (hFile=0x208) returned 0x1
	[0061.141] WriteFile (in: hFile=0x208, lpBuffer=0x2675cbc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2675cbc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.144] CloseHandle (hObject=0x208) returned 1
	[0061.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", lpFilePart=0x0) returned 0x4e
	[0061.145] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile11.bmp")) returned 0
	[0061.148] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile12.bmp", cAlternateFileName="")) returned 1
	[0061.149] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", lpFilePart=0x0) returned 0x4e
	[0061.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.149] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile12.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.149] GetFileType (hFile=0x208) returned 0x1
	[0061.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.150] GetFileType (hFile=0x208) returned 0x1
	[0061.150] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.150] ReadFile (in: hFile=0x208, lpBuffer=0x267761c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x267761c*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.157] CloseHandle (hObject=0x208) returned 1
	[0061.157] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.157] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile12.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.159] GetFileType (hFile=0x208) returned 0x1
	[0061.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.159] GetFileType (hFile=0x208) returned 0x1
	[0061.160] WriteFile (in: hFile=0x208, lpBuffer=0x2684d80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2684d80*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.163] CloseHandle (hObject=0x208) returned 1
	[0061.163] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", lpFilePart=0x0) returned 0x4e
	[0061.164] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile12.bmp")) returned 0
	[0061.167] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile13.bmp", cAlternateFileName="")) returned 1
	[0061.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", lpFilePart=0x0) returned 0x4e
	[0061.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.167] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile13.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.168] GetFileType (hFile=0x208) returned 0x1
	[0061.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.168] GetFileType (hFile=0x208) returned 0x1
	[0061.168] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xbeb8
	[0061.169] ReadFile (in: hFile=0x208, lpBuffer=0x26866e0, nNumberOfBytesToRead=0xbeb8, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26866e0*, lpNumberOfBytesRead=0x26ef24*=0xbeb8, lpOverlapped=0x0) returned 1
	[0061.181] CloseHandle (hObject=0x208) returned 1
	[0061.182] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.182] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile13.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.183] GetFileType (hFile=0x208) returned 0x1
	[0061.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.183] GetFileType (hFile=0x208) returned 0x1
	[0061.183] WriteFile (in: hFile=0x208, lpBuffer=0x2693cc4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2693cc4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.187] CloseHandle (hObject=0x208) returned 1
	[0061.187] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", lpFilePart=0x0) returned 0x4e
	[0061.187] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile13.bmp")) returned 0
	[0061.191] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile14.bmp", cAlternateFileName="")) returned 1
	[0061.191] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", lpFilePart=0x0) returned 0x4e
	[0061.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.192] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile14.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.193] GetFileType (hFile=0x208) returned 0x1
	[0061.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.193] GetFileType (hFile=0x208) returned 0x1
	[0061.193] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.194] ReadFile (in: hFile=0x208, lpBuffer=0x2695624, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2695624*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.199] CloseHandle (hObject=0x208) returned 1
	[0061.199] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.199] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile14.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.200] GetFileType (hFile=0x208) returned 0x1
	[0061.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.200] GetFileType (hFile=0x208) returned 0x1
	[0061.201] WriteFile (in: hFile=0x208, lpBuffer=0x26a2d88*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26a2d88*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.204] CloseHandle (hObject=0x208) returned 1
	[0061.205] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", lpFilePart=0x0) returned 0x4e
	[0061.205] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile14.bmp")) returned 0
	[0061.208] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile15.bmp", cAlternateFileName="")) returned 1
	[0061.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", lpFilePart=0x0) returned 0x4e
	[0061.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.209] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile15.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.209] GetFileType (hFile=0x208) returned 0x1
	[0061.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.210] GetFileType (hFile=0x208) returned 0x1
	[0061.210] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.210] ReadFile (in: hFile=0x208, lpBuffer=0x26a46e8, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26a46e8*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.218] CloseHandle (hObject=0x208) returned 1
	[0061.218] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.218] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile15.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.219] GetFileType (hFile=0x208) returned 0x1
	[0061.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.219] GetFileType (hFile=0x208) returned 0x1
	[0061.220] WriteFile (in: hFile=0x208, lpBuffer=0x26b1e4c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26b1e4c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.223] CloseHandle (hObject=0x208) returned 1
	[0061.223] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", lpFilePart=0x0) returned 0x4e
	[0061.224] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile15.bmp")) returned 0
	[0061.227] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile16.bmp", cAlternateFileName="")) returned 1
	[0061.228] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", lpFilePart=0x0) returned 0x4e
	[0061.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.228] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile16.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.228] GetFileType (hFile=0x208) returned 0x1
	[0061.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.229] GetFileType (hFile=0x208) returned 0x1
	[0061.229] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.229] ReadFile (in: hFile=0x208, lpBuffer=0x26b37ac, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26b37ac*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.234] CloseHandle (hObject=0x208) returned 1
	[0061.235] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.235] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile16.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.237] GetFileType (hFile=0x208) returned 0x1
	[0061.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.237] GetFileType (hFile=0x208) returned 0x1
	[0061.238] WriteFile (in: hFile=0x208, lpBuffer=0x26c0f10*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26c0f10*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.240] CloseHandle (hObject=0x208) returned 1
	[0061.241] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", lpFilePart=0x0) returned 0x4e
	[0061.241] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile16.bmp")) returned 0
	[0061.244] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile17.bmp", cAlternateFileName="")) returned 1
	[0061.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", lpFilePart=0x0) returned 0x4e
	[0061.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.245] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile17.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.245] GetFileType (hFile=0x208) returned 0x1
	[0061.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.246] GetFileType (hFile=0x208) returned 0x1
	[0061.246] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.246] ReadFile (in: hFile=0x208, lpBuffer=0x26c2870, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26c2870*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.252] CloseHandle (hObject=0x208) returned 1
	[0061.252] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.252] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile17.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.253] GetFileType (hFile=0x208) returned 0x1
	[0061.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.253] GetFileType (hFile=0x208) returned 0x1
	[0061.253] WriteFile (in: hFile=0x208, lpBuffer=0x26cffd4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26cffd4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.257] CloseHandle (hObject=0x208) returned 1
	[0061.257] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", lpFilePart=0x0) returned 0x4e
	[0061.258] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile17.bmp")) returned 0
	[0061.261] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile18.bmp", cAlternateFileName="")) returned 1
	[0061.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", lpFilePart=0x0) returned 0x4e
	[0061.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.261] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile18.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.266] GetFileType (hFile=0x208) returned 0x1
	[0061.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.266] GetFileType (hFile=0x208) returned 0x1
	[0061.266] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.267] ReadFile (in: hFile=0x208, lpBuffer=0x26d1934, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26d1934*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.271] CloseHandle (hObject=0x208) returned 1
	[0061.272] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.272] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile18.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.273] GetFileType (hFile=0x208) returned 0x1
	[0061.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.273] GetFileType (hFile=0x208) returned 0x1
	[0061.273] WriteFile (in: hFile=0x208, lpBuffer=0x26df098*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26df098*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.278] CloseHandle (hObject=0x208) returned 1
	[0061.279] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", lpFilePart=0x0) returned 0x4e
	[0061.279] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile18.bmp")) returned 0
	[0061.283] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile19.bmp", cAlternateFileName="")) returned 1
	[0061.283] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", lpFilePart=0x0) returned 0x4e
	[0061.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.283] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile19.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.283] GetFileType (hFile=0x208) returned 0x1
	[0061.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.284] GetFileType (hFile=0x208) returned 0x1
	[0061.284] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.284] ReadFile (in: hFile=0x208, lpBuffer=0x26e09f8, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26e09f8*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.289] CloseHandle (hObject=0x208) returned 1
	[0061.289] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.290] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile19.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.290] GetFileType (hFile=0x208) returned 0x1
	[0061.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.290] GetFileType (hFile=0x208) returned 0x1
	[0061.291] WriteFile (in: hFile=0x208, lpBuffer=0x26ee15c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26ee15c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.294] CloseHandle (hObject=0x208) returned 1
	[0061.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", lpFilePart=0x0) returned 0x4e
	[0061.296] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile19.bmp")) returned 0
	[0061.300] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile20.bmp", cAlternateFileName="")) returned 1
	[0061.300] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", lpFilePart=0x0) returned 0x4e
	[0061.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.300] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile20.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.301] GetFileType (hFile=0x208) returned 0x1
	[0061.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.301] GetFileType (hFile=0x208) returned 0x1
	[0061.301] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.302] ReadFile (in: hFile=0x208, lpBuffer=0x26efabc, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26efabc*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.307] CloseHandle (hObject=0x208) returned 1
	[0061.307] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.307] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile20.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.309] GetFileType (hFile=0x208) returned 0x1
	[0061.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.309] GetFileType (hFile=0x208) returned 0x1
	[0061.310] WriteFile (in: hFile=0x208, lpBuffer=0x26fd220*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26fd220*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.313] CloseHandle (hObject=0x208) returned 1
	[0061.314] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", lpFilePart=0x0) returned 0x4e
	[0061.314] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile20.bmp")) returned 0
	[0061.318] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile21.bmp", cAlternateFileName="")) returned 1
	[0061.318] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", lpFilePart=0x0) returned 0x4e
	[0061.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.318] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile21.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.319] GetFileType (hFile=0x208) returned 0x1
	[0061.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.319] GetFileType (hFile=0x208) returned 0x1
	[0061.319] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.320] ReadFile (in: hFile=0x208, lpBuffer=0x26feb80, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26feb80*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.325] CloseHandle (hObject=0x208) returned 1
	[0061.325] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.325] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile21.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.327] GetFileType (hFile=0x208) returned 0x1
	[0061.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.328] GetFileType (hFile=0x208) returned 0x1
	[0061.328] WriteFile (in: hFile=0x208, lpBuffer=0x270c2e4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x270c2e4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.331] CloseHandle (hObject=0x208) returned 1
	[0061.332] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", lpFilePart=0x0) returned 0x4e
	[0061.332] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile21.bmp")) returned 0
	[0061.335] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile22.bmp", cAlternateFileName="")) returned 1
	[0061.336] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", lpFilePart=0x0) returned 0x4e
	[0061.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.336] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile22.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.338] GetFileType (hFile=0x208) returned 0x1
	[0061.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.338] GetFileType (hFile=0x208) returned 0x1
	[0061.338] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.339] ReadFile (in: hFile=0x208, lpBuffer=0x270dc44, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x270dc44*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.344] CloseHandle (hObject=0x208) returned 1
	[0061.344] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.344] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile22.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.345] GetFileType (hFile=0x208) returned 0x1
	[0061.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.345] GetFileType (hFile=0x208) returned 0x1
	[0061.345] WriteFile (in: hFile=0x208, lpBuffer=0x271b3a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x271b3a8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.349] CloseHandle (hObject=0x208) returned 1
	[0061.350] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", lpFilePart=0x0) returned 0x4e
	[0061.350] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile22.bmp")) returned 0
	[0061.353] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile23.bmp", cAlternateFileName="")) returned 1
	[0061.355] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", lpFilePart=0x0) returned 0x4e
	[0061.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.356] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile23.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.356] GetFileType (hFile=0x208) returned 0x1
	[0061.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.356] GetFileType (hFile=0x208) returned 0x1
	[0061.357] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.357] ReadFile (in: hFile=0x208, lpBuffer=0x271cd08, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x271cd08*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.363] CloseHandle (hObject=0x208) returned 1
	[0061.364] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.364] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile23.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.364] GetFileType (hFile=0x208) returned 0x1
	[0061.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.365] GetFileType (hFile=0x208) returned 0x1
	[0061.365] WriteFile (in: hFile=0x208, lpBuffer=0x272a46c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x272a46c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.369] CloseHandle (hObject=0x208) returned 1
	[0061.370] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", lpFilePart=0x0) returned 0x4e
	[0061.370] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile23.bmp")) returned 0
	[0061.422] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile24.bmp", cAlternateFileName="")) returned 1
	[0061.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", lpFilePart=0x0) returned 0x4e
	[0061.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.423] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile24.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.424] GetFileType (hFile=0x208) returned 0x1
	[0061.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.424] GetFileType (hFile=0x208) returned 0x1
	[0061.424] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.425] ReadFile (in: hFile=0x208, lpBuffer=0x272bdcc, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x272bdcc*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.430] CloseHandle (hObject=0x208) returned 1
	[0061.430] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.431] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile24.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.433] GetFileType (hFile=0x208) returned 0x1
	[0061.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.433] GetFileType (hFile=0x208) returned 0x1
	[0061.434] WriteFile (in: hFile=0x208, lpBuffer=0x2739530*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2739530*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.438] CloseHandle (hObject=0x208) returned 1
	[0061.438] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", lpFilePart=0x0) returned 0x4e
	[0061.438] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile24.bmp")) returned 0
	[0061.442] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile25.bmp", cAlternateFileName="")) returned 1
	[0061.442] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", lpFilePart=0x0) returned 0x4e
	[0061.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.443] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile25.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.443] GetFileType (hFile=0x208) returned 0x1
	[0061.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.443] GetFileType (hFile=0x208) returned 0x1
	[0061.444] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.444] ReadFile (in: hFile=0x208, lpBuffer=0x273ae90, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x273ae90*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.450] CloseHandle (hObject=0x208) returned 1
	[0061.450] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.451] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile25.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.451] GetFileType (hFile=0x208) returned 0x1
	[0061.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.452] GetFileType (hFile=0x208) returned 0x1
	[0061.452] WriteFile (in: hFile=0x208, lpBuffer=0x27485f4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27485f4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.455] CloseHandle (hObject=0x208) returned 1
	[0061.456] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", lpFilePart=0x0) returned 0x4e
	[0061.456] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile25.bmp")) returned 0
	[0061.460] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile26.bmp", cAlternateFileName="")) returned 1
	[0061.460] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", lpFilePart=0x0) returned 0x4e
	[0061.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.460] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile26.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.462] GetFileType (hFile=0x208) returned 0x1
	[0061.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.463] GetFileType (hFile=0x208) returned 0x1
	[0061.463] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.463] ReadFile (in: hFile=0x208, lpBuffer=0x2749f54, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2749f54*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.469] CloseHandle (hObject=0x208) returned 1
	[0061.469] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.470] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile26.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.470] GetFileType (hFile=0x208) returned 0x1
	[0061.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.471] GetFileType (hFile=0x208) returned 0x1
	[0061.471] WriteFile (in: hFile=0x208, lpBuffer=0x27576b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27576b8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.474] CloseHandle (hObject=0x208) returned 1
	[0061.475] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", lpFilePart=0x0) returned 0x4e
	[0061.475] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile26.bmp")) returned 0
	[0061.479] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile27.bmp", cAlternateFileName="")) returned 1
	[0061.479] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", lpFilePart=0x0) returned 0x4e
	[0061.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.479] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile27.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.480] GetFileType (hFile=0x208) returned 0x1
	[0061.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.480] GetFileType (hFile=0x208) returned 0x1
	[0061.480] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.481] ReadFile (in: hFile=0x208, lpBuffer=0x2759018, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2759018*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.487] CloseHandle (hObject=0x208) returned 1
	[0061.487] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.488] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile27.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.488] GetFileType (hFile=0x208) returned 0x1
	[0061.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.488] GetFileType (hFile=0x208) returned 0x1
	[0061.489] WriteFile (in: hFile=0x208, lpBuffer=0x276677c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x276677c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.492] CloseHandle (hObject=0x208) returned 1
	[0061.492] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", lpFilePart=0x0) returned 0x4e
	[0061.493] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile27.bmp")) returned 0
	[0061.496] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile28.bmp", cAlternateFileName="")) returned 1
	[0061.496] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", lpFilePart=0x0) returned 0x4e
	[0061.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.497] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile28.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.497] GetFileType (hFile=0x208) returned 0x1
	[0061.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.497] GetFileType (hFile=0x208) returned 0x1
	[0061.498] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.499] ReadFile (in: hFile=0x208, lpBuffer=0x27680dc, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27680dc*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.504] CloseHandle (hObject=0x208) returned 1
	[0061.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.505] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile28.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.509] GetFileType (hFile=0x208) returned 0x1
	[0061.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.509] GetFileType (hFile=0x208) returned 0x1
	[0061.510] WriteFile (in: hFile=0x208, lpBuffer=0x2775840*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2775840*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.513] CloseHandle (hObject=0x208) returned 1
	[0061.513] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", lpFilePart=0x0) returned 0x4e
	[0061.514] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile28.bmp")) returned 0
	[0061.517] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile29.bmp", cAlternateFileName="")) returned 1
	[0061.517] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", lpFilePart=0x0) returned 0x4e
	[0061.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.518] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile29.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.518] GetFileType (hFile=0x208) returned 0x1
	[0061.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.518] GetFileType (hFile=0x208) returned 0x1
	[0061.518] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.519] ReadFile (in: hFile=0x208, lpBuffer=0x27771a0, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27771a0*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.524] CloseHandle (hObject=0x208) returned 1
	[0061.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.524] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile29.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.525] GetFileType (hFile=0x208) returned 0x1
	[0061.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.525] GetFileType (hFile=0x208) returned 0x1
	[0061.525] WriteFile (in: hFile=0x208, lpBuffer=0x2784904*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2784904*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.528] CloseHandle (hObject=0x208) returned 1
	[0061.528] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", lpFilePart=0x0) returned 0x4e
	[0061.529] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile29.bmp")) returned 0
	[0061.532] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile30.bmp", cAlternateFileName="")) returned 1
	[0061.532] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", lpFilePart=0x0) returned 0x4e
	[0061.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.533] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile30.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.535] GetFileType (hFile=0x208) returned 0x1
	[0061.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.535] GetFileType (hFile=0x208) returned 0x1
	[0061.535] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.536] ReadFile (in: hFile=0x208, lpBuffer=0x2786264, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2786264*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.541] CloseHandle (hObject=0x208) returned 1
	[0061.541] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.541] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile30.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.542] GetFileType (hFile=0x208) returned 0x1
	[0061.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.543] GetFileType (hFile=0x208) returned 0x1
	[0061.543] WriteFile (in: hFile=0x208, lpBuffer=0x27939c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27939c8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.548] CloseHandle (hObject=0x208) returned 1
	[0061.549] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", lpFilePart=0x0) returned 0x4e
	[0061.549] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile30.bmp")) returned 0
	[0061.553] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile31.bmp", cAlternateFileName="")) returned 1
	[0061.553] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", lpFilePart=0x0) returned 0x4e
	[0061.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.554] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile31.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.554] GetFileType (hFile=0x208) returned 0x1
	[0061.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.554] GetFileType (hFile=0x208) returned 0x1
	[0061.555] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.555] ReadFile (in: hFile=0x208, lpBuffer=0x2795328, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2795328*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.560] CloseHandle (hObject=0x208) returned 1
	[0061.560] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.561] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile31.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.562] GetFileType (hFile=0x208) returned 0x1
	[0061.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.562] GetFileType (hFile=0x208) returned 0x1
	[0061.562] WriteFile (in: hFile=0x208, lpBuffer=0x27a2a8c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27a2a8c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.565] CloseHandle (hObject=0x208) returned 1
	[0061.566] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", lpFilePart=0x0) returned 0x4e
	[0061.566] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile31.bmp")) returned 0
	[0061.569] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile32.bmp", cAlternateFileName="")) returned 1
	[0061.570] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", lpFilePart=0x0) returned 0x4e
	[0061.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.570] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile32.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.570] GetFileType (hFile=0x208) returned 0x1
	[0061.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.571] GetFileType (hFile=0x208) returned 0x1
	[0061.571] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.571] ReadFile (in: hFile=0x208, lpBuffer=0x27a43ec, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27a43ec*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.587] CloseHandle (hObject=0x208) returned 1
	[0061.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.588] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile32.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.600] GetFileType (hFile=0x208) returned 0x1
	[0061.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.600] GetFileType (hFile=0x208) returned 0x1
	[0061.601] WriteFile (in: hFile=0x208, lpBuffer=0x27b1b50*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27b1b50*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.604] CloseHandle (hObject=0x208) returned 1
	[0061.604] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", lpFilePart=0x0) returned 0x4e
	[0061.605] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile32.bmp")) returned 0
	[0061.608] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile33.bmp", cAlternateFileName="")) returned 1
	[0061.609] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", lpFilePart=0x0) returned 0x4e
	[0061.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.609] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile33.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.609] GetFileType (hFile=0x208) returned 0x1
	[0061.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.610] GetFileType (hFile=0x208) returned 0x1
	[0061.610] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.611] ReadFile (in: hFile=0x208, lpBuffer=0x27b34b0, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27b34b0*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.618] CloseHandle (hObject=0x208) returned 1
	[0061.619] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.619] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile33.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.620] GetFileType (hFile=0x208) returned 0x1
	[0061.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.620] GetFileType (hFile=0x208) returned 0x1
	[0061.621] WriteFile (in: hFile=0x208, lpBuffer=0x27c0c14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27c0c14*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.624] CloseHandle (hObject=0x208) returned 1
	[0061.625] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", lpFilePart=0x0) returned 0x4e
	[0061.625] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile33.bmp")) returned 0
	[0061.629] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile34.bmp", cAlternateFileName="")) returned 1
	[0061.629] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp", lpFilePart=0x0) returned 0x4e
	[0061.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.630] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile34.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.632] GetFileType (hFile=0x208) returned 0x1
	[0061.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.632] GetFileType (hFile=0x208) returned 0x1
	[0061.632] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.634] ReadFile (in: hFile=0x208, lpBuffer=0x27c2574, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27c2574*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.642] CloseHandle (hObject=0x208) returned 1
	[0061.642] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.642] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile34.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.643] GetFileType (hFile=0x208) returned 0x1
	[0061.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.643] GetFileType (hFile=0x208) returned 0x1
	[0061.644] WriteFile (in: hFile=0x208, lpBuffer=0x27cfcd8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27cfcd8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.647] CloseHandle (hObject=0x208) returned 1
	[0061.647] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp", lpFilePart=0x0) returned 0x4e
	[0061.647] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile34.bmp")) returned 0
	[0061.651] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile35.bmp", cAlternateFileName="")) returned 1
	[0061.651] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp", lpFilePart=0x0) returned 0x4e
	[0061.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.652] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile35.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.652] GetFileType (hFile=0x208) returned 0x1
	[0061.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.652] GetFileType (hFile=0x208) returned 0x1
	[0061.653] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.655] ReadFile (in: hFile=0x208, lpBuffer=0x27d1638, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27d1638*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.660] CloseHandle (hObject=0x208) returned 1
	[0061.660] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.660] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile35.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.661] GetFileType (hFile=0x208) returned 0x1
	[0061.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.661] GetFileType (hFile=0x208) returned 0x1
	[0061.672] WriteFile (in: hFile=0x208, lpBuffer=0x25ed238*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25ed238*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.677] CloseHandle (hObject=0x208) returned 1
	[0061.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp", lpFilePart=0x0) returned 0x4e
	[0061.678] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile35.bmp")) returned 0
	[0061.682] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile36.bmp", cAlternateFileName="")) returned 1
	[0061.682] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", lpFilePart=0x0) returned 0x4e
	[0061.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.683] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile36.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.683] GetFileType (hFile=0x208) returned 0x1
	[0061.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.683] GetFileType (hFile=0x208) returned 0x1
	[0061.683] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.684] ReadFile (in: hFile=0x208, lpBuffer=0x25eeb98, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x25eeb98*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.689] CloseHandle (hObject=0x208) returned 1
	[0061.689] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.689] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile36.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.690] GetFileType (hFile=0x208) returned 0x1
	[0061.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.690] GetFileType (hFile=0x208) returned 0x1
	[0061.691] WriteFile (in: hFile=0x208, lpBuffer=0x25fc2fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25fc2fc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.694] CloseHandle (hObject=0x208) returned 1
	[0061.695] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", lpFilePart=0x0) returned 0x4e
	[0061.696] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile36.bmp")) returned 0
	[0061.699] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile37.bmp", cAlternateFileName="")) returned 1
	[0061.700] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp", lpFilePart=0x0) returned 0x4e
	[0061.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.700] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile37.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.701] GetFileType (hFile=0x208) returned 0x1
	[0061.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.701] GetFileType (hFile=0x208) returned 0x1
	[0061.785] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.785] ReadFile (in: hFile=0x208, lpBuffer=0x25fdc5c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x25fdc5c*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.791] CloseHandle (hObject=0x208) returned 1
	[0061.791] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.792] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile37.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.792] GetFileType (hFile=0x208) returned 0x1
	[0061.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0061.793] GetFileType (hFile=0x208) returned 0x1
	[0061.794] WriteFile (in: hFile=0x208, lpBuffer=0x260b3c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x260b3c0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0061.797] CloseHandle (hObject=0x208) returned 1
	[0061.797] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp", lpFilePart=0x0) returned 0x4e
	[0061.797] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile37.bmp")) returned 0
	[0061.801] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile38.bmp", cAlternateFileName="")) returned 1
	[0061.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", lpFilePart=0x0) returned 0x4e
	[0061.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0061.802] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile38.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0061.803] GetFileType (hFile=0x208) returned 0x1
	[0061.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0061.804] GetFileType (hFile=0x208) returned 0x1
	[0061.804] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0061.804] ReadFile (in: hFile=0x208, lpBuffer=0x260cd20, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x260cd20*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0061.809] CloseHandle (hObject=0x208) returned 1
	[0061.809] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0061.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0061.810] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile38.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.092] GetFileType (hFile=0x208) returned 0x1
	[0062.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0062.092] GetFileType (hFile=0x208) returned 0x1
	[0062.327] WriteFile (in: hFile=0x208, lpBuffer=0x25eeefc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25eeefc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0062.331] CloseHandle (hObject=0x208) returned 1
	[0062.332] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", lpFilePart=0x0) returned 0x4e
	[0062.332] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile38.bmp")) returned 0
	[0062.337] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile39.bmp", cAlternateFileName="")) returned 1
	[0062.338] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", lpFilePart=0x0) returned 0x4e
	[0062.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0062.338] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile39.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.338] GetFileType (hFile=0x208) returned 0x1
	[0062.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0062.339] GetFileType (hFile=0x208) returned 0x1
	[0062.339] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0062.339] ReadFile (in: hFile=0x208, lpBuffer=0x25fd834, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x25fd834*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0062.345] CloseHandle (hObject=0x208) returned 1
	[0062.346] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0062.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0062.346] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile39.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.347] GetFileType (hFile=0x208) returned 0x1
	[0062.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0062.347] GetFileType (hFile=0x208) returned 0x1
	[0062.348] WriteFile (in: hFile=0x208, lpBuffer=0x261a670*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x261a670*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0062.351] CloseHandle (hObject=0x208) returned 1
	[0062.351] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", lpFilePart=0x0) returned 0x4e
	[0062.352] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile39.bmp")) returned 0
	[0062.355] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae607689, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae607689, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc50c9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile40.bmp", cAlternateFileName="")) returned 1
	[0062.356] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", lpFilePart=0x0) returned 0x4e
	[0062.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0062.356] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile40.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.357] GetFileType (hFile=0x208) returned 0x1
	[0062.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0062.357] GetFileType (hFile=0x208) returned 0x1
	[0062.357] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0062.358] ReadFile (in: hFile=0x208, lpBuffer=0x261bfd0, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x261bfd0*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0062.364] CloseHandle (hObject=0x208) returned 1
	[0062.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0062.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0062.365] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile40.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.366] GetFileType (hFile=0x208) returned 0x1
	[0062.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0062.366] GetFileType (hFile=0x208) returned 0x1
	[0062.366] WriteFile (in: hFile=0x208, lpBuffer=0x2629734*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2629734*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0062.371] CloseHandle (hObject=0x208) returned 1
	[0062.372] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", lpFilePart=0x0) returned 0x4e
	[0062.372] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile40.bmp")) returned 0
	[0062.376] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae62d7e6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae62d7e6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddcc30b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile41.bmp", cAlternateFileName="")) returned 1
	[0062.377] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", lpFilePart=0x0) returned 0x4e
	[0062.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0062.377] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile41.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.378] GetFileType (hFile=0x208) returned 0x1
	[0062.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0062.378] GetFileType (hFile=0x208) returned 0x1
	[0062.378] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0062.378] ReadFile (in: hFile=0x208, lpBuffer=0x262b094, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x262b094*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0062.384] CloseHandle (hObject=0x208) returned 1
	[0062.384] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0062.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0062.385] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile41.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.385] GetFileType (hFile=0x208) returned 0x1
	[0062.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0062.386] GetFileType (hFile=0x208) returned 0x1
	[0062.386] WriteFile (in: hFile=0x208, lpBuffer=0x26387f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26387f8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0062.389] CloseHandle (hObject=0x208) returned 1
	[0062.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", lpFilePart=0x0) returned 0x4e
	[0062.389] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile41.bmp")) returned 0
	[0062.415] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddce9217, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile42.bmp", cAlternateFileName="")) returned 1
	[0062.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", lpFilePart=0x0) returned 0x4e
	[0062.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0062.416] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile42.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.417] GetFileType (hFile=0x208) returned 0x1
	[0062.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0062.417] GetFileType (hFile=0x208) returned 0x1
	[0062.417] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0062.417] ReadFile (in: hFile=0x208, lpBuffer=0x263a158, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x263a158*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0062.424] CloseHandle (hObject=0x208) returned 1
	[0062.425] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0062.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0062.425] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile42.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.428] GetFileType (hFile=0x208) returned 0x1
	[0062.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0062.428] GetFileType (hFile=0x208) returned 0x1
	[0062.429] WriteFile (in: hFile=0x208, lpBuffer=0x26478bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26478bc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0062.432] CloseHandle (hObject=0x208) returned 1
	[0062.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", lpFilePart=0x0) returned 0x4e
	[0062.432] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile42.bmp")) returned 0
	[0062.436] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd0f375, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile43.bmp", cAlternateFileName="")) returned 1
	[0062.436] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", lpFilePart=0x0) returned 0x4e
	[0062.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0062.437] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile43.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.437] GetFileType (hFile=0x208) returned 0x1
	[0062.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0062.437] GetFileType (hFile=0x208) returned 0x1
	[0062.437] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0062.438] ReadFile (in: hFile=0x208, lpBuffer=0x264921c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x264921c*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0062.445] CloseHandle (hObject=0x208) returned 1
	[0062.445] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0062.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0062.445] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile43.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.446] GetFileType (hFile=0x208) returned 0x1
	[0062.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0062.446] GetFileType (hFile=0x208) returned 0x1
	[0062.447] WriteFile (in: hFile=0x208, lpBuffer=0x2656980*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2656980*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0062.450] CloseHandle (hObject=0x208) returned 1
	[0062.450] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", lpFilePart=0x0) returned 0x4e
	[0062.450] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile43.bmp")) returned 0
	[0062.454] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 1
	[0062.454] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp", lpFilePart=0x0) returned 0x4e
	[0062.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0062.455] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile44.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.455] GetFileType (hFile=0x208) returned 0x1
	[0062.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0062.455] GetFileType (hFile=0x208) returned 0x1
	[0062.455] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc038
	[0062.455] ReadFile (in: hFile=0x208, lpBuffer=0x26582e0, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26582e0*, lpNumberOfBytesRead=0x26ef24*=0xc038, lpOverlapped=0x0) returned 1
	[0062.461] CloseHandle (hObject=0x208) returned 1
	[0062.461] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp.KEKW", lpFilePart=0x0) returned 0x53
	[0062.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0062.461] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile44.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.462] GetFileType (hFile=0x208) returned 0x1
	[0062.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0062.462] GetFileType (hFile=0x208) returned 0x1
	[0062.463] WriteFile (in: hFile=0x208, lpBuffer=0x2665a44*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2665a44*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0062.467] CloseHandle (hObject=0x208) returned 1
	[0062.467] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp", lpFilePart=0x0) returned 0x4e
	[0062.467] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile44.bmp")) returned 0
	[0062.471] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.471] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.472] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0062.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.472] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0062.473] GetFileType (hFile=0x204) returned 0x1
	[0062.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0062.473] GetFileType (hFile=0x204) returned 0x1
	[0062.473] WriteFile (in: hFile=0x204, lpBuffer=0x26684f4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26684f4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0062.476] CloseHandle (hObject=0x204) returned 1
	[0062.477] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1
	[0062.477] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1
	[0062.478] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 0
	[0062.478] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0062.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0062.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0062.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0062.479] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x2e
	[0062.479] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x2f
	[0062.479] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0062.480] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.480] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 1
	[0062.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat", lpFilePart=0x0) returned 0x47
	[0062.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0062.481] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0062.483] GetFileType (hFile=0x204) returned 0x1
	[0062.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0062.483] GetFileType (hFile=0x204) returned 0x1
	[0062.483] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x0
	[0062.484] CloseHandle (hObject=0x204) returned 1
	[0062.484] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat.KEKW", lpFilePart=0x0) returned 0x4c
	[0062.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0062.484] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0062.485] GetFileType (hFile=0x204) returned 0x1
	[0062.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0062.485] GetFileType (hFile=0x204) returned 0x1
	[0062.486] WriteFile (in: hFile=0x204, lpBuffer=0x266bbd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x266bbd0*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0062.489] CloseHandle (hObject=0x204) returned 1
	[0062.489] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat", lpFilePart=0x0) returned 0x47
	[0062.490] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat")) returned 1
	[0062.490] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf63a3270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63a3270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1
	[0062.491] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1
	[0062.491] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", lpFilePart=0x0) returned 0x38
	[0062.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0062.492] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0062.492] GetFileType (hFile=0x204) returned 0x1
	[0062.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0062.493] GetFileType (hFile=0x204) returned 0x1
	[0062.493] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xc038
	[0062.493] ReadFile (in: hFile=0x204, lpBuffer=0x266d210, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x266d210*, lpNumberOfBytesRead=0x26efc4*=0xc038, lpOverlapped=0x0) returned 1
	[0062.498] CloseHandle (hObject=0x204) returned 1
	[0062.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.KEKW", lpFilePart=0x0) returned 0x3d
	[0062.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0062.499] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0062.499] GetFileType (hFile=0x204) returned 0x1
	[0062.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0062.500] GetFileType (hFile=0x204) returned 0x1
	[0062.500] WriteFile (in: hFile=0x204, lpBuffer=0x267a914*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x267a914*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0062.503] CloseHandle (hObject=0x204) returned 1
	[0062.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", lpFilePart=0x0) returned 0x38
	[0062.504] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp")) returned 1
	[0062.508] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1
	[0062.509] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", lpFilePart=0x0) returned 0x37
	[0062.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0062.509] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0062.509] GetFileType (hFile=0x204) returned 0x1
	[0062.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0062.509] GetFileType (hFile=0x204) returned 0x1
	[0062.509] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xc038
	[0062.510] ReadFile (in: hFile=0x204, lpBuffer=0x267bda8, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x267bda8*, lpNumberOfBytesRead=0x26efc4*=0xc038, lpOverlapped=0x0) returned 1
	[0062.513] CloseHandle (hObject=0x204) returned 1
	[0062.513] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.KEKW", lpFilePart=0x0) returned 0x3c
	[0062.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0062.514] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.KEKW" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0062.514] GetFileType (hFile=0x204) returned 0x1
	[0062.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0062.515] GetFileType (hFile=0x204) returned 0x1
	[0062.515] WriteFile (in: hFile=0x204, lpBuffer=0x26894a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26894a8*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0062.518] CloseHandle (hObject=0x204) returned 1
	[0062.519] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", lpFilePart=0x0) returned 0x37
	[0062.519] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp")) returned 1
	[0062.523] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.523] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0062.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0062.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0062.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0062.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.524] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\user account pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0062.525] GetFileType (hFile=0x200) returned 0x1
	[0062.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0062.525] GetFileType (hFile=0x200) returned 0x1
	[0062.526] WriteFile (in: hFile=0x200, lpBuffer=0x268bb7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x268bb7c*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0062.530] CloseHandle (hObject=0x200) returned 1
	[0062.530] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1
	[0062.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0062.531] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault", lpFilePart=0x0) returned 0x1e
	[0062.531] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x1f
	[0062.531] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0062.532] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.532] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.533] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0062.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0062.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0062.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0062.534] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault", lpFilePart=0x0) returned 0x1e
	[0062.534] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x1f
	[0062.534] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0062.535] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.535] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.535] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0062.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0062.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0062.536] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\Decrypt.txt", lpFilePart=0x0) returned 0x2a
	[0062.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.536] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\vault\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0062.545] GetFileType (hFile=0x200) returned 0x1
	[0062.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0062.546] GetFileType (hFile=0x200) returned 0x1
	[0062.546] WriteFile (in: hFile=0x200, lpBuffer=0x268ef30*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x268ef30*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0062.549] CloseHandle (hObject=0x200) returned 1
	[0062.550] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1
	[0062.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0062.550] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x1e
	[0062.550] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x1f
	[0062.550] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0062.553] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.554] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.554] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0062.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0062.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0062.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0062.555] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x1e
	[0062.555] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x1f
	[0062.555] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0062.556] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.556] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.557] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0062.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0062.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0062.557] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\Decrypt.txt", lpFilePart=0x0) returned 0x2a
	[0062.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.557] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\visio\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0062.558] GetFileType (hFile=0x200) returned 0x1
	[0062.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0062.558] GetFileType (hFile=0x200) returned 0x1
	[0062.558] WriteFile (in: hFile=0x200, lpBuffer=0x26922e4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x26922e4*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0062.562] CloseHandle (hObject=0x200) returned 1
	[0062.562] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0062.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0062.563] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows", lpFilePart=0x0) returned 0x20
	[0062.563] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x21
	[0062.563] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0062.564] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.564] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIT", cAlternateFileName="")) returned 1
	[0062.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.565] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\AIT", lpFilePart=0x0) returned 0x24
	[0062.565] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\AIT\\", lpFilePart=0x0) returned 0x25
	[0062.565] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.566] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.567] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.567] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.568] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\AIT", lpFilePart=0x0) returned 0x24
	[0062.568] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\AIT\\", lpFilePart=0x0) returned 0x25
	[0062.568] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.569] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.569] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.570] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.570] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\AIT\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0062.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.571] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\ait\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0062.571] GetFileType (hFile=0x204) returned 0x1
	[0062.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0062.572] GetFileType (hFile=0x204) returned 0x1
	[0062.572] WriteFile (in: hFile=0x204, lpBuffer=0x2695f58*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2695f58*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0062.585] CloseHandle (hObject=0x204) returned 1
	[0062.586] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1
	[0062.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x27
	[0062.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x28
	[0062.586] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.587] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.588] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x284cecd2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x284cecd2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x284cecd2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cversions.2.db", cAlternateFileName="CVERSI~1.DB")) returned 1
	[0062.588] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x10f4d170, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x10f4d170, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x10f4d170, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="{11336D5B-7F61-4871-82E3-E0F59766823B}.2.ver0x0000000000000001.db", cAlternateFileName="{11336~1.DB")) returned 1
	[0062.589] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x75fef9b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x75fef9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75fef9b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db", cAlternateFileName="{3978E~1.DB")) returned 1
	[0062.590] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf67691e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xcf67691e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xcf67691e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x0, dwReserved1=0x0, cFileName="{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db", cAlternateFileName="{40FC8~1.DB")) returned 1
	[0062.591] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b7d54e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9b7d54e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b7d54e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db", cAlternateFileName="{4E36E~1.DB")) returned 1
	[0062.592] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab9fb9ff, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab9fb9ff, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab9fb9ff, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db", cAlternateFileName="{4E426~2.DB")) returned 1
	[0062.592] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76015b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x76015b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76015b10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000011.db", cAlternateFileName="{6AF06~1.DB")) returned 1
	[0062.593] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b8217a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9b8217a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b8217a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f5f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db", cAlternateFileName="{6AF06~2.DB")) returned 1
	[0062.594] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab96347e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab96347e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab96347e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x65578, dwReserved0=0x0, dwReserved1=0x0, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", cAlternateFileName="{DDF57~2.DB")) returned 1
	[0062.594] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab96347e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab96347e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab96347e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x65578, dwReserved0=0x0, dwReserved1=0x0, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", cAlternateFileName="{DDF57~2.DB")) returned 0
	[0062.595] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.595] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x27
	[0062.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x28
	[0062.596] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.596] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.597] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x284cecd2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x284cecd2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x284cecd2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cversions.2.db", cAlternateFileName="CVERSI~1.DB")) returned 1
	[0062.598] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x10f4d170, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x10f4d170, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x10f4d170, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="{11336D5B-7F61-4871-82E3-E0F59766823B}.2.ver0x0000000000000001.db", cAlternateFileName="{11336~1.DB")) returned 1
	[0062.598] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x75fef9b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x75fef9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75fef9b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db", cAlternateFileName="{3978E~1.DB")) returned 1
	[0062.599] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf67691e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xcf67691e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xcf67691e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x0, dwReserved1=0x0, cFileName="{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db", cAlternateFileName="{40FC8~1.DB")) returned 1
	[0062.599] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b7d54e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9b7d54e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b7d54e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db", cAlternateFileName="{4E36E~1.DB")) returned 1
	[0062.600] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab9fb9ff, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab9fb9ff, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab9fb9ff, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db", cAlternateFileName="{4E426~2.DB")) returned 1
	[0062.600] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76015b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x76015b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76015b10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000011.db", cAlternateFileName="{6AF06~1.DB")) returned 1
	[0062.601] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b8217a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9b8217a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b8217a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f5f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db", cAlternateFileName="{6AF06~2.DB")) returned 1
	[0062.601] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab96347e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab96347e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab96347e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x65578, dwReserved0=0x0, dwReserved1=0x0, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", cAlternateFileName="{DDF57~2.DB")) returned 1
	[0062.601] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.602] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.602] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Caches\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0062.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.603] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0062.604] GetFileType (hFile=0x204) returned 0x1
	[0062.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0062.604] GetFileType (hFile=0x204) returned 0x1
	[0062.605] WriteFile (in: hFile=0x204, lpBuffer=0x269dc64*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x269dc64*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0062.607] CloseHandle (hObject=0x204) returned 1
	[0062.608] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1
	[0062.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.609] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore", lpFilePart=0x0) returned 0x34
	[0062.609] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\", lpFilePart=0x0) returned 0x35
	[0062.609] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.610] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.610] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0062.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.611] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", lpFilePart=0x0) returned 0x3a
	[0062.611] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", lpFilePart=0x0) returned 0x3b
	[0062.611] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0062.612] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.613] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x0, dwReserved1=0x0, cFileName="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", cAlternateFileName="")) returned 1
	[0062.613] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 1
	[0062.614] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 0
	[0062.614] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0062.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0062.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0062.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.615] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", lpFilePart=0x0) returned 0x3a
	[0062.615] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", lpFilePart=0x0) returned 0x3b
	[0062.615] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0062.616] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.616] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x0, dwReserved1=0x0, cFileName="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", cAlternateFileName="")) returned 1
	[0062.617] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 1
	[0062.617] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.618] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0062.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0062.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0062.618] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0062.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.618] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0062.619] GetFileType (hFile=0x208) returned 0x1
	[0062.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0062.619] GetFileType (hFile=0x208) returned 0x1
	[0062.620] WriteFile (in: hFile=0x208, lpBuffer=0x26a3160*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26a3160*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0062.623] CloseHandle (hObject=0x208) returned 1
	[0062.623] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.624] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.624] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore", lpFilePart=0x0) returned 0x34
	[0062.624] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\", lpFilePart=0x0) returned 0x35
	[0062.625] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.625] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.626] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf64f9ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64f9ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0062.626] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf64f9ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64f9ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0062.627] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.627] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0062.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.627] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0062.628] GetFileType (hFile=0x204) returned 0x1
	[0062.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0062.628] GetFileType (hFile=0x204) returned 0x1
	[0062.628] WriteFile (in: hFile=0x204, lpBuffer=0x26a61b0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26a61b0*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0062.631] CloseHandle (hObject=0x204) returned 1
	[0062.632] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1
	[0062.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.632] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM", lpFilePart=0x0) returned 0x24
	[0062.633] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\", lpFilePart=0x0) returned 0x25
	[0062.633] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.635] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.636] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0062.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.636] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache", lpFilePart=0x0) returned 0x2a
	[0062.637] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\", lpFilePart=0x0) returned 0x2b
	[0062.637] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0062.638] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.638] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.639] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0062.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0062.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0062.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache", lpFilePart=0x0) returned 0x2a
	[0062.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\", lpFilePart=0x0) returned 0x2b
	[0062.640] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0062.640] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.641] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.641] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0062.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0062.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0062.641] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0062.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.642] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\drm\\cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0062.642] GetFileType (hFile=0x208) returned 0x1
	[0062.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0062.642] GetFileType (hFile=0x208) returned 0x1
	[0062.643] WriteFile (in: hFile=0x208, lpBuffer=0x26aa000*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26aa000*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0062.649] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.649] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.649] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM", lpFilePart=0x0) returned 0x24
	[0062.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\", lpFilePart=0x0) returned 0x25
	[0062.650] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.650] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.651] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6546190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6546190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0062.651] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6546190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6546190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 0
	[0062.652] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.652] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0062.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.652] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\drm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0062.654] GetFileType (hFile=0x204) returned 0x1
	[0062.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0062.654] GetFileType (hFile=0x204) returned 0x1
	[0062.654] WriteFile (in: hFile=0x204, lpBuffer=0x26ace30*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26ace30*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0062.657] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0062.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.658] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x2d
	[0062.658] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x2e
	[0062.658] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.659] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.660] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.660] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.661] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x2d
	[0062.661] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x2e
	[0062.661] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.661] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.662] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.662] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.663] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0062.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.663] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\gameexplorer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0062.663] GetFileType (hFile=0x204) returned 0x1
	[0062.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0062.664] GetFileType (hFile=0x204) returned 0x1
	[0062.664] WriteFile (in: hFile=0x204, lpBuffer=0x26b057c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26b057c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0062.667] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1
	[0062.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics", lpFilePart=0x0) returned 0x3d
	[0062.668] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", lpFilePart=0x0) returned 0x3e
	[0062.668] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.673] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.673] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f828940, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x2b0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-ntkl.etl", cAlternateFileName="ENERGY~2.ETL")) returned 1
	[0062.674] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9bd2ca0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9bd2ca0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xd9bd2ca0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x7122, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-12.xml", cAlternateFileName="ENERGY~2.XML")) returned 1
	[0062.674] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e53620, ftCreationTime.dwHighDateTime=0x1d305f5, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-26.xml", cAlternateFileName="ENERGY~3.XML")) returned 1
	[0062.675] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b145c0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9b145c0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-latest.xml", cAlternateFileName="ENERGY~1.XML")) returned 1
	[0062.676] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c91380, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9c91380, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x812c9f60, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x41f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report.html", cAlternateFileName="ENERGY~1.HTM")) returned 1
	[0062.676] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 1
	[0062.677] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 0
	[0062.677] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics", lpFilePart=0x0) returned 0x3d
	[0062.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", lpFilePart=0x0) returned 0x3e
	[0062.681] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.684] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.684] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f828940, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x2b0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-ntkl.etl", cAlternateFileName="ENERGY~2.ETL")) returned 1
	[0062.685] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9bd2ca0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9bd2ca0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xd9bd2ca0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x7122, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-12.xml", cAlternateFileName="ENERGY~2.XML")) returned 1
	[0062.685] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e53620, ftCreationTime.dwHighDateTime=0x1d305f5, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-26.xml", cAlternateFileName="ENERGY~3.XML")) returned 1
	[0062.686] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b145c0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9b145c0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-latest.xml", cAlternateFileName="ENERGY~1.XML")) returned 1
	[0062.686] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c91380, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9c91380, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x812c9f60, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x41f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report.html", cAlternateFileName="ENERGY~1.HTM")) returned 1
	[0062.687] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", lpFilePart=0x0) returned 0x50
	[0062.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0062.687] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.690] GetFileType (hFile=0x208) returned 0x1
	[0062.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0062.690] GetFileType (hFile=0x208) returned 0x1
	[0062.690] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x41f0
	[0062.691] ReadFile (in: hFile=0x208, lpBuffer=0x26b4d78, nNumberOfBytesToRead=0x41f0, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26b4d78*, lpNumberOfBytesRead=0x26ef24*=0x41f0, lpOverlapped=0x0) returned 1
	[0062.696] CloseHandle (hObject=0x208) returned 1
	[0062.696] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.KEKW", lpFilePart=0x0) returned 0x55
	[0062.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0062.697] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.KEKW" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0062.697] GetFileType (hFile=0x208) returned 0x1
	[0062.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0062.698] GetFileType (hFile=0x208) returned 0x1
	[0062.698] WriteFile (in: hFile=0x208, lpBuffer=0x26ba6a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26ba6a4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0062.701] CloseHandle (hObject=0x208) returned 1
	[0062.701] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", lpFilePart=0x0) returned 0x50
	[0062.702] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html")) returned 1
	[0062.705] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 1
	[0062.705] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.706] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.706] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0062.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.706] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0062.707] GetFileType (hFile=0x204) returned 0x1
	[0062.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0062.707] GetFileType (hFile=0x204) returned 0x1
	[0062.708] WriteFile (in: hFile=0x204, lpBuffer=0x26bd218*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26bd218*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0062.710] CloseHandle (hObject=0x204) returned 1
	[0062.711] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1
	[0062.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x2a
	[0062.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x2b
	[0062.712] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.718] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.719] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0062.719] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1
	[0062.720] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1
	[0062.720] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1
	[0062.721] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1
	[0062.721] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1
	[0062.722] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1
	[0062.722] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1
	[0062.723] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1
	[0062.723] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1
	[0062.724] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1
	[0062.724] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0
	[0062.725] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.727] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x2a
	[0062.728] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x2b
	[0062.728] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.731] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.731] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0062.732] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1
	[0062.732] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1
	[0062.733] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1
	[0062.733] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1
	[0062.734] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1
	[0062.734] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1
	[0062.734] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1
	[0062.735] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1
	[0062.735] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1
	[0062.736] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1
	[0062.736] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.736] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0062.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.740] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0062.743] GetFileType (hFile=0x204) returned 0x1
	[0062.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0062.743] GetFileType (hFile=0x204) returned 0x1
	[0062.743] WriteFile (in: hFile=0x204, lpBuffer=0x26c3da0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26c3da0*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0062.747] CloseHandle (hObject=0x204) returned 1
	[0062.749] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sqm", cAlternateFileName="")) returned 1
	[0062.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.749] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm", lpFilePart=0x0) returned 0x24
	[0062.749] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\", lpFilePart=0x0) returned 0x25
	[0062.750] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.751] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.751] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest", cAlternateFileName="")) returned 1
	[0062.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest", lpFilePart=0x0) returned 0x2d
	[0062.752] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\", lpFilePart=0x0) returned 0x2e
	[0062.752] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0062.753] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.753] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.754] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0062.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0062.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0062.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.754] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest", lpFilePart=0x0) returned 0x2d
	[0062.754] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\", lpFilePart=0x0) returned 0x2e
	[0062.755] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0062.755] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.756] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.756] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0062.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0062.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0062.757] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0062.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.757] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\sqm\\manifest\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0062.757] GetFileType (hFile=0x208) returned 0x1
	[0062.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0062.758] GetFileType (hFile=0x208) returned 0x1
	[0062.758] WriteFile (in: hFile=0x208, lpBuffer=0x26c7c90*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26c7c90*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0062.763] CloseHandle (hObject=0x208) returned 1
	[0062.764] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1
	[0062.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions", lpFilePart=0x0) returned 0x2d
	[0062.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\", lpFilePart=0x0) returned 0x2e
	[0062.764] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0062.765] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.765] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.766] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0062.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0062.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0062.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions", lpFilePart=0x0) returned 0x2d
	[0062.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\", lpFilePart=0x0) returned 0x2e
	[0062.767] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0062.767] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.768] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.768] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0062.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0062.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0062.768] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0062.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.769] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\sqm\\sessions\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0062.769] GetFileType (hFile=0x208) returned 0x1
	[0062.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0062.770] GetFileType (hFile=0x208) returned 0x1
	[0062.770] WriteFile (in: hFile=0x208, lpBuffer=0x26cb3b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26cb3b4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0062.773] CloseHandle (hObject=0x208) returned 1
	[0062.773] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1
	[0062.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.774] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload", lpFilePart=0x0) returned 0x2b
	[0062.774] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\", lpFilePart=0x0) returned 0x2c
	[0062.774] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0062.775] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.775] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.776] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0062.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0062.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0062.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.776] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload", lpFilePart=0x0) returned 0x2b
	[0062.776] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\", lpFilePart=0x0) returned 0x2c
	[0062.776] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0062.777] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.779] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0062.779] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0062.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0062.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0062.780] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0062.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.780] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\sqm\\upload\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0062.780] GetFileType (hFile=0x208) returned 0x1
	[0062.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0062.781] GetFileType (hFile=0x208) returned 0x1
	[0062.781] WriteFile (in: hFile=0x208, lpBuffer=0x26cea5c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26cea5c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0062.784] CloseHandle (hObject=0x208) returned 1
	[0062.785] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.785] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.786] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm", lpFilePart=0x0) returned 0x24
	[0062.786] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\", lpFilePart=0x0) returned 0x25
	[0062.786] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.786] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.787] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf6650b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6650b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest", cAlternateFileName="")) returned 1
	[0062.788] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf6676c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6676c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1
	[0062.788] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1
	[0062.789] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 0
	[0062.789] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0062.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0062.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0062.789] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0062.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.790] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\sqm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0062.790] GetFileType (hFile=0x204) returned 0x1
	[0062.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0062.790] GetFileType (hFile=0x204) returned 0x1
	[0062.791] WriteFile (in: hFile=0x204, lpBuffer=0x26d1a9c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26d1a9c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0062.796] CloseHandle (hObject=0x204) returned 1
	[0062.797] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0062.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0062.797] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x2b
	[0062.797] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x2c
	[0062.798] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0062.798] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.799] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 1
	[0062.799] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0062.800] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1
	[0062.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0062.800] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x34
	[0062.800] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x35
	[0062.800] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0062.801] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.802] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1
	[0062.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x40
	[0062.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x41
	[0062.803] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.803] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.804] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1
	[0062.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x4e
	[0062.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x4f
	[0062.805] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0062.805] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.806] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0062.806] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 1
	[0062.807] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0
	[0062.807] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0062.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0062.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0062.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.808] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x4e
	[0062.808] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x4f
	[0062.808] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0062.810] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.811] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0062.811] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 1
	[0062.811] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.811] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0062.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0062.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0062.812] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0062.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0062.812] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0062.816] GetFileType (hFile=0x224) returned 0x1
	[0062.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0062.817] GetFileType (hFile=0x224) returned 0x1
	[0062.817] WriteFile (in: hFile=0x224, lpBuffer=0x26d87fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26d87fc*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0062.820] CloseHandle (hObject=0x224) returned 1
	[0062.821] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1
	[0062.821] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0062.821] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 1
	[0062.822] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 1
	[0062.822] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 1
	[0062.822] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 1
	[0062.822] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paint.lnk", cAlternateFileName="")) returned 1
	[0062.822] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1
	[0062.822] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 1
	[0062.823] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 1
	[0062.823] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 1
	[0062.823] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 1
	[0062.823] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1
	[0062.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.824] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x4d
	[0062.824] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x4e
	[0062.824] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0062.825] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.825] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 1
	[0062.825] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0062.825] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1
	[0062.825] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 1
	[0062.826] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 1
	[0062.826] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1
	[0062.826] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 1
	[0062.826] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1
	[0062.826] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0062.826] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0062.827] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0
	[0062.827] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0062.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0062.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0062.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.827] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x4d
	[0062.828] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x4e
	[0062.828] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0062.828] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.828] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 1
	[0062.829] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0062.829] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1
	[0062.829] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 1
	[0062.829] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 1
	[0062.829] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1
	[0062.830] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 1
	[0062.830] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1
	[0062.830] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0062.830] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0062.830] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.830] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0062.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0062.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0062.831] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0062.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0062.831] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0062.833] GetFileType (hFile=0x224) returned 0x1
	[0062.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0062.834] GetFileType (hFile=0x224) returned 0x1
	[0062.843] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1
	[0062.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.843] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC", lpFilePart=0x0) returned 0x4a
	[0062.844] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\", lpFilePart=0x0) returned 0x4b
	[0062.844] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0062.844] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.844] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0062.844] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 1
	[0062.844] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.lnk", cAlternateFileName="")) returned 1
	[0062.845] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0062.845] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0
	[0062.845] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0062.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0062.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0062.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.845] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC", lpFilePart=0x0) returned 0x4a
	[0062.845] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\", lpFilePart=0x0) returned 0x4b
	[0062.845] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0062.846] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.846] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0062.846] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 1
	[0062.846] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.lnk", cAlternateFileName="")) returned 1
	[0062.846] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0062.847] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.847] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0062.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0062.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0062.847] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0062.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0062.847] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0062.850] GetFileType (hFile=0x224) returned 0x1
	[0062.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0062.851] GetFileType (hFile=0x224) returned 0x1
	[0062.855] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 1
	[0062.855] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1
	[0062.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.855] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell", lpFilePart=0x0) returned 0x53
	[0062.855] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\", lpFilePart=0x0) returned 0x54
	[0062.856] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0062.856] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.856] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0062.856] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0062.856] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1
	[0062.856] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1
	[0062.857] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0062.857] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0
	[0062.857] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0062.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0062.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0062.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.857] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell", lpFilePart=0x0) returned 0x53
	[0062.858] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\", lpFilePart=0x0) returned 0x54
	[0062.858] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0062.858] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.858] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0062.858] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0062.858] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1
	[0062.858] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1
	[0062.859] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0062.859] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0062.859] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0062.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0062.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0062.859] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0062.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0062.859] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0062.862] GetFileType (hFile=0x224) returned 0x1
	[0062.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0062.863] GetFileType (hFile=0x224) returned 0x1
	[0062.866] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1
	[0062.866] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0
	[0062.867] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.867] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x40
	[0062.867] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x41
	[0062.867] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.868] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0062.868] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf66e90b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf66e90b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1
	[0062.868] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1
	[0062.868] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0062.868] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 1
	[0062.868] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 1
	[0062.868] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 1
	[0062.869] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 1
	[0062.869] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paint.lnk", cAlternateFileName="")) returned 1
	[0062.869] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1
	[0062.869] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 1
	[0062.869] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 1
	[0062.869] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 1
	[0062.869] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 1
	[0062.869] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf670f210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf670f210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1
	[0062.869] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf6735370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6735370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1
	[0062.870] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.870] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0062.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0062.871] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0062.874] GetFileType (hFile=0x220) returned 0x1
	[0062.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0062.874] GetFileType (hFile=0x220) returned 0x1
	[0062.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x49
	[0062.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x4a
	[0062.878] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.879] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.880] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x49
	[0062.880] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x4a
	[0062.880] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.880] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0062.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0062.881] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0062.884] GetFileType (hFile=0x220) returned 0x1
	[0062.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0062.884] GetFileType (hFile=0x220) returned 0x1
	[0062.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.890] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games", lpFilePart=0x0) returned 0x3a
	[0062.890] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\", lpFilePart=0x0) returned 0x3b
	[0062.890] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.891] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games", lpFilePart=0x0) returned 0x3a
	[0062.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\", lpFilePart=0x0) returned 0x3b
	[0062.891] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.892] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.892] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0062.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0062.892] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0062.895] GetFileType (hFile=0x220) returned 0x1
	[0062.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0062.896] GetFileType (hFile=0x220) returned 0x1
	[0062.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.899] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java", lpFilePart=0x0) returned 0x39
	[0062.899] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\", lpFilePart=0x0) returned 0x3a
	[0062.899] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.903] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.906] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java", lpFilePart=0x0) returned 0x39
	[0062.906] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\", lpFilePart=0x0) returned 0x3a
	[0062.906] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.909] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.912] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0062.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0062.912] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0062.917] GetFileType (hFile=0x220) returned 0x1
	[0062.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0062.917] GetFileType (hFile=0x220) returned 0x1
	[0062.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.921] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x40
	[0062.922] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x41
	[0062.922] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.922] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.923] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x40
	[0062.923] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x41
	[0062.923] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.923] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.923] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0062.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0062.924] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0062.926] GetFileType (hFile=0x220) returned 0x1
	[0062.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0062.927] GetFileType (hFile=0x220) returned 0x1
	[0062.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.930] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office", lpFilePart=0x0) returned 0x45
	[0062.930] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\", lpFilePart=0x0) returned 0x46
	[0062.931] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.931] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools", lpFilePart=0x0) returned 0x61
	[0062.931] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\", lpFilePart=0x0) returned 0x62
	[0062.931] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0062.934] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0062.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0062.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0062.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0062.937] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools", lpFilePart=0x0) returned 0x61
	[0062.937] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\", lpFilePart=0x0) returned 0x62
	[0062.937] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0062.940] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0062.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0062.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0062.943] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x6d
	[0062.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0062.943] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0062.948] GetFileType (hFile=0x224) returned 0x1
	[0062.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0062.948] GetFileType (hFile=0x224) returned 0x1
	[0062.951] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office", lpFilePart=0x0) returned 0x45
	[0062.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\", lpFilePart=0x0) returned 0x46
	[0062.952] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.952] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.953] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0062.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0062.953] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0062.955] GetFileType (hFile=0x220) returned 0x1
	[0062.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0062.956] GetFileType (hFile=0x220) returned 0x1
	[0062.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.959] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint", lpFilePart=0x0) returned 0x3f
	[0062.960] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\", lpFilePart=0x0) returned 0x40
	[0062.960] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.963] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.966] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint", lpFilePart=0x0) returned 0x3f
	[0062.966] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\", lpFilePart=0x0) returned 0x40
	[0062.967] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.970] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0062.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0062.973] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0062.978] GetFileType (hFile=0x220) returned 0x1
	[0062.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0062.978] GetFileType (hFile=0x220) returned 0x1
	[0062.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0062.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x3c
	[0062.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x3d
	[0062.982] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.983] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0062.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0062.983] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x3c
	[0062.983] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x3d
	[0062.983] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.983] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.984] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0062.984] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0062.986] GetFileType (hFile=0x220) returned 0x1
	[0062.987] GetFileType (hFile=0x220) returned 0x1
	[0062.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC", lpFilePart=0x0) returned 0x3e
	[0062.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\", lpFilePart=0x0) returned 0x3f
	[0062.991] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.993] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.993] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC", lpFilePart=0x0) returned 0x3e
	[0062.993] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\", lpFilePart=0x0) returned 0x3f
	[0062.993] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0062.994] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0062.994] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0062.994] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\tablet pc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0062.996] GetFileType (hFile=0x220) returned 0x1
	[0062.996] GetFileType (hFile=0x220) returned 0x1
	[0063.001] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x34
	[0063.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x35
	[0063.001] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.006] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.006] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0063.006] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.007] GetFileType (hFile=0x208) returned 0x1
	[0063.007] GetFileType (hFile=0x208) returned 0x1
	[0063.011] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.011] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x2b
	[0063.012] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x2c
	[0063.012] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.014] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.014] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0063.014] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0063.016] GetFileType (hFile=0x204) returned 0x1
	[0063.016] GetFileType (hFile=0x204) returned 0x1
	[0063.020] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x2a
	[0063.021] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x2b
	[0063.021] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.022] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x2a
	[0063.023] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x2b
	[0063.023] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.024] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.024] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0063.024] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\templates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0063.025] GetFileType (hFile=0x204) returned 0x1
	[0063.025] GetFileType (hFile=0x204) returned 0x1
	[0063.028] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x24
	[0063.028] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x25
	[0063.028] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.029] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x32
	[0063.030] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x33
	[0063.030] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.031] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x32
	[0063.031] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x33
	[0063.031] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.032] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.032] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0063.032] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\wer\\reportarchive\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.033] GetFileType (hFile=0x208) returned 0x1
	[0063.033] GetFileType (hFile=0x208) returned 0x1
	[0063.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue", lpFilePart=0x0) returned 0x30
	[0063.036] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\", lpFilePart=0x0) returned 0x31
	[0063.036] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.039] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue", lpFilePart=0x0) returned 0x30
	[0063.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\", lpFilePart=0x0) returned 0x31
	[0063.039] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.040] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.040] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0063.040] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\wer\\reportqueue\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.041] GetFileType (hFile=0x208) returned 0x1
	[0063.041] GetFileType (hFile=0x208) returned 0x1
	[0063.045] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.045] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x24
	[0063.045] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x25
	[0063.045] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.046] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.047] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0063.047] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\wer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0063.047] GetFileType (hFile=0x204) returned 0x1
	[0063.047] GetFileType (hFile=0x204) returned 0x1
	[0063.050] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0063.051] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows", lpFilePart=0x0) returned 0x20
	[0063.051] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x21
	[0063.051] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0063.054] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0063.054] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0063.054] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0063.055] GetFileType (hFile=0x200) returned 0x1
	[0063.055] GetFileType (hFile=0x200) returned 0x1
	[0063.059] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x29
	[0063.059] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\", lpFilePart=0x0) returned 0x2a
	[0063.059] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0063.065] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", lpFilePart=0x0) returned 0x3c
	[0063.065] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\", lpFilePart=0x0) returned 0x3d
	[0063.065] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", lpFilePart=0x0) returned 0x43
	[0063.066] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\", lpFilePart=0x0) returned 0x44
	[0063.066] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.067] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.067] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup", lpFilePart=0x0) returned 0x43
	[0063.067] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\", lpFilePart=0x0) returned 0x44
	[0063.067] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.068] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.069] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0063.069] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\backup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.076] GetFileType (hFile=0x208) returned 0x1
	[0063.077] GetFileType (hFile=0x208) returned 0x1
	[0063.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", lpFilePart=0x0) returned 0x44
	[0063.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\", lpFilePart=0x0) returned 0x45
	[0063.080] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.082] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.083] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates", lpFilePart=0x0) returned 0x44
	[0063.083] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\", lpFilePart=0x0) returned 0x45
	[0063.083] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.084] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.084] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0063.084] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\updates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.085] GetFileType (hFile=0x208) returned 0x1
	[0063.085] GetFileType (hFile=0x208) returned 0x1
	[0063.088] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpFilePart=0x0) returned 0x63
	[0063.088] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\", lpFilePart=0x0) returned 0x64
	[0063.088] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.090] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.090] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpFilePart=0x0) returned 0x63
	[0063.090] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\", lpFilePart=0x0) returned 0x64
	[0063.090] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.092] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.092] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt", lpFilePart=0x0) returned 0x6f
	[0063.092] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.093] GetFileType (hFile=0x208) returned 0x1
	[0063.093] GetFileType (hFile=0x208) returned 0x1
	[0063.096] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.096] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates", lpFilePart=0x0) returned 0x3c
	[0063.096] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\", lpFilePart=0x0) returned 0x3d
	[0063.097] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.098] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.098] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0063.098] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\definition updates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0063.103] GetFileType (hFile=0x204) returned 0x1
	[0063.103] GetFileType (hFile=0x204) returned 0x1
	[0063.106] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", lpFilePart=0x0) returned 0x33
	[0063.106] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\", lpFilePart=0x0) returned 0x34
	[0063.107] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.107] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.108] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy", lpFilePart=0x0) returned 0x33
	[0063.108] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\", lpFilePart=0x0) returned 0x34
	[0063.108] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.109] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.109] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0063.109] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\localcopy\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0063.109] GetFileType (hFile=0x204) returned 0x1
	[0063.109] GetFileType (hFile=0x204) returned 0x1
	[0063.112] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", lpFilePart=0x0) returned 0x34
	[0063.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\", lpFilePart=0x0) returned 0x35
	[0063.113] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.113] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine", lpFilePart=0x0) returned 0x34
	[0063.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\", lpFilePart=0x0) returned 0x35
	[0063.113] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.114] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.114] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0063.114] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\quarantine\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0063.114] GetFileType (hFile=0x204) returned 0x1
	[0063.115] GetFileType (hFile=0x204) returned 0x1
	[0063.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans", lpFilePart=0x0) returned 0x2f
	[0063.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\", lpFilePart=0x0) returned 0x30
	[0063.118] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History", lpFilePart=0x0) returned 0x37
	[0063.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\", lpFilePart=0x0) returned 0x38
	[0063.121] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.121] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", lpFilePart=0x0) returned 0x44
	[0063.121] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\", lpFilePart=0x0) returned 0x45
	[0063.121] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc0a7e0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.122] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.122] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", lpFilePart=0x0) returned 0x44
	[0063.122] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\", lpFilePart=0x0) returned 0x45
	[0063.122] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc0a7e0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin", lpFilePart=0x0) returned 0x4e
	[0063.123] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpsfc.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0063.123] GetFileType (hFile=0x224) returned 0x1
	[0063.123] GetFileType (hFile=0x224) returned 0x1
	[0063.124] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x33b60
	[0063.126] ReadFile (in: hFile=0x224, lpBuffer=0x35d54d0, nNumberOfBytesToRead=0x33b60, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x35d54d0*, lpNumberOfBytesRead=0x26ede4*=0x33b60, lpOverlapped=0x0) returned 1
	[0063.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin.KEKW", lpFilePart=0x0) returned 0x53
	[0063.136] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin.KEKW" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpsfc.bin.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0063.137] GetFileType (hFile=0x224) returned 0x1
	[0063.137] GetFileType (hFile=0x224) returned 0x1
	[0063.137] WriteFile (in: hFile=0x224, lpBuffer=0x2767560*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2767560*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0063.141] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin", lpFilePart=0x0) returned 0x4e
	[0063.141] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpSfc.bin" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpsfc.bin")) returned 1
	[0063.150] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.150] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0063.150] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\cachemanager\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0063.151] GetFileType (hFile=0x220) returned 0x1
	[0063.151] GetFileType (hFile=0x220) returned 0x1
	[0063.152] WriteFile (in: hFile=0x220, lpBuffer=0x2769cbc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2769cbc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0063.155] CloseHandle (hObject=0x220) returned 1
	[0063.155] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Results", cAlternateFileName="")) returned 1
	[0063.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.156] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", lpFilePart=0x0) returned 0x3f
	[0063.156] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\", lpFilePart=0x0) returned 0x40
	[0063.156] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.157] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.157] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1
	[0063.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0063.158] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource", lpFilePart=0x0) returned 0x48
	[0063.158] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\", lpFilePart=0x0) returned 0x49
	[0063.158] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0063.159] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.160] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80be8ad0, ftCreationTime.dwHighDateTime=0x1d33740, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x81085570, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", cAlternateFileName="{1D1DB~1")) returned 1
	[0063.160] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80be8ad0, ftCreationTime.dwHighDateTime=0x1d33740, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x81085570, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", cAlternateFileName="{1D1DB~1")) returned 0
	[0063.161] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0063.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0063.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0063.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0063.161] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource", lpFilePart=0x0) returned 0x48
	[0063.161] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\", lpFilePart=0x0) returned 0x49
	[0063.162] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0063.162] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.163] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80be8ad0, ftCreationTime.dwHighDateTime=0x1d33740, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x81085570, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", cAlternateFileName="{1D1DB~1")) returned 1
	[0063.163] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.163] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0063.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0063.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0063.164] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0063.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0063.164] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\results\\resource\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0063.165] GetFileType (hFile=0x224) returned 0x1
	[0063.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0063.165] GetFileType (hFile=0x224) returned 0x1
	[0063.166] WriteFile (in: hFile=0x224, lpBuffer=0x276ed74*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x276ed74*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0063.169] CloseHandle (hObject=0x224) returned 1
	[0063.169] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.170] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0063.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0063.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results", lpFilePart=0x0) returned 0x3f
	[0063.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\", lpFilePart=0x0) returned 0x40
	[0063.171] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.171] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.172] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xf6a2eef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a2eef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1
	[0063.172] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xf6a2eef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a2eef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 0
	[0063.173] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0063.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0063.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0063.174] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\results\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0063.174] GetFileType (hFile=0x220) returned 0x1
	[0063.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0063.174] GetFileType (hFile=0x220) returned 0x1
	[0063.175] WriteFile (in: hFile=0x220, lpBuffer=0x2771f48*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2771f48*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0063.177] CloseHandle (hObject=0x220) returned 1
	[0063.178] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Service", cAlternateFileName="")) returned 1
	[0063.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.179] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.182] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.182] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9820270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7de6c9b0, ftLastWriteTime.dwHighDateTime=0x1d3373d, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.Log", cAlternateFileName="")) returned 1
	[0063.183] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadeed740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xadeed740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x2d1f02a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x1a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unknown.Log", cAlternateFileName="")) returned 1
	[0063.183] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadeed740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xadeed740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x2d1f02a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x1a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unknown.Log", cAlternateFileName="")) returned 0
	[0063.184] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0063.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0063.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.185] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.185] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.186] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9820270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7de6c9b0, ftLastWriteTime.dwHighDateTime=0x1d3373d, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.Log", cAlternateFileName="")) returned 1
	[0063.186] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadeed740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xadeed740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x2d1f02a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x1a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unknown.Log", cAlternateFileName="")) returned 1
	[0063.187] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.187] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0063.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0063.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0063.188] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\service\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0063.189] GetFileType (hFile=0x220) returned 0x1
	[0063.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0063.189] GetFileType (hFile=0x220) returned 0x1
	[0063.189] WriteFile (in: hFile=0x220, lpBuffer=0x2776554*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2776554*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0063.192] CloseHandle (hObject=0x220) returned 1
	[0063.192] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Store", cAlternateFileName="")) returned 1
	[0063.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.193] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.194] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.195] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.195] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0063.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0063.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.196] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.196] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.197] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.197] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0063.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0063.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0063.199] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\store\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0063.200] GetFileType (hFile=0x220) returned 0x1
	[0063.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0063.200] GetFileType (hFile=0x220) returned 0x1
	[0063.200] WriteFile (in: hFile=0x220, lpBuffer=0x277a030*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x277a030*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0063.203] CloseHandle (hObject=0x220) returned 1
	[0063.204] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.204] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.205] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.205] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.206] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6a08d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a08d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CacheManager", cAlternateFileName="CACHEM~1")) returned 1
	[0063.207] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6a55050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a55050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Results", cAlternateFileName="")) returned 1
	[0063.207] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6a7b1b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a7b1b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Service", cAlternateFileName="")) returned 1
	[0063.208] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Store", cAlternateFileName="")) returned 1
	[0063.208] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Store", cAlternateFileName="")) returned 0
	[0063.209] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0063.209] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\history\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.210] GetFileType (hFile=0x208) returned 0x1
	[0063.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0063.210] GetFileType (hFile=0x208) returned 0x1
	[0063.210] WriteFile (in: hFile=0x208, lpBuffer=0x277d4f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x277d4f0*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0063.213] CloseHandle (hObject=0x208) returned 1
	[0063.214] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.217] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0063.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0063.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.218] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.219] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.219] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0063.220] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 0
	[0063.220] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0063.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0063.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.221] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\scans\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0063.222] GetFileType (hFile=0x204) returned 0x1
	[0063.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0063.222] GetFileType (hFile=0x204) returned 0x1
	[0063.222] WriteFile (in: hFile=0x204, lpBuffer=0x2780494*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2780494*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0063.225] CloseHandle (hObject=0x204) returned 1
	[0063.226] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 1
	[0063.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.226] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.227] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.227] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x798d48a0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x30ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 1
	[0063.228] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x798d48a0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x30ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 0
	[0063.229] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0063.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0063.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.230] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.230] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.231] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x798d48a0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x30ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 1
	[0063.231] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.232] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0063.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0063.232] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0063.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.233] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\support\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0063.233] GetFileType (hFile=0x204) returned 0x1
	[0063.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0063.233] GetFileType (hFile=0x204) returned 0x1
	[0063.234] WriteFile (in: hFile=0x204, lpBuffer=0x27842c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27842c8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0063.237] CloseHandle (hObject=0x204) returned 1
	[0063.237] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.238] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0063.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0063.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0063.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0063.238] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x29
	[0063.238] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\", lpFilePart=0x0) returned 0x2a
	[0063.239] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0063.239] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.240] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1
	[0063.240] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1
	[0063.241] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1
	[0063.241] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6ac7470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ac7470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scans", cAlternateFileName="")) returned 1
	[0063.242] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 1
	[0063.242] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 0
	[0063.243] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0063.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0063.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0063.243] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows Defender\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0063.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.243] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows defender\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0063.244] GetFileType (hFile=0x200) returned 0x1
	[0063.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0063.244] GetFileType (hFile=0x200) returned 0x1
	[0063.245] WriteFile (in: hFile=0x200, lpBuffer=0x27876a0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27876a0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0063.249] CloseHandle (hObject=0x200) returned 1
	[0063.249] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1
	[0063.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0063.250] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT", lpFilePart=0x0) returned 0x23
	[0063.250] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\", lpFilePart=0x0) returned 0x24
	[0063.250] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0063.251] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.251] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1
	[0063.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.252] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax", lpFilePart=0x0) returned 0x29
	[0063.252] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\", lpFilePart=0x0) returned 0x2a
	[0063.252] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.259] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.260] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivityLog", cAlternateFileName="ACTIVI~1")) returned 1
	[0063.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.260] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog", lpFilePart=0x0) returned 0x35
	[0063.260] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\", lpFilePart=0x0) returned 0x36
	[0063.261] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.261] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.262] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.262] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.263] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog", lpFilePart=0x0) returned 0x35
	[0063.263] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\", lpFilePart=0x0) returned 0x36
	[0063.263] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.264] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.265] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.265] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.265] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0063.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0063.266] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\activitylog\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.266] GetFileType (hFile=0x208) returned 0x1
	[0063.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0063.267] GetFileType (hFile=0x208) returned 0x1
	[0063.267] WriteFile (in: hFile=0x208, lpBuffer=0x278bff0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x278bff0*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0063.270] CloseHandle (hObject=0x208) returned 1
	[0063.271] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Coverpages", cAlternateFileName="COMMON~1")) returned 1
	[0063.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.271] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages", lpFilePart=0x0) returned 0x3b
	[0063.271] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\", lpFilePart=0x0) returned 0x3c
	[0063.271] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.272] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.273] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0063.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.273] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US", lpFilePart=0x0) returned 0x41
	[0063.274] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\", lpFilePart=0x0) returned 0x42
	[0063.274] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.275] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.276] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="confident.cov", cAlternateFileName="")) returned 1
	[0063.276] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x0, dwReserved1=0x0, cFileName="fyi.cov", cAlternateFileName="")) returned 1
	[0063.277] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="generic.cov", cAlternateFileName="")) returned 1
	[0063.277] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 1
	[0063.278] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 0
	[0063.279] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0063.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0063.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.279] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US", lpFilePart=0x0) returned 0x41
	[0063.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\", lpFilePart=0x0) returned 0x42
	[0063.280] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.280] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.281] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="confident.cov", cAlternateFileName="")) returned 1
	[0063.281] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x0, dwReserved1=0x0, cFileName="fyi.cov", cAlternateFileName="")) returned 1
	[0063.282] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="generic.cov", cAlternateFileName="")) returned 1
	[0063.282] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 1
	[0063.282] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.282] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0063.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0063.283] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0063.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0063.283] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0063.284] GetFileType (hFile=0x220) returned 0x1
	[0063.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0063.284] GetFileType (hFile=0x220) returned 0x1
	[0063.284] WriteFile (in: hFile=0x220, lpBuffer=0x2791c1c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2791c1c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0063.290] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.291] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.291] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages", lpFilePart=0x0) returned 0x3b
	[0063.291] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\", lpFilePart=0x0) returned 0x3c
	[0063.292] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.293] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.293] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6b5f9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b5f9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0063.294] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6b5f9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b5f9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0063.294] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.295] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0063.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0063.295] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\common coverpages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.295] GetFileType (hFile=0x208) returned 0x1
	[0063.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0063.296] GetFileType (hFile=0x208) returned 0x1
	[0063.296] WriteFile (in: hFile=0x208, lpBuffer=0x2794d48*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2794d48*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0063.299] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Inbox", cAlternateFileName="")) returned 1
	[0063.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.299] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox", lpFilePart=0x0) returned 0x2f
	[0063.300] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\", lpFilePart=0x0) returned 0x30
	[0063.300] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.302] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.302] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.303] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox", lpFilePart=0x0) returned 0x2f
	[0063.303] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\", lpFilePart=0x0) returned 0x30
	[0063.304] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.304] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.305] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.305] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.305] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0063.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0063.305] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\inbox\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.306] GetFileType (hFile=0x208) returned 0x1
	[0063.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0063.306] GetFileType (hFile=0x208) returned 0x1
	[0063.307] WriteFile (in: hFile=0x208, lpBuffer=0x27984dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27984dc*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0063.310] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Queue", cAlternateFileName="")) returned 1
	[0063.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue", lpFilePart=0x0) returned 0x2f
	[0063.310] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\", lpFilePart=0x0) returned 0x30
	[0063.311] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.311] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.312] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.312] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.313] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue", lpFilePart=0x0) returned 0x2f
	[0063.313] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\", lpFilePart=0x0) returned 0x30
	[0063.313] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.313] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.314] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.314] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.314] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0063.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0063.315] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\queue\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.315] GetFileType (hFile=0x208) returned 0x1
	[0063.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0063.316] GetFileType (hFile=0x208) returned 0x1
	[0063.316] WriteFile (in: hFile=0x208, lpBuffer=0x279bc70*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x279bc70*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0063.319] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SentItems", cAlternateFileName="SENTIT~1")) returned 1
	[0063.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.319] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems", lpFilePart=0x0) returned 0x33
	[0063.319] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\", lpFilePart=0x0) returned 0x34
	[0063.320] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.320] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.321] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.321] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.322] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems", lpFilePart=0x0) returned 0x33
	[0063.322] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\", lpFilePart=0x0) returned 0x34
	[0063.322] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.323] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.324] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.324] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.324] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0063.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0063.324] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\sentitems\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.325] GetFileType (hFile=0x208) returned 0x1
	[0063.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0063.325] GetFileType (hFile=0x208) returned 0x1
	[0063.325] WriteFile (in: hFile=0x208, lpBuffer=0x279f51c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x279f51c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0063.328] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 1
	[0063.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.329] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox", lpFilePart=0x0) returned 0x36
	[0063.329] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\", lpFilePart=0x0) returned 0x37
	[0063.329] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.330] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.330] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0063.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.331] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US", lpFilePart=0x0) returned 0x3c
	[0063.331] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\", lpFilePart=0x0) returned 0x3d
	[0063.331] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.336] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.337] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 1
	[0063.337] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0
	[0063.337] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0063.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0063.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.338] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US", lpFilePart=0x0) returned 0x3c
	[0063.338] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\", lpFilePart=0x0) returned 0x3d
	[0063.338] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.339] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.340] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 1
	[0063.340] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.340] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0063.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0063.340] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0063.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0063.341] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0063.341] GetFileType (hFile=0x220) returned 0x1
	[0063.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0063.342] GetFileType (hFile=0x220) returned 0x1
	[0063.342] WriteFile (in: hFile=0x220, lpBuffer=0x27a3f64*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27a3f64*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0063.345] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.345] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.346] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox", lpFilePart=0x0) returned 0x36
	[0063.346] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\", lpFilePart=0x0) returned 0x37
	[0063.346] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.347] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.347] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0063.348] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0063.348] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.348] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt", lpFilePart=0x0) returned 0x42
	[0063.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0063.348] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\virtualinbox\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.349] GetFileType (hFile=0x208) returned 0x1
	[0063.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0063.349] GetFileType (hFile=0x208) returned 0x1
	[0063.349] WriteFile (in: hFile=0x208, lpBuffer=0x27a6ff8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27a6ff8*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0063.352] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.352] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0063.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0063.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.353] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax", lpFilePart=0x0) returned 0x29
	[0063.353] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\", lpFilePart=0x0) returned 0x2a
	[0063.353] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.354] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.354] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b39890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b39890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivityLog", cAlternateFileName="ACTIVI~1")) returned 1
	[0063.355] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Coverpages", cAlternateFileName="COMMON~1")) returned 1
	[0063.355] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Inbox", cAlternateFileName="")) returned 1
	[0063.356] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6babcb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6babcb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Queue", cAlternateFileName="")) returned 1
	[0063.356] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6bd1e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bd1e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SentItems", cAlternateFileName="SENTIT~1")) returned 1
	[0063.356] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 1
	[0063.357] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 0
	[0063.357] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0063.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0063.358] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0063.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.358] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msfax\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0063.358] GetFileType (hFile=0x204) returned 0x1
	[0063.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0063.359] GetFileType (hFile=0x204) returned 0x1
	[0063.359] WriteFile (in: hFile=0x204, lpBuffer=0x27aa538*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27aa538*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0063.362] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1
	[0063.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.362] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan", lpFilePart=0x0) returned 0x2a
	[0063.362] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\", lpFilePart=0x0) returned 0x2b
	[0063.363] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.363] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.364] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1
	[0063.364] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0
	[0063.364] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0063.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0063.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan", lpFilePart=0x0) returned 0x2a
	[0063.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\", lpFilePart=0x0) returned 0x2b
	[0063.365] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.366] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.366] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1
	[0063.366] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", lpFilePart=0x0) returned 0x3a
	[0063.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0063.367] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0063.367] GetFileType (hFile=0x208) returned 0x1
	[0063.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0063.367] GetFileType (hFile=0x208) returned 0x1
	[0063.368] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x7e148
	[0063.374] ReadFile (in: hFile=0x208, lpBuffer=0x3609050, nNumberOfBytesToRead=0x7e148, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x3609050*, lpNumberOfBytesRead=0x26ef24*=0x7e148, lpOverlapped=0x0) returned 1
	[0063.442] CloseHandle (hObject=0x208) returned 1
	[0063.443] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.KEKW", lpFilePart=0x0) returned 0x3f
	[0063.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0063.443] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.KEKW" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0063.444] GetFileType (hFile=0x208) returned 0x1
	[0063.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0063.444] GetFileType (hFile=0x208) returned 0x1
	[0063.444] WriteFile (in: hFile=0x208, lpBuffer=0x27ae1f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27ae1f0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0063.447] CloseHandle (hObject=0x208) returned 1
	[0063.447] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", lpFilePart=0x0) returned 0x3a
	[0063.448] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0
	[0063.452] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.452] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0063.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0063.452] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0063.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.453] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0063.453] GetFileType (hFile=0x204) returned 0x1
	[0063.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0063.454] GetFileType (hFile=0x204) returned 0x1
	[0063.454] WriteFile (in: hFile=0x204, lpBuffer=0x27b0c00*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27b0c00*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0063.457] CloseHandle (hObject=0x204) returned 1
	[0063.466] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.467] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0063.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0063.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0063.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0063.467] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT", lpFilePart=0x0) returned 0x23
	[0063.467] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\", lpFilePart=0x0) returned 0x24
	[0063.468] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0063.468] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.469] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6c1e0d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6c1e0d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1
	[0063.469] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d02910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d02910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1
	[0063.470] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d02910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d02910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0
	[0063.470] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0063.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0063.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0063.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0063.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.471] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\windows nt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0063.472] GetFileType (hFile=0x200) returned 0x1
	[0063.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0063.472] GetFileType (hFile=0x200) returned 0x1
	[0063.472] WriteFile (in: hFile=0x200, lpBuffer=0x27b3af8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27b3af8*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0063.475] CloseHandle (hObject=0x200) returned 1
	[0063.476] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1
	[0063.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0063.476] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x20
	[0063.476] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x21
	[0063.476] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0063.477] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.478] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0063.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.478] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x29
	[0063.479] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2a
	[0063.479] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.481] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.481] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.482] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0063.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0063.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.482] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x29
	[0063.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2a
	[0063.483] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.484] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.484] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.485] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0063.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0063.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0063.485] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0063.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.485] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\wwansvc\\profiles\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0063.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dcb8) returned 1
	[0063.490] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.490] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0063.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0063.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0063.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0063.491] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x20
	[0063.491] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x21
	[0063.491] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0063.492] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.492] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0063.493] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0
	[0063.493] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0063.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0063.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0063.494] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0063.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.494] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\wwansvc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0063.494] GetFileType (hFile=0x200) returned 0x1
	[0063.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0063.495] GetFileType (hFile=0x200) returned 0x1
	[0063.495] WriteFile (in: hFile=0x200, lpBuffer=0x27b86dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27b86dc*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0063.498] CloseHandle (hObject=0x200) returned 1
	[0063.499] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.499] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0063.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0063.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0063.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0063.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18
	[0063.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\", lpFilePart=0x0) returned 0x19
	[0063.500] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0063.501] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.501] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3ab9850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ab9850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1
	[0063.502] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0063.503] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ee3ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ee3ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1
	[0063.503] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f0a030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f0a030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1
	[0063.504] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f562f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f562f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1
	[0063.504] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1
	[0063.505] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0063.506] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3fee870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fee870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1
	[0063.506] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf40149d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40149d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0063.507] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf403ab30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf403ab30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1
	[0063.507] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1
	[0063.508] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1
	[0063.508] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1
	[0063.509] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4dc4850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4dc4850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1
	[0063.509] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf5345b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5345b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1
	[0063.510] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf542a370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf542a370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1
	[0063.519] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf568b970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf568b970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1
	[0063.519] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6415690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6415690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1
	[0063.520] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1
	[0063.520] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1
	[0063.521] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0063.521] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0063.522] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d28a70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d28a70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1
	[0063.522] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d4ebd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d4ebd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1
	[0063.523] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d4ebd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d4ebd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0
	[0063.523] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0063.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0063.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0063.523] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0063.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.524] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0063.525] GetFileType (hFile=0x1fc) returned 0x1
	[0063.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0063.525] GetFileType (hFile=0x1fc) returned 0x1
	[0063.525] WriteFile (in: hFile=0x1fc, lpBuffer=0x27bc8c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x27bc8c8*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0063.548] CloseHandle (hObject=0x1fc) returned 1
	[0063.549] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0063.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0063.549] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help", lpFilePart=0x0) returned 0x1d
	[0063.550] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\", lpFilePart=0x0) returned 0x1e
	[0063.550] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0063.605] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.608] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x896b9210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x896b9210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.hxn", cAlternateFileName="")) returned 1
	[0063.608] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1
	[0063.609] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn", cAlternateFileName="MSEXCE~2.HXN")) returned 1
	[0063.610] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn", cAlternateFileName="MSGRAP~1.HXN")) returned 1
	[0063.610] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn", cAlternateFileName="MSGROO~1.HXN")) returned 1
	[0063.611] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn", cAlternateFileName="MSINFO~1.HXN")) returned 1
	[0063.611] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn", cAlternateFileName="MSINFO~2.HXN")) returned 1
	[0063.612] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1
	[0063.612] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn", cAlternateFileName="MSMSAC~2.HXN")) returned 1
	[0063.613] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1
	[0063.613] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1
	[0063.614] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn", cAlternateFileName="MSMSPU~2.HXN")) returned 1
	[0063.614] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn", cAlternateFileName="MSMSTO~1.HXN")) returned 1
	[0063.615] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn", cAlternateFileName="MSOIS1~1.HXN")) returned 1
	[0063.615] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1
	[0063.616] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1
	[0063.616] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn", cAlternateFileName="MSOUTL~2.HXN")) returned 1
	[0063.617] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1
	[0063.617] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn", cAlternateFileName="MSPOWE~2.HXN")) returned 1
	[0063.618] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1
	[0063.618] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1
	[0063.619] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1
	[0063.667] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn", cAlternateFileName="MSVISI~4.HXN")) returned 1
	[0063.667] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_PRM.14.1033.hxn", cAlternateFileName="MSE1C9~1.HXN")) returned 1
	[0063.668] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_STD.14.1033.hxn", cAlternateFileName="MSVISI~2.HXN")) returned 1
	[0063.668] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.14.1033.hxn", cAlternateFileName="MSWINP~1.HXN")) returned 1
	[0063.669] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.DEV.14.1033.hxn", cAlternateFileName="MSWINP~2.HXN")) returned 1
	[0063.670] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.14.1033.hxn", cAlternateFileName="MSWINW~1.HXN")) returned 1
	[0063.670] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.DEV.14.1033.hxn", cAlternateFileName="MSWINW~2.HXN")) returned 1
	[0063.671] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 1
	[0063.671] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 0
	[0063.672] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0063.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0063.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0063.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0063.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help", lpFilePart=0x0) returned 0x1d
	[0063.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\", lpFilePart=0x0) returned 0x1e
	[0063.675] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0063.678] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.679] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x896b9210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x896b9210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.hxn", cAlternateFileName="")) returned 1
	[0063.680] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1
	[0063.680] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn", cAlternateFileName="MSEXCE~2.HXN")) returned 1
	[0063.681] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn", cAlternateFileName="MSGRAP~1.HXN")) returned 1
	[0063.681] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn", cAlternateFileName="MSGROO~1.HXN")) returned 1
	[0063.682] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn", cAlternateFileName="MSINFO~1.HXN")) returned 1
	[0063.682] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn", cAlternateFileName="MSINFO~2.HXN")) returned 1
	[0063.683] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1
	[0063.684] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn", cAlternateFileName="MSMSAC~2.HXN")) returned 1
	[0063.684] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1
	[0063.684] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1
	[0063.685] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn", cAlternateFileName="MSMSPU~2.HXN")) returned 1
	[0063.685] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn", cAlternateFileName="MSMSTO~1.HXN")) returned 1
	[0063.686] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn", cAlternateFileName="MSOIS1~1.HXN")) returned 1
	[0063.686] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1
	[0063.687] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1
	[0063.687] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn", cAlternateFileName="MSOUTL~2.HXN")) returned 1
	[0063.688] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1
	[0063.688] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn", cAlternateFileName="MSPOWE~2.HXN")) returned 1
	[0063.689] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1
	[0063.689] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1
	[0063.690] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1
	[0063.690] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn", cAlternateFileName="MSVISI~4.HXN")) returned 1
	[0063.691] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_PRM.14.1033.hxn", cAlternateFileName="MSE1C9~1.HXN")) returned 1
	[0063.691] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_STD.14.1033.hxn", cAlternateFileName="MSVISI~2.HXN")) returned 1
	[0063.692] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.14.1033.hxn", cAlternateFileName="MSWINP~1.HXN")) returned 1
	[0063.692] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.DEV.14.1033.hxn", cAlternateFileName="MSWINP~2.HXN")) returned 1
	[0063.693] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.14.1033.hxn", cAlternateFileName="MSWINW~1.HXN")) returned 1
	[0063.693] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.DEV.14.1033.hxn", cAlternateFileName="MSWINW~2.HXN")) returned 1
	[0063.694] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 1
	[0063.694] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.694] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0063.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0063.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0063.697] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\Decrypt.txt", lpFilePart=0x0) returned 0x29
	[0063.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.697] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\Decrypt.txt" (normalized: "c:\\programdata\\microsoft help\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0063.701] GetFileType (hFile=0x1fc) returned 0x1
	[0063.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0063.701] GetFileType (hFile=0x1fc) returned 0x1
	[0063.701] WriteFile (in: hFile=0x1fc, lpBuffer=0x27c8d50*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x27c8d50*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0063.704] CloseHandle (hObject=0x1fc) returned 1
	[0063.705] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0063.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0063.706] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla", lpFilePart=0x0) returned 0x16
	[0063.706] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\", lpFilePart=0x0) returned 0x17
	[0063.706] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0063.707] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.707] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1
	[0063.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0063.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs", lpFilePart=0x0) returned 0x1b
	[0063.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x1c
	[0063.708] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0063.738] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.739] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 1
	[0063.740] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 0
	[0063.740] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0063.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0063.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0063.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0063.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs", lpFilePart=0x0) returned 0x1b
	[0063.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x1c
	[0063.741] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0063.742] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.742] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 1
	[0063.743] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.743] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0063.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0063.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0063.744] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\Decrypt.txt", lpFilePart=0x0) returned 0x27
	[0063.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.744] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\logs\\Decrypt.txt" (normalized: "c:\\programdata\\mozilla\\logs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0063.745] GetFileType (hFile=0x200) returned 0x1
	[0063.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0063.745] GetFileType (hFile=0x200) returned 0x1
	[0063.745] WriteFile (in: hFile=0x200, lpBuffer=0x27ccbc8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27ccbc8*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0063.749] CloseHandle (hObject=0x200) returned 1
	[0063.750] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.750] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0063.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0063.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0063.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0063.751] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla", lpFilePart=0x0) returned 0x16
	[0063.751] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\", lpFilePart=0x0) returned 0x17
	[0063.751] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0063.752] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.752] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fb01d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fb01d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1
	[0063.753] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fb01d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fb01d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0
	[0063.753] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0063.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0063.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0063.753] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0063.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.754] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\Decrypt.txt" (normalized: "c:\\programdata\\mozilla\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0063.754] GetFileType (hFile=0x1fc) returned 0x1
	[0063.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0063.754] GetFileType (hFile=0x1fc) returned 0x1
	[0063.755] WriteFile (in: hFile=0x1fc, lpBuffer=0x27cf814*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x27cf814*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0063.758] CloseHandle (hObject=0x1fc) returned 1
	[0063.758] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1
	[0063.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0063.759] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle", lpFilePart=0x0) returned 0x15
	[0063.759] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\", lpFilePart=0x0) returned 0x16
	[0063.759] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0063.760] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.761] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.761] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0063.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0063.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0063.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0063.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle", lpFilePart=0x0) returned 0x15
	[0063.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\", lpFilePart=0x0) returned 0x16
	[0063.762] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0063.763] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.763] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0063.764] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0063.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0063.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0063.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Decrypt.txt", lpFilePart=0x0) returned 0x21
	[0063.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.765] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Decrypt.txt" (normalized: "c:\\programdata\\oracle\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0063.765] GetFileType (hFile=0x1fc) returned 0x1
	[0063.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0063.765] GetFileType (hFile=0x1fc) returned 0x1
	[0063.766] WriteFile (in: hFile=0x1fc, lpBuffer=0x27d2994*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x27d2994*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0063.769] CloseHandle (hObject=0x1fc) returned 1
	[0063.769] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1
	[0063.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0063.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache", lpFilePart=0x0) returned 0x1c
	[0063.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\", lpFilePart=0x0) returned 0x1d
	[0063.770] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0063.781] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.797] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1
	[0063.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0063.797] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpFilePart=0x0) returned 0x45
	[0063.797] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpFilePart=0x0) returned 0x46
	[0063.798] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0063.798] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.799] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0063.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0063.799] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", lpFilePart=0x0) returned 0x4e
	[0063.800] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", lpFilePart=0x0) returned 0x4f
	[0063.800] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0063.801] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.801] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1
	[0063.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", lpFilePart=0x0) returned 0x54
	[0063.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", lpFilePart=0x0) returned 0x55
	[0063.802] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.802] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.803] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1
	[0063.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.803] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x58
	[0063.804] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x59
	[0063.804] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.805] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.805] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0063.806] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0
	[0063.806] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0063.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0063.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0063.807] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x58
	[0063.807] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x59
	[0063.807] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0063.808] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.808] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0063.808] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.809] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0063.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0063.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0063.809] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0063.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0063.809] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0063.810] GetFileType (hFile=0x220) returned 0x1
	[0063.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0063.810] GetFileType (hFile=0x220) returned 0x1
	[0063.815] WriteFile (in: hFile=0x220, lpBuffer=0x25ed9dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25ed9dc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0063.818] CloseHandle (hObject=0x220) returned 1
	[0063.818] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0063.819] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0063.820] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", lpFilePart=0x0) returned 0x54
	[0063.820] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", lpFilePart=0x0) returned 0x55
	[0063.820] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0063.820] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0063.821] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf706e8b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf706e8b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1
	[0063.822] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf706e8b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf706e8b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0
	[0063.822] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0063.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0063.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0063.834] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0063.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0063.834] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0063.835] GetFileType (hFile=0x208) returned 0x1
	[0063.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0063.835] GetFileType (hFile=0x208) returned 0x1
	[0063.835] WriteFile (in: hFile=0x208, lpBuffer=0x25f0e5c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x25f0e5c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0064.062] CloseHandle (hObject=0x208) returned 1
	[0064.063] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.063] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.064] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", lpFilePart=0x0) returned 0x4e
	[0064.064] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", lpFilePart=0x0) returned 0x4f
	[0064.064] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.065] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.066] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7094a10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7094a10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1
	[0064.066] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7094a10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7094a10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0
	[0064.067] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.067] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0064.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0064.067] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.068] GetFileType (hFile=0x204) returned 0x1
	[0064.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0064.068] GetFileType (hFile=0x204) returned 0x1
	[0064.068] WriteFile (in: hFile=0x204, lpBuffer=0x25f4220*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x25f4220*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0064.071] CloseHandle (hObject=0x204) returned 1
	[0064.072] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.073] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.073] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpFilePart=0x0) returned 0x45
	[0064.073] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpFilePart=0x0) returned 0x46
	[0064.073] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.074] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.075] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf72cfeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72cfeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.075] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf72cfeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72cfeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0064.076] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0064.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.077] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.077] GetFileType (hFile=0x200) returned 0x1
	[0064.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0064.077] GetFileType (hFile=0x200) returned 0x1
	[0064.078] WriteFile (in: hFile=0x200, lpBuffer=0x25f74c0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25f74c0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.080] CloseHandle (hObject=0x200) returned 1
	[0064.081] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1
	[0064.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.081] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpFilePart=0x0) returned 0x45
	[0064.082] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpFilePart=0x0) returned 0x46
	[0064.082] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.089] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.090] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.090] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", lpFilePart=0x0) returned 0x4e
	[0064.090] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", lpFilePart=0x0) returned 0x4f
	[0064.091] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.091] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.092] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1
	[0064.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.093] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", lpFilePart=0x0) returned 0x54
	[0064.093] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", lpFilePart=0x0) returned 0x55
	[0064.093] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.097] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.098] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1
	[0064.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0064.098] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x58
	[0064.098] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x59
	[0064.098] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0064.099] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.100] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0064.100] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0
	[0064.101] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0064.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0064.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0064.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0064.101] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x58
	[0064.102] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x59
	[0064.102] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0064.102] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.103] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0064.104] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.105] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0064.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0064.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0064.105] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0064.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0064.105] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0064.106] GetFileType (hFile=0x220) returned 0x1
	[0064.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0064.106] GetFileType (hFile=0x220) returned 0x1
	[0064.107] WriteFile (in: hFile=0x220, lpBuffer=0x25fe4dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25fe4dc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.110] CloseHandle (hObject=0x220) returned 1
	[0064.110] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.110] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.111] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", lpFilePart=0x0) returned 0x54
	[0064.111] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", lpFilePart=0x0) returned 0x55
	[0064.111] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.112] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.113] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1
	[0064.113] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0
	[0064.113] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.114] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0064.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0064.114] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.115] GetFileType (hFile=0x208) returned 0x1
	[0064.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0064.115] GetFileType (hFile=0x208) returned 0x1
	[0064.115] WriteFile (in: hFile=0x208, lpBuffer=0x260195c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x260195c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0064.118] CloseHandle (hObject=0x208) returned 1
	[0064.119] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.119] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", lpFilePart=0x0) returned 0x4e
	[0064.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", lpFilePart=0x0) returned 0x4f
	[0064.120] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.121] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.122] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1
	[0064.122] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0
	[0064.123] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.123] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0064.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0064.123] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.124] GetFileType (hFile=0x204) returned 0x1
	[0064.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0064.124] GetFileType (hFile=0x204) returned 0x1
	[0064.124] WriteFile (in: hFile=0x204, lpBuffer=0x2604d20*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2604d20*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0064.127] CloseHandle (hObject=0x204) returned 1
	[0064.128] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.128] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.129] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpFilePart=0x0) returned 0x45
	[0064.129] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpFilePart=0x0) returned 0x46
	[0064.129] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.130] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.131] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.131] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0064.131] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.132] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0064.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.132] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.133] GetFileType (hFile=0x200) returned 0x1
	[0064.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0064.133] GetFileType (hFile=0x200) returned 0x1
	[0064.133] WriteFile (in: hFile=0x200, lpBuffer=0x2607fc0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2607fc0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.136] CloseHandle (hObject=0x200) returned 1
	[0064.137] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1
	[0064.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.137] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0064.138] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpFilePart=0x0) returned 0x4f
	[0064.138] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.139] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.139] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0064.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.140] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.142] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.143] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c
	[0064.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6d
	[0064.144] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.144] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.145] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.145] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.146] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0064.146] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.147] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c
	[0064.147] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6d
	[0064.147] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.148] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.148] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.149] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.149] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.149] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.150] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x78
	[0064.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0064.151] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.151] GetFileType (hFile=0x208) returned 0x1
	[0064.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0064.152] GetFileType (hFile=0x208) returned 0x1
	[0064.152] WriteFile (in: hFile=0x208, lpBuffer=0x260f248*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x260f248*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0064.154] CloseHandle (hObject=0x208) returned 1
	[0064.155] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.155] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.156] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0064.156] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.156] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.157] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.157] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.158] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0064.158] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.159] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0064.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0064.159] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.159] GetFileType (hFile=0x204) returned 0x1
	[0064.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0064.160] GetFileType (hFile=0x204) returned 0x1
	[0064.160] WriteFile (in: hFile=0x204, lpBuffer=0x26127ec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26127ec*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0064.163] CloseHandle (hObject=0x204) returned 1
	[0064.163] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.164] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.164] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0064.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpFilePart=0x0) returned 0x4f
	[0064.165] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.165] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.166] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.166] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0064.167] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.167] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0064.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.168] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.168] GetFileType (hFile=0x200) returned 0x1
	[0064.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0064.168] GetFileType (hFile=0x200) returned 0x1
	[0064.169] WriteFile (in: hFile=0x200, lpBuffer=0x2615bc8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2615bc8*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.171] CloseHandle (hObject=0x200) returned 1
	[0064.172] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1
	[0064.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.172] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x43
	[0064.173] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpFilePart=0x0) returned 0x44
	[0064.173] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.174] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.174] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd314a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf08b3aa0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0064.175] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0064.175] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0064.175] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x43
	[0064.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpFilePart=0x0) returned 0x44
	[0064.176] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.177] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.178] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd314a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf08b3aa0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0064.178] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0064.178] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.179] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.179] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0064.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.180] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.180] GetFileType (hFile=0x200) returned 0x1
	[0064.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0064.180] GetFileType (hFile=0x200) returned 0x1
	[0064.181] WriteFile (in: hFile=0x200, lpBuffer=0x261a45c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x261a45c*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.189] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1
	[0064.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.190] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0064.190] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpFilePart=0x0) returned 0x4f
	[0064.190] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.193] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.193] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.193] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0064.193] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.194] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.194] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.195] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.195] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x71
	[0064.196] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x72
	[0064.196] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.196] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.197] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87bcb00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0xa87bcb00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0xa87bcb00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.198] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.198] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0064.198] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.199] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x71
	[0064.199] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x72
	[0064.199] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.200] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.200] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87bcb00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0xa87bcb00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0xa87bcb00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.201] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.201] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.202] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.202] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7d
	[0064.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0064.202] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.203] GetFileType (hFile=0x208) returned 0x1
	[0064.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0064.203] GetFileType (hFile=0x208) returned 0x1
	[0064.203] WriteFile (in: hFile=0x208, lpBuffer=0x26218d0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26218d0*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0064.207] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.207] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0064.208] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.208] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.208] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.209] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.209] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0064.210] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.210] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0064.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0064.211] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.211] GetFileType (hFile=0x204) returned 0x1
	[0064.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0064.211] GetFileType (hFile=0x204) returned 0x1
	[0064.212] WriteFile (in: hFile=0x204, lpBuffer=0x2624e94*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2624e94*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0064.216] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.216] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0064.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpFilePart=0x0) returned 0x4f
	[0064.217] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.218] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.218] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.219] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0064.220] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.221] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0064.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.221] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.221] GetFileType (hFile=0x200) returned 0x1
	[0064.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0064.222] GetFileType (hFile=0x200) returned 0x1
	[0064.222] WriteFile (in: hFile=0x200, lpBuffer=0x2628270*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2628270*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.227] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1
	[0064.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.227] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpFilePart=0x0) returned 0x43
	[0064.228] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpFilePart=0x0) returned 0x44
	[0064.229] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.230] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.231] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a127460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1c821ca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0064.232] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0064.232] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0064.233] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.234] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpFilePart=0x0) returned 0x43
	[0064.234] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpFilePart=0x0) returned 0x44
	[0064.234] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.235] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.236] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a127460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1c821ca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0064.236] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0064.237] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.237] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.238] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0064.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.238] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.239] GetFileType (hFile=0x200) returned 0x1
	[0064.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0064.239] GetFileType (hFile=0x200) returned 0x1
	[0064.240] WriteFile (in: hFile=0x200, lpBuffer=0x262cb04*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x262cb04*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.244] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1
	[0064.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0064.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpFilePart=0x0) returned 0x50
	[0064.245] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.245] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.246] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.246] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0064.246] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59
	[0064.246] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.247] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.248] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.248] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6d
	[0064.248] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6e
	[0064.249] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.249] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.249] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15e8b00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd15e8b00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd15e8b00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.250] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.250] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0064.251] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.251] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6d
	[0064.251] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6e
	[0064.251] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.252] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.252] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15e8b00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd15e8b00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd15e8b00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.252] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.253] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.253] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.253] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x79
	[0064.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0064.253] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.254] GetFileType (hFile=0x208) returned 0x1
	[0064.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0064.254] GetFileType (hFile=0x208) returned 0x1
	[0064.254] WriteFile (in: hFile=0x208, lpBuffer=0x2633e0c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2633e0c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0064.257] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.258] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.258] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0064.258] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59
	[0064.258] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.259] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.260] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf7498f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7498f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.260] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf7498f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7498f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0064.261] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0064.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0064.261] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.262] GetFileType (hFile=0x204) returned 0x1
	[0064.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0064.262] GetFileType (hFile=0x204) returned 0x1
	[0064.262] WriteFile (in: hFile=0x204, lpBuffer=0x26373dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26373dc*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0064.265] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.265] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0064.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpFilePart=0x0) returned 0x50
	[0064.266] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.267] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.267] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.268] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0064.268] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.268] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0064.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.269] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.269] GetFileType (hFile=0x200) returned 0x1
	[0064.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0064.269] GetFileType (hFile=0x200) returned 0x1
	[0064.270] WriteFile (in: hFile=0x200, lpBuffer=0x263a7d0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x263a7d0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.273] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1
	[0064.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.273] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0064.274] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpFilePart=0x0) returned 0x50
	[0064.274] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.276] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.276] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.277] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0064.277] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59
	[0064.277] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.278] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.278] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.279] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x70
	[0064.279] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x71
	[0064.279] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.280] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.280] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.281] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.281] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0064.281] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.282] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x70
	[0064.282] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x71
	[0064.282] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.283] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.283] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.284] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.284] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.284] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.285] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7c
	[0064.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0064.285] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.286] GetFileType (hFile=0x208) returned 0x1
	[0064.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0064.286] GetFileType (hFile=0x208) returned 0x1
	[0064.286] WriteFile (in: hFile=0x208, lpBuffer=0x2641c38*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2641c38*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0064.289] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.289] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.290] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0064.290] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59
	[0064.290] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.292] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.293] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74e51f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74e51f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.293] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74e51f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74e51f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0064.293] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.294] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0064.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0064.294] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.294] GetFileType (hFile=0x204) returned 0x1
	[0064.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0064.295] GetFileType (hFile=0x204) returned 0x1
	[0064.295] WriteFile (in: hFile=0x204, lpBuffer=0x2645220*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2645220*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0064.298] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.298] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.299] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0064.299] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpFilePart=0x0) returned 0x50
	[0064.299] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.300] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.300] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.301] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0064.301] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.302] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0064.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.302] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.303] GetFileType (hFile=0x200) returned 0x1
	[0064.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0064.303] GetFileType (hFile=0x200) returned 0x1
	[0064.304] WriteFile (in: hFile=0x200, lpBuffer=0x2648614*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2648614*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.308] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1
	[0064.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.308] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0064.308] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpFilePart=0x0) returned 0x50
	[0064.308] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.319] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.320] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0064.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59
	[0064.320] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.321] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.322] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.322] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6f
	[0064.322] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x70
	[0064.323] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.323] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.324] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.324] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.325] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0064.325] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6f
	[0064.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x70
	[0064.326] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.326] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.327] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.327] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.328] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.328] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.328] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7b
	[0064.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0064.329] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.329] GetFileType (hFile=0x208) returned 0x1
	[0064.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0064.329] GetFileType (hFile=0x208) returned 0x1
	[0064.330] WriteFile (in: hFile=0x208, lpBuffer=0x264f9d0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x264f9d0*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0064.334] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.334] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.334] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0064.334] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59
	[0064.335] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.335] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.336] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7557610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7557610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.336] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7557610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7557610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0064.336] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.337] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0064.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0064.337] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.463] GetFileType (hFile=0x204) returned 0x1
	[0064.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0064.463] GetFileType (hFile=0x204) returned 0x1
	[0064.463] WriteFile (in: hFile=0x204, lpBuffer=0x2652fb0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2652fb0*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0064.470] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.470] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0064.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpFilePart=0x0) returned 0x50
	[0064.471] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.472] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.472] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7688110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7688110, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.473] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7688110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7688110, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0064.473] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0064.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.473] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.474] GetFileType (hFile=0x200) returned 0x1
	[0064.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0064.474] GetFileType (hFile=0x200) returned 0x1
	[0064.474] WriteFile (in: hFile=0x200, lpBuffer=0x26563a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x26563a4*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.531] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1
	[0064.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.531] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0064.531] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpFilePart=0x0) returned 0x4f
	[0064.532] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.533] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.533] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.534] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0064.534] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.534] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.535] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.535] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.535] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x71
	[0064.535] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x72
	[0064.536] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.536] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.536] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9b1b00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7c9b1b00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7c9b1b00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.537] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.537] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0064.537] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.538] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x71
	[0064.538] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x72
	[0064.538] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.539] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.539] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9b1b00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7c9b1b00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7c9b1b00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.539] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.540] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.540] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.557] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7d
	[0064.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0064.557] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.558] GetFileType (hFile=0x208) returned 0x1
	[0064.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0064.558] GetFileType (hFile=0x208) returned 0x1
	[0064.558] WriteFile (in: hFile=0x208, lpBuffer=0x265d818*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x265d818*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0064.562] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.562] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.562] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0064.562] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.563] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.563] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.563] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.564] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0064.564] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.564] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0064.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0064.564] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.565] GetFileType (hFile=0x204) returned 0x1
	[0064.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0064.565] GetFileType (hFile=0x204) returned 0x1
	[0064.565] WriteFile (in: hFile=0x204, lpBuffer=0x2660ddc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2660ddc*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0064.569] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.569] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.569] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0064.570] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpFilePart=0x0) returned 0x4f
	[0064.570] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.570] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.571] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.571] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0064.571] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.571] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0064.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.572] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.574] GetFileType (hFile=0x200) returned 0x1
	[0064.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0064.574] GetFileType (hFile=0x200) returned 0x1
	[0064.574] WriteFile (in: hFile=0x200, lpBuffer=0x26641b8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x26641b8*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.577] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1
	[0064.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.577] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0064.578] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", lpFilePart=0x0) returned 0x4f
	[0064.578] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.578] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.579] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.579] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0064.579] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.579] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.580] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.580] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.581] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6e
	[0064.581] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x6f
	[0064.581] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.581] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.582] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b69ee00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7b69ee00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7b69ee00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.582] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.582] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0064.583] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.583] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6e
	[0064.583] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x6f
	[0064.584] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.584] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.584] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b69ee00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7b69ee00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7b69ee00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.584] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.585] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.585] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.585] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7a
	[0064.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0064.585] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.586] GetFileType (hFile=0x208) returned 0x1
	[0064.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0064.586] GetFileType (hFile=0x208) returned 0x1
	[0064.586] WriteFile (in: hFile=0x208, lpBuffer=0x266b4f4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x266b4f4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0064.635] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.636] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.636] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0064.636] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.637] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.637] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.637] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf77b8c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf77b8c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.638] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf77b8c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf77b8c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0064.638] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.638] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0064.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0064.639] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.639] GetFileType (hFile=0x204) returned 0x1
	[0064.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0064.639] GetFileType (hFile=0x204) returned 0x1
	[0064.640] WriteFile (in: hFile=0x204, lpBuffer=0x266eaa8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x266eaa8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0064.643] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.643] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0064.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", lpFilePart=0x0) returned 0x4f
	[0064.644] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.644] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.645] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.645] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0064.645] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0064.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.646] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.646] GetFileType (hFile=0x200) returned 0x1
	[0064.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0064.647] GetFileType (hFile=0x200) returned 0x1
	[0064.647] WriteFile (in: hFile=0x200, lpBuffer=0x2671e84*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2671e84*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.651] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1
	[0064.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.651] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0064.651] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpFilePart=0x0) returned 0x4f
	[0064.651] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.698] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.699] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.699] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0064.699] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.699] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.707] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.707] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.707] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x6f
	[0064.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x70
	[0064.708] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.710] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.710] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aae6600, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x8aae6600, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x8aae6600, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.711] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.711] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0064.711] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x6f
	[0064.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x70
	[0064.712] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.713] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.713] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aae6600, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x8aae6600, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x8aae6600, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.713] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.713] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.714] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0064.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0064.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7b
	[0064.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0064.714] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.715] GetFileType (hFile=0x208) returned 0x1
	[0064.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0064.715] GetFileType (hFile=0x208) returned 0x1
	[0064.715] WriteFile (in: hFile=0x208, lpBuffer=0x2679244*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2679244*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0064.719] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.719] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0064.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.720] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.720] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.720] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.721] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0064.721] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0064.721] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.722] GetFileType (hFile=0x204) returned 0x1
	[0064.722] GetFileType (hFile=0x204) returned 0x1
	[0064.722] WriteFile (in: hFile=0x204, lpBuffer=0x267c7f8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x267c7f8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0064.725] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.726] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0064.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpFilePart=0x0) returned 0x4f
	[0064.726] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.727] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.727] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.727] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0064.727] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.728] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0064.728] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.728] GetFileType (hFile=0x200) returned 0x1
	[0064.728] GetFileType (hFile=0x200) returned 0x1
	[0064.729] WriteFile (in: hFile=0x200, lpBuffer=0x267fbd4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x267fbd4*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.731] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1
	[0064.732] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0064.732] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpFilePart=0x0) returned 0x4f
	[0064.732] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.733] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.733] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.733] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0064.734] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.734] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.736] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.736] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.736] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c
	[0064.737] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6d
	[0064.737] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.739] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.739] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884c0c00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x884c0c00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x884c0c00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.739] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.739] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0064.739] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.740] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c
	[0064.740] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6d
	[0064.740] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.740] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.740] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884c0c00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x884c0c00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x884c0c00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0064.740] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0064.741] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.741] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x78
	[0064.741] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.742] GetFileType (hFile=0x208) returned 0x1
	[0064.742] GetFileType (hFile=0x208) returned 0x1
	[0064.749] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.749] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.749] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0064.749] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.750] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.750] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.750] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0064.750] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0064.750] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.751] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0064.751] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.751] GetFileType (hFile=0x204) returned 0x1
	[0064.751] GetFileType (hFile=0x204) returned 0x1
	[0064.754] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.755] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0064.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpFilePart=0x0) returned 0x4f
	[0064.755] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.756] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.756] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0064.756] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0064.756] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.756] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0064.756] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.757] GetFileType (hFile=0x200) returned 0x1
	[0064.757] GetFileType (hFile=0x200) returned 0x1
	[0064.760] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1
	[0064.760] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpFilePart=0x0) returned 0x43
	[0064.760] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", lpFilePart=0x0) returned 0x44
	[0064.761] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.762] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.763] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfe3882c0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0064.763] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0064.763] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0064.763] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.768] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpFilePart=0x0) returned 0x43
	[0064.768] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", lpFilePart=0x0) returned 0x44
	[0064.768] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.770] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.770] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0064.770] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.771] GetFileType (hFile=0x200) returned 0x1
	[0064.771] GetFileType (hFile=0x200) returned 0x1
	[0064.774] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0064.774] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", lpFilePart=0x0) returned 0x4f
	[0064.783] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.793] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0064.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.794] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6e
	[0064.795] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x6f
	[0064.795] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.795] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.796] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6e
	[0064.796] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x6f
	[0064.796] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.796] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.797] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7a
	[0064.797] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.797] GetFileType (hFile=0x208) returned 0x1
	[0064.798] GetFileType (hFile=0x208) returned 0x1
	[0064.801] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57
	[0064.801] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.801] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.802] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.802] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0064.802] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.803] GetFileType (hFile=0x204) returned 0x1
	[0064.803] GetFileType (hFile=0x204) returned 0x1
	[0064.808] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.809] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpFilePart=0x0) returned 0x4e
	[0064.809] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", lpFilePart=0x0) returned 0x4f
	[0064.809] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.809] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.810] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0064.810] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.810] GetFileType (hFile=0x200) returned 0x1
	[0064.810] GetFileType (hFile=0x200) returned 0x1
	[0064.814] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0064.814] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", lpFilePart=0x0) returned 0x50
	[0064.814] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.815] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0064.815] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59
	[0064.815] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.818] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x72
	[0064.818] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x73
	[0064.818] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.819] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.819] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x72
	[0064.819] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x73
	[0064.819] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.820] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.820] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7e
	[0064.820] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.824] GetFileType (hFile=0x208) returned 0x1
	[0064.824] GetFileType (hFile=0x208) returned 0x1
	[0064.828] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.828] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58
	[0064.828] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59
	[0064.828] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.828] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.829] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0064.829] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.829] GetFileType (hFile=0x204) returned 0x1
	[0064.829] GetFileType (hFile=0x204) returned 0x1
	[0064.833] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.834] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpFilePart=0x0) returned 0x4f
	[0064.834] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", lpFilePart=0x0) returned 0x50
	[0064.834] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.834] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.834] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0064.834] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.835] GetFileType (hFile=0x200) returned 0x1
	[0064.835] GetFileType (hFile=0x200) returned 0x1
	[0064.838] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", lpFilePart=0x0) returned 0x43
	[0064.838] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\", lpFilePart=0x0) returned 0x44
	[0064.838] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.841] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.841] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", lpFilePart=0x0) returned 0x43
	[0064.842] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\", lpFilePart=0x0) returned 0x44
	[0064.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.842] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.842] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0064.842] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.843] GetFileType (hFile=0x200) returned 0x1
	[0064.843] GetFileType (hFile=0x200) returned 0x1
	[0064.846] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x43
	[0064.846] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpFilePart=0x0) returned 0x44
	[0064.846] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.848] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.848] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x43
	[0064.848] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpFilePart=0x0) returned 0x44
	[0064.849] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.849] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.849] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0064.849] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.850] GetFileType (hFile=0x200) returned 0x1
	[0064.850] GetFileType (hFile=0x200) returned 0x1
	[0064.854] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x43
	[0064.854] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpFilePart=0x0) returned 0x44
	[0064.854] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.856] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.856] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x43
	[0064.856] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpFilePart=0x0) returned 0x44
	[0064.856] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.857] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.857] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0064.857] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.858] GetFileType (hFile=0x200) returned 0x1
	[0064.858] GetFileType (hFile=0x200) returned 0x1
	[0064.861] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0064.861] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpFilePart=0x0) returned 0x4f
	[0064.861] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0064.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.862] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x6f
	[0064.863] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x70
	[0064.863] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.863] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.864] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x6f
	[0064.864] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x70
	[0064.864] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0064.865] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0064.865] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7b
	[0064.865] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0064.866] GetFileType (hFile=0x208) returned 0x1
	[0064.866] GetFileType (hFile=0x208) returned 0x1
	[0064.871] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57
	[0064.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58
	[0064.872] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.872] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0064.872] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.873] GetFileType (hFile=0x204) returned 0x1
	[0064.873] GetFileType (hFile=0x204) returned 0x1
	[0064.876] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.877] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x4e
	[0064.877] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpFilePart=0x0) returned 0x4f
	[0064.877] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.877] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.878] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0064.878] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.878] GetFileType (hFile=0x200) returned 0x1
	[0064.878] GetFileType (hFile=0x200) returned 0x1
	[0064.881] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0064.881] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache", lpFilePart=0x0) returned 0x1c
	[0064.882] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\", lpFilePart=0x0) returned 0x1d
	[0064.882] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0064.882] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0064.882] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0064.882] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\Decrypt.txt" (normalized: "c:\\programdata\\package cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0064.884] GetFileType (hFile=0x1fc) returned 0x1
	[0064.884] GetFileType (hFile=0x1fc) returned 0x1
	[0064.887] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Start Menu", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Start Menu", lpFilePart=0x0) returned 0x19
	[0064.887] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Start Menu\\", lpFilePart=0x0) returned 0x1a
	[0064.888] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Start Menu\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0064.895] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1
	[0064.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0064.896] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun", lpFilePart=0x0) returned 0x12
	[0064.896] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\", lpFilePart=0x0) returned 0x13
	[0064.896] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0064.900] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.900] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0064.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.901] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java", lpFilePart=0x0) returned 0x17
	[0064.901] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\", lpFilePart=0x0) returned 0x18
	[0064.901] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.902] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.903] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1
	[0064.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.903] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x23
	[0064.903] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x24
	[0064.904] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.905] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.906] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureglist.xml", cAlternateFileName="JAUREG~1.XML")) returned 1
	[0064.906] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureglist.xml", cAlternateFileName="JAUREG~1.XML")) returned 0
	[0064.907] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.908] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x23
	[0064.908] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x24
	[0064.908] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0064.909] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.910] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureglist.xml", cAlternateFileName="JAUREG~1.XML")) returned 1
	[0064.910] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.911] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0064.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0064.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0064.911] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0064.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0064.911] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\Decrypt.txt" (normalized: "c:\\programdata\\sun\\java\\java update\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0064.912] GetFileType (hFile=0x204) returned 0x1
	[0064.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0064.912] GetFileType (hFile=0x204) returned 0x1
	[0064.913] WriteFile (in: hFile=0x204, lpBuffer=0x26d340c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26d340c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0064.916] CloseHandle (hObject=0x204) returned 1
	[0064.919] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.919] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.920] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java", lpFilePart=0x0) returned 0x17
	[0064.920] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\", lpFilePart=0x0) returned 0x18
	[0064.920] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0064.921] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.922] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7ad88f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7ad88f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1
	[0064.922] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7ad88f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7ad88f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0
	[0064.923] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0064.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0064.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0064.923] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Decrypt.txt", lpFilePart=0x0) returned 0x23
	[0064.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0064.923] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Decrypt.txt" (normalized: "c:\\programdata\\sun\\java\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0064.954] GetFileType (hFile=0x200) returned 0x1
	[0064.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0064.955] GetFileType (hFile=0x200) returned 0x1
	[0064.955] WriteFile (in: hFile=0x200, lpBuffer=0x26d60e0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x26d60e0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0064.958] CloseHandle (hObject=0x200) returned 1
	[0064.959] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.959] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0064.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0064.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0064.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0064.960] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun", lpFilePart=0x0) returned 0x12
	[0064.960] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\", lpFilePart=0x0) returned 0x13
	[0064.960] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0064.961] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.965] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b4ad10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b4ad10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0064.965] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b4ad10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b4ad10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0
	[0064.966] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0064.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0064.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0064.966] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Decrypt.txt", lpFilePart=0x0) returned 0x1e
	[0064.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0064.967] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Decrypt.txt" (normalized: "c:\\programdata\\sun\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0064.967] GetFileType (hFile=0x1fc) returned 0x1
	[0064.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0064.968] GetFileType (hFile=0x1fc) returned 0x1
	[0064.968] WriteFile (in: hFile=0x1fc, lpBuffer=0x26d8ca4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x26d8ca4*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0064.972] CloseHandle (hObject=0x1fc) returned 1
	[0064.972] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0064.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0064.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates", lpFilePart=0x0) returned 0x18
	[0064.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates\\", lpFilePart=0x0) returned 0x19
	[0064.973] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Templates\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0064.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0c0) returned 1
	[0064.985] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0064.985] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0064.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0064.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0064.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0064.986] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe
	[0064.986] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\", lpFilePart=0x0) returned 0xf
	[0064.986] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0064.987] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0064.988] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39d5010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39d5010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0064.988] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0064.989] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0064.989] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0064.990] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0064.990] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6d9ae90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d9ae90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0064.991] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf6f63f10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6f63f10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0064.992] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fd6330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fd6330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0064.992] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf6ffc490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ffc490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1
	[0064.994] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1
	[0064.995] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0064.995] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b70e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b70e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1
	[0064.996] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0064.997] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0
	[0064.997] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0064.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0064.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0064.998] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb68, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Decrypt.txt", lpFilePart=0x0) returned 0x1a
	[0064.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0064.998] CreateFileW (lpFileName="C:\\ProgramData\\Decrypt.txt" (normalized: "c:\\programdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0064.999] GetFileType (hFile=0x1f0) returned 0x1
	[0065.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f058) returned 1
	[0065.000] GetFileType (hFile=0x1f0) returned 0x1
	[0065.000] WriteFile (in: hFile=0x1f0, lpBuffer=0x26dc9c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f0f4, lpOverlapped=0x0 | out: lpBuffer=0x26dc9c4*, lpNumberOfBytesWritten=0x26f0f4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.003] CloseHandle (hObject=0x1f0) returned 1
	[0065.004] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0065.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0065.005] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb
	[0065.005] GetFullPathNameW (in: lpFileName="C:\\Recovery\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\", lpFilePart=0x0) returned 0xc
	[0065.005] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0065.009] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.009] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 1
	[0065.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0065.010] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpFilePart=0x0) returned 0x30
	[0065.010] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpFilePart=0x0) returned 0x31
	[0065.010] FindFirstFileW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0065.011] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.011] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x27c2fae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1
	[0065.012] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 1
	[0065.012] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 0
	[0065.013] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0065.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0065.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0065.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0065.014] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpFilePart=0x0) returned 0x30
	[0065.014] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpFilePart=0x0) returned 0x31
	[0065.014] FindFirstFileW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0065.015] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.015] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x27c2fae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1
	[0065.016] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 1
	[0065.016] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.016] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0065.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0065.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0065.017] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0065.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0065.017] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Decrypt.txt" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0065.018] GetFileType (hFile=0x1fc) returned 0x1
	[0065.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0065.019] GetFileType (hFile=0x1fc) returned 0x1
	[0065.019] WriteFile (in: hFile=0x1fc, lpBuffer=0x26e0fac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x26e0fac*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0065.024] CloseHandle (hObject=0x1fc) returned 1
	[0065.025] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.025] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0065.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0065.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0065.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0065.026] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb
	[0065.026] GetFullPathNameW (in: lpFileName="C:\\Recovery\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\", lpFilePart=0x0) returned 0xc
	[0065.026] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0065.027] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.027] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7be3290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7be3290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 1
	[0065.028] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7be3290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7be3290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 0
	[0065.028] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0065.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0065.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0065.029] GetFullPathNameW (in: lpFileName="C:\\Recovery\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb68, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\Decrypt.txt", lpFilePart=0x0) returned 0x17
	[0065.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0065.029] CreateFileW (lpFileName="C:\\Recovery\\Decrypt.txt" (normalized: "c:\\recovery\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0065.030] GetFileType (hFile=0x1f0) returned 0x1
	[0065.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f058) returned 1
	[0065.030] GetFileType (hFile=0x1f0) returned 0x1
	[0065.030] WriteFile (in: hFile=0x1f0, lpBuffer=0x26e3bb8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f0f4, lpOverlapped=0x0 | out: lpBuffer=0x26e3bb8*, lpNumberOfBytesWritten=0x26f0f4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.033] CloseHandle (hObject=0x1f0) returned 1
	[0065.034] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1
	[0065.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0065.034] GetFullPathNameW (in: lpFileName="C:\\System Volume Information", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information", lpFilePart=0x0) returned 0x1c
	[0065.034] GetFullPathNameW (in: lpFileName="C:\\System Volume Information\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information\\", lpFilePart=0x0) returned 0x1d
	[0065.035] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0065.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f160) returned 1
	[0065.040] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0065.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0065.041] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
	[0065.041] GetFullPathNameW (in: lpFileName="C:\\Users\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\", lpFilePart=0x0) returned 0x9
	[0065.042] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0065.042] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.043] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1
	[0065.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0065.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d
	[0065.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpFilePart=0x0) returned 0x1e
	[0065.044] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0065.045] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.045] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0065.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0065.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", lpFilePart=0x0) returned 0x25
	[0065.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpFilePart=0x0) returned 0x26
	[0065.046] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0065.047] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.048] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0065.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0065.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b
	[0065.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c
	[0065.048] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0065.049] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.050] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0065.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0065.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x31
	[0065.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpFilePart=0x0) returned 0x32
	[0065.051] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0065.051] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.052] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0065.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0065.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x39
	[0065.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3a
	[0065.053] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0065.054] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.054] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0065.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0065.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x3e
	[0065.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x3f
	[0065.056] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0065.061] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.061] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1
	[0065.062] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1
	[0065.063] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0065.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", lpFilePart=0x0) returned 0x44
	[0065.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpFilePart=0x0) returned 0x45
	[0065.063] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0065.068] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.068] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1
	[0065.069] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0
	[0065.070] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0065.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0065.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0065.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", lpFilePart=0x0) returned 0x44
	[0065.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpFilePart=0x0) returned 0x45
	[0065.071] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0065.071] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.072] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1
	[0065.073] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.073] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0065.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0065.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0065.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0065.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0065.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0065.075] GetFileType (hFile=0x228) returned 0x1
	[0065.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0065.075] GetFileType (hFile=0x228) returned 0x1
	[0065.075] WriteFile (in: hFile=0x228, lpBuffer=0x26ec58c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26ec58c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0065.078] CloseHandle (hObject=0x228) returned 1
	[0065.079] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1
	[0065.080] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1
	[0065.080] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0
	[0065.080] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0065.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0065.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0065.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0065.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x3e
	[0065.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x3f
	[0065.081] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0065.082] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.083] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1
	[0065.083] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1
	[0065.083] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xf7c7b810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7c7b810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0065.084] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1
	[0065.084] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1
	[0065.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin", lpFilePart=0x0) returned 0x4c
	[0065.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0065.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0065.087] GetFileType (hFile=0x228) returned 0x1
	[0065.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0065.087] GetFileType (hFile=0x228) returned 0x1
	[0065.087] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x12ea5
	[0065.087] ReadFile (in: hFile=0x228, lpBuffer=0x26ef6b0, nNumberOfBytesToRead=0x12ea5, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26ef6b0*, lpNumberOfBytesRead=0x26ed44*=0x12ea5, lpOverlapped=0x0) returned 1
	[0065.095] CloseHandle (hObject=0x228) returned 1
	[0065.095] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.KEKW", lpFilePart=0x0) returned 0x51
	[0065.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0065.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0065.096] GetFileType (hFile=0x228) returned 0x1
	[0065.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0065.097] GetFileType (hFile=0x228) returned 0x1
	[0065.098] WriteFile (in: hFile=0x228, lpBuffer=0x2703cf8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2703cf8*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0065.101] CloseHandle (hObject=0x228) returned 1
	[0065.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin", lpFilePart=0x0) returned 0x4c
	[0065.102] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin")) returned 1
	[0065.107] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.107] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0065.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0065.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0065.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0065.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0065.109] GetFileType (hFile=0x224) returned 0x1
	[0065.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0065.109] GetFileType (hFile=0x224) returned 0x1
	[0065.110] WriteFile (in: hFile=0x224, lpBuffer=0x2706438*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2706438*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0065.112] CloseHandle (hObject=0x224) returned 1
	[0065.113] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.113] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0065.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0065.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0065.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0065.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x39
	[0065.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3a
	[0065.115] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0065.115] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.116] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf7cc7ad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7cc7ad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0065.116] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf7cc7ad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7cc7ad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0
	[0065.117] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0065.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0065.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0065.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0065.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0065.118] GetFileType (hFile=0x220) returned 0x1
	[0065.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0065.119] GetFileType (hFile=0x220) returned 0x1
	[0065.119] WriteFile (in: hFile=0x220, lpBuffer=0x2709520*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2709520*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.122] CloseHandle (hObject=0x220) returned 1
	[0065.122] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0065.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0065.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", lpFilePart=0x0) returned 0x37
	[0065.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", lpFilePart=0x0) returned 0x38
	[0065.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0065.124] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.125] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1
	[0065.125] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0065.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0065.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", lpFilePart=0x0) returned 0x40
	[0065.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpFilePart=0x0) returned 0x41
	[0065.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0065.129] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.129] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1
	[0065.130] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1
	[0065.130] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0
	[0065.131] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0065.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0065.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0065.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0065.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", lpFilePart=0x0) returned 0x40
	[0065.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpFilePart=0x0) returned 0x41
	[0065.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0065.132] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.133] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1
	[0065.133] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1
	[0065.134] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.134] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0065.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0065.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0065.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0065.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0065.136] GetFileType (hFile=0x224) returned 0x1
	[0065.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0065.136] GetFileType (hFile=0x224) returned 0x1
	[0065.136] WriteFile (in: hFile=0x224, lpBuffer=0x270e714*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x270e714*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0065.139] CloseHandle (hObject=0x224) returned 1
	[0065.140] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.140] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0065.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0065.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0065.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0065.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", lpFilePart=0x0) returned 0x37
	[0065.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", lpFilePart=0x0) returned 0x38
	[0065.141] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0065.142] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.142] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1
	[0065.143] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf7d13d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7d13d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0065.143] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf7d13d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7d13d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0
	[0065.144] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0065.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0065.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0065.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0065.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0065.145] GetFileType (hFile=0x220) returned 0x1
	[0065.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0065.145] GetFileType (hFile=0x220) returned 0x1
	[0065.146] WriteFile (in: hFile=0x220, lpBuffer=0x2711bb8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2711bb8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.149] CloseHandle (hObject=0x220) returned 1
	[0065.150] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.150] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0065.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0065.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0065.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0065.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x31
	[0065.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpFilePart=0x0) returned 0x32
	[0065.151] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0065.152] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.152] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf7cedc30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7cedc30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0065.153] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf7d13d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7d13d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0065.153] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf7d13d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7d13d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0
	[0065.154] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0065.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0065.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0065.154] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0065.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0065.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0065.155] GetFileType (hFile=0x208) returned 0x1
	[0065.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0065.156] GetFileType (hFile=0x208) returned 0x1
	[0065.156] WriteFile (in: hFile=0x208, lpBuffer=0x2714cc0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2714cc0*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0065.159] CloseHandle (hObject=0x208) returned 1
	[0065.159] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0065.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0065.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x3c
	[0065.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\", lpFilePart=0x0) returned 0x3d
	[0065.160] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0065.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eee0) returned 1
	[0065.165] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1
	[0065.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0065.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", lpFilePart=0x0) returned 0x30
	[0065.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", lpFilePart=0x0) returned 0x31
	[0065.166] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0065.167] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.168] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1
	[0065.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0065.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", lpFilePart=0x0) returned 0x34
	[0065.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", lpFilePart=0x0) returned 0x35
	[0065.169] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0065.170] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.170] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0065.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0065.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", lpFilePart=0x0) returned 0x39
	[0065.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", lpFilePart=0x0) returned 0x3a
	[0065.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0065.173] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.173] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1
	[0065.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", lpFilePart=0x0) returned 0x46
	[0065.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", lpFilePart=0x0) returned 0x47
	[0065.174] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0065.175] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.176] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1
	[0065.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ", lpFilePart=0x0) returned 0x53
	[0065.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\", lpFilePart=0x0) returned 0x54
	[0065.176] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.177] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.178] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1
	[0065.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0065.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpFilePart=0x0) returned 0x8a
	[0065.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", lpFilePart=0x0) returned 0x8b
	[0065.179] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0065.183] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.183] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0065.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0065.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data", lpFilePart=0x0) returned 0x8f
	[0065.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\", lpFilePart=0x0) returned 0x90
	[0065.184] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0065.185] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.186] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0065.186] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0065.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0065.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0065.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0065.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data", lpFilePart=0x0) returned 0x8f
	[0065.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\", lpFilePart=0x0) returned 0x90
	[0065.187] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0065.188] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.188] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0065.189] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0065.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0065.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0065.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Decrypt.txt", lpFilePart=0x0) returned 0x9b
	[0065.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\data\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0065.190] GetFileType (hFile=0x234) returned 0x1
	[0065.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0065.190] GetFileType (hFile=0x234) returned 0x1
	[0065.190] WriteFile (in: hFile=0x234, lpBuffer=0x271f114*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x271f114*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.194] CloseHandle (hObject=0x234) returned 1
	[0065.195] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.195] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0065.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0065.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0065.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0065.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpFilePart=0x0) returned 0x8a
	[0065.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", lpFilePart=0x0) returned 0x8b
	[0065.196] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0065.197] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.197] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7d861b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7d861b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0065.198] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7d861b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7d861b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0
	[0065.198] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0065.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0065.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0065.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0065.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0065.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0065.200] GetFileType (hFile=0x230) returned 0x1
	[0065.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0065.200] GetFileType (hFile=0x230) returned 0x1
	[0065.200] WriteFile (in: hFile=0x230, lpBuffer=0x2722cc8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x2722cc8*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0065.203] CloseHandle (hObject=0x230) returned 1
	[0065.203] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.204] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ", lpFilePart=0x0) returned 0x53
	[0065.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\", lpFilePart=0x0) returned 0x54
	[0065.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.205] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.206] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7dac310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7dac310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1
	[0065.206] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7dac310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7dac310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0
	[0065.207] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0065.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0065.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0065.208] GetFileType (hFile=0x22c) returned 0x1
	[0065.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0065.208] GetFileType (hFile=0x22c) returned 0x1
	[0065.208] WriteFile (in: hFile=0x22c, lpBuffer=0x2726304*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2726304*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.212] CloseHandle (hObject=0x22c) returned 1
	[0065.213] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.213] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0065.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0065.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0065.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", lpFilePart=0x0) returned 0x46
	[0065.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", lpFilePart=0x0) returned 0x47
	[0065.214] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0065.215] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.215] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7dac310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7dac310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1
	[0065.216] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7dac310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7dac310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0
	[0065.216] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0065.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0065.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0065.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0065.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0065.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0065.217] GetFileType (hFile=0x228) returned 0x1
	[0065.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0065.218] GetFileType (hFile=0x228) returned 0x1
	[0065.218] WriteFile (in: hFile=0x228, lpBuffer=0x27295f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27295f0*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0065.221] CloseHandle (hObject=0x228) returned 1
	[0065.221] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.221] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0065.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0065.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0065.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0065.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", lpFilePart=0x0) returned 0x39
	[0065.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", lpFilePart=0x0) returned 0x3a
	[0065.222] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0065.223] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.223] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7dd2470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7dd2470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1
	[0065.224] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7dd2470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7dd2470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0
	[0065.224] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0065.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0065.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0065.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0065.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0065.225] GetFileType (hFile=0x224) returned 0x1
	[0065.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0065.226] GetFileType (hFile=0x224) returned 0x1
	[0065.226] WriteFile (in: hFile=0x224, lpBuffer=0x272c718*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x272c718*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0065.229] CloseHandle (hObject=0x224) returned 1
	[0065.230] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1
	[0065.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0065.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", lpFilePart=0x0) returned 0x41
	[0065.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", lpFilePart=0x0) returned 0x42
	[0065.230] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0065.231] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.232] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1
	[0065.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", lpFilePart=0x0) returned 0x4e
	[0065.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", lpFilePart=0x0) returned 0x4f
	[0065.232] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0065.238] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.239] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1
	[0065.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", lpFilePart=0x0) returned 0x8a
	[0065.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\", lpFilePart=0x0) returned 0x8b
	[0065.239] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.241] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.242] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1
	[0065.243] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 0
	[0065.243] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", lpFilePart=0x0) returned 0x8a
	[0065.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\", lpFilePart=0x0) returned 0x8b
	[0065.244] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.245] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.246] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1
	[0065.246] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.246] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0065.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0065.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0065.248] GetFileType (hFile=0x22c) returned 0x1
	[0065.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0065.248] GetFileType (hFile=0x22c) returned 0x1
	[0065.248] WriteFile (in: hFile=0x22c, lpBuffer=0x27337cc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x27337cc*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.251] CloseHandle (hObject=0x22c) returned 1
	[0065.252] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1
	[0065.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpFilePart=0x0) returned 0x85
	[0065.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", lpFilePart=0x0) returned 0x86
	[0065.253] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.258] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.259] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 1
	[0065.260] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.cdf-ms", cAlternateFileName="")) returned 1
	[0065.260] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.manifest", cAlternateFileName="")) returned 1
	[0065.261] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap_unsigned.cdf-ms", cAlternateFileName="CLICKO~1.CDF")) returned 1
	[0065.261] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap_unsigned.manifest", cAlternateFileName="CLICKO~1.MAN")) returned 1
	[0065.262] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 1
	[0065.262] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 0
	[0065.263] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpFilePart=0x0) returned 0x85
	[0065.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", lpFilePart=0x0) returned 0x86
	[0065.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.269] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.269] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 1
	[0065.270] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.cdf-ms", cAlternateFileName="")) returned 1
	[0065.270] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.manifest", cAlternateFileName="")) returned 1
	[0065.271] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap_unsigned.cdf-ms", cAlternateFileName="CLICKO~1.CDF")) returned 1
	[0065.271] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap_unsigned.manifest", cAlternateFileName="CLICKO~1.MAN")) returned 1
	[0065.272] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 1
	[0065.272] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.272] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Decrypt.txt", lpFilePart=0x0) returned 0x91
	[0065.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0065.276] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0065.279] GetFileType (hFile=0x22c) returned 0x1
	[0065.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0065.279] GetFileType (hFile=0x22c) returned 0x1
	[0065.279] WriteFile (in: hFile=0x22c, lpBuffer=0x273c6a8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x273c6a8*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.283] CloseHandle (hObject=0x22c) returned 1
	[0065.284] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1
	[0065.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests", lpFilePart=0x0) returned 0x58
	[0065.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\", lpFilePart=0x0) returned 0x59
	[0065.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.290] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.290] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 1
	[0065.291] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 1
	[0065.292] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cAlternateFileName="GOOGAP~1.CDF")) returned 1
	[0065.292] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 1
	[0065.293] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 0
	[0065.293] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests", lpFilePart=0x0) returned 0x58
	[0065.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\", lpFilePart=0x0) returned 0x59
	[0065.297] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.300] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.300] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 1
	[0065.301] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 1
	[0065.301] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cAlternateFileName="GOOGAP~1.CDF")) returned 1
	[0065.302] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 1
	[0065.302] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.303] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0065.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0065.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0065.309] GetFileType (hFile=0x22c) returned 0x1
	[0065.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0065.310] GetFileType (hFile=0x22c) returned 0x1
	[0065.310] WriteFile (in: hFile=0x22c, lpBuffer=0x2743654*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2743654*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.313] CloseHandle (hObject=0x22c) returned 1
	[0065.313] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.314] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0065.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0065.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0065.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", lpFilePart=0x0) returned 0x4e
	[0065.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", lpFilePart=0x0) returned 0x4f
	[0065.315] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0065.315] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.316] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7e1e730, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7e1e730, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1
	[0065.316] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7e6a9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7e6a9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1
	[0065.317] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7eb6cb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7eb6cb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1
	[0065.317] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7eb6cb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7eb6cb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0
	[0065.318] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0065.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0065.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0065.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0065.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0065.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0065.319] GetFileType (hFile=0x228) returned 0x1
	[0065.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0065.319] GetFileType (hFile=0x228) returned 0x1
	[0065.319] WriteFile (in: hFile=0x228, lpBuffer=0x2747068*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2747068*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0065.328] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.328] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0065.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0065.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0065.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0065.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", lpFilePart=0x0) returned 0x41
	[0065.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", lpFilePart=0x0) returned 0x42
	[0065.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0065.329] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.330] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7eb6cb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7eb6cb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1
	[0065.331] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7eb6cb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7eb6cb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0
	[0065.331] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0065.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0065.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0065.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0065.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0065.332] GetFileType (hFile=0x224) returned 0x1
	[0065.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0065.332] GetFileType (hFile=0x224) returned 0x1
	[0065.333] WriteFile (in: hFile=0x224, lpBuffer=0x274a2a0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x274a2a0*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0065.336] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.336] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0065.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0065.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0065.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0065.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", lpFilePart=0x0) returned 0x34
	[0065.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", lpFilePart=0x0) returned 0x35
	[0065.337] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0065.338] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.338] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7dd2470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7dd2470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0065.339] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7edce10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7edce10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1
	[0065.340] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7edce10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7edce10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0
	[0065.340] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0065.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0065.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0065.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0065.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0065.342] GetFileType (hFile=0x220) returned 0x1
	[0065.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0065.343] GetFileType (hFile=0x220) returned 0x1
	[0065.343] WriteFile (in: hFile=0x220, lpBuffer=0x274d454*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x274d454*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.347] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.347] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0065.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0065.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0065.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0065.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", lpFilePart=0x0) returned 0x30
	[0065.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", lpFilePart=0x0) returned 0x31
	[0065.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0065.349] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.350] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7f02f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7f02f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1
	[0065.351] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7f02f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7f02f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0
	[0065.352] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0065.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0065.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0065.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0065.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0065.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0065.353] GetFileType (hFile=0x208) returned 0x1
	[0065.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0065.354] GetFileType (hFile=0x208) returned 0x1
	[0065.354] WriteFile (in: hFile=0x208, lpBuffer=0x275040c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x275040c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0065.358] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0065.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0065.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", lpFilePart=0x0) returned 0x36
	[0065.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", lpFilePart=0x0) returned 0x37
	[0065.359] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0065.360] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.360] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0065.361] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0065.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0065.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0065.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0065.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", lpFilePart=0x0) returned 0x36
	[0065.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", lpFilePart=0x0) returned 0x37
	[0065.362] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0065.362] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.363] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0065.363] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0065.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0065.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0065.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Decrypt.txt", lpFilePart=0x0) returned 0x42
	[0065.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0065.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\deployment\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0065.365] GetFileType (hFile=0x208) returned 0x1
	[0065.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0065.365] GetFileType (hFile=0x208) returned 0x1
	[0065.365] WriteFile (in: hFile=0x208, lpBuffer=0x2753d8c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2753d8c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0065.369] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0x0, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1
	[0065.370] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1
	[0065.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0065.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x32
	[0065.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", lpFilePart=0x0) returned 0x33
	[0065.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0065.372] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.372] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1
	[0065.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0065.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", lpFilePart=0x0) returned 0x39
	[0065.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", lpFilePart=0x0) returned 0x3a
	[0065.373] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0065.374] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.374] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1
	[0065.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0065.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x43
	[0065.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x44
	[0065.375] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0065.412] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.414] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1
	[0065.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpFilePart=0x0) returned 0x5b
	[0065.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", lpFilePart=0x0) returned 0x5c
	[0065.415] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0065.417] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.418] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0065.418] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0065.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0065.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0065.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpFilePart=0x0) returned 0x5b
	[0065.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", lpFilePart=0x0) returned 0x5c
	[0065.419] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0065.419] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.420] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0065.420] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0065.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0065.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0065.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0065.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0065.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0065.422] GetFileType (hFile=0x228) returned 0x1
	[0065.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0065.422] GetFileType (hFile=0x228) returned 0x1
	[0065.422] WriteFile (in: hFile=0x228, lpBuffer=0x275a07c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x275a07c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0065.425] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1
	[0065.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpFilePart=0x0) returned 0x4c
	[0065.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", lpFilePart=0x0) returned 0x4d
	[0065.426] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0065.437] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.437] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata", cAlternateFileName="")) returned 1
	[0065.438] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="reports", cAlternateFileName="")) returned 1
	[0065.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", lpFilePart=0x0) returned 0x54
	[0065.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", lpFilePart=0x0) returned 0x55
	[0065.438] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.439] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.440] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0065.440] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.441] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", lpFilePart=0x0) returned 0x54
	[0065.441] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", lpFilePart=0x0) returned 0x55
	[0065.441] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.441] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.442] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0065.442] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.442] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0065.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0065.443] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\reports\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0065.444] GetFileType (hFile=0x22c) returned 0x1
	[0065.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0065.444] GetFileType (hFile=0x22c) returned 0x1
	[0065.444] WriteFile (in: hFile=0x22c, lpBuffer=0x275ef08*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x275ef08*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.448] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0065.448] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0
	[0065.449] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0065.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0065.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0065.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpFilePart=0x0) returned 0x4c
	[0065.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", lpFilePart=0x0) returned 0x4d
	[0065.450] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0065.450] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.451] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata", cAlternateFileName="")) returned 1
	[0065.451] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7fe77b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7fe77b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="reports", cAlternateFileName="")) returned 1
	[0065.451] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1
	[0065.452] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat", lpFilePart=0x0) returned 0x59
	[0065.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0065.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0065.452] GetFileType (hFile=0x22c) returned 0x1
	[0065.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0065.453] GetFileType (hFile=0x22c) returned 0x1
	[0065.453] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x28
	[0065.453] ReadFile (in: hFile=0x22c, lpBuffer=0x2761798, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x2761798*, lpNumberOfBytesRead=0x26eca4*=0x28, lpOverlapped=0x0) returned 1
	[0065.456] CloseHandle (hObject=0x22c) returned 1
	[0065.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.KEKW", lpFilePart=0x0) returned 0x5e
	[0065.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0065.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0065.458] GetFileType (hFile=0x22c) returned 0x1
	[0065.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0065.458] GetFileType (hFile=0x22c) returned 0x1
	[0065.458] WriteFile (in: hFile=0x22c, lpBuffer=0x2763ef0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x2763ef0*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0065.462] CloseHandle (hObject=0x22c) returned 1
	[0065.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat", lpFilePart=0x0) returned 0x59
	[0065.462] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 1
	[0065.466] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.466] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0065.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0065.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0065.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Decrypt.txt", lpFilePart=0x0) returned 0x58
	[0065.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0065.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0065.467] GetFileType (hFile=0x228) returned 0x1
	[0065.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0065.467] GetFileType (hFile=0x228) returned 0x1
	[0065.468] WriteFile (in: hFile=0x228, lpBuffer=0x2766680*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2766680*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0065.471] CloseHandle (hObject=0x228) returned 1
	[0065.471] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1
	[0065.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0065.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpFilePart=0x0) returned 0x4b
	[0065.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpFilePart=0x0) returned 0x4c
	[0065.472] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0065.477] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.480] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0065.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", lpFilePart=0x0) returned 0x51
	[0065.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", lpFilePart=0x0) returned 0x52
	[0065.481] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.485] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.486] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_0", cAlternateFileName="")) returned 1
	[0065.487] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_1", cAlternateFileName="")) returned 1
	[0065.487] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_2", cAlternateFileName="")) returned 1
	[0065.488] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x402000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_3", cAlternateFileName="")) returned 1
	[0065.488] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 1
	[0065.489] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 0
	[0065.489] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.490] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", lpFilePart=0x0) returned 0x51
	[0065.490] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", lpFilePart=0x0) returned 0x52
	[0065.490] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.491] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.491] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_0", cAlternateFileName="")) returned 1
	[0065.493] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_1", cAlternateFileName="")) returned 1
	[0065.494] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_2", cAlternateFileName="")) returned 1
	[0065.495] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x402000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_3", cAlternateFileName="")) returned 1
	[0065.495] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 1
	[0065.496] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.497] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.497] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0065.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0065.498] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0065.499] GetFileType (hFile=0x22c) returned 0x1
	[0065.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0065.499] GetFileType (hFile=0x22c) returned 0x1
	[0065.500] WriteFile (in: hFile=0x22c, lpBuffer=0x276cfbc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x276cfbc*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.503] CloseHandle (hObject=0x22c) returned 1
	[0065.503] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0065.504] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d44890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 1
	[0065.504] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83b08a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83b08a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0b57b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 1
	[0065.505] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3b6860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3b6860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b8f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 1
	[0065.506] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_reduction_proxy_leveldb", cAlternateFileName="DATA_R~1")) returned 1
	[0065.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", lpFilePart=0x0) returned 0x68
	[0065.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", lpFilePart=0x0) returned 0x69
	[0065.507] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.512] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.512] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1
	[0065.513] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x804795c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1
	[0065.514] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1
	[0065.515] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9ab9e110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1
	[0065.516] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1
	[0065.517] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0
	[0065.517] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", lpFilePart=0x0) returned 0x68
	[0065.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", lpFilePart=0x0) returned 0x69
	[0065.523] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.525] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.526] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1
	[0065.526] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x804795c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1
	[0065.527] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1
	[0065.527] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9ab9e110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1
	[0065.528] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1
	[0065.528] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.528] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\Decrypt.txt", lpFilePart=0x0) returned 0x74
	[0065.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0065.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0065.534] GetFileType (hFile=0x22c) returned 0x1
	[0065.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0065.534] GetFileType (hFile=0x22c) returned 0x1
	[0065.534] WriteFile (in: hFile=0x22c, lpBuffer=0x2774138*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2774138*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.538] CloseHandle (hObject=0x22c) returned 1
	[0065.538] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extension Rules", cAlternateFileName="EXTENS~3")) returned 1
	[0065.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", lpFilePart=0x0) returned 0x5b
	[0065.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", lpFilePart=0x0) returned 0x5c
	[0065.539] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.545] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.546] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1
	[0065.546] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82adc050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82adc050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1
	[0065.547] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ad9940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1
	[0065.547] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1
	[0065.548] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1
	[0065.548] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0
	[0065.549] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", lpFilePart=0x0) returned 0x5b
	[0065.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", lpFilePart=0x0) returned 0x5c
	[0065.557] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.560] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.560] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1
	[0065.560] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82adc050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82adc050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1
	[0065.563] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ad9940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1
	[0065.563] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1
	[0065.564] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1
	[0065.564] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.565] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0065.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0065.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0065.578] GetFileType (hFile=0x22c) returned 0x1
	[0065.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0065.579] GetFileType (hFile=0x22c) returned 0x1
	[0065.579] WriteFile (in: hFile=0x22c, lpBuffer=0x277a494*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x277a494*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.582] CloseHandle (hObject=0x22c) returned 1
	[0065.583] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extension State", cAlternateFileName="EXTENS~2")) returned 1
	[0065.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", lpFilePart=0x0) returned 0x5b
	[0065.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", lpFilePart=0x0) returned 0x5c
	[0065.584] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.592] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.592] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1
	[0065.592] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824d3190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1
	[0065.593] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1
	[0065.593] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1
	[0065.594] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1
	[0065.594] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0
	[0065.595] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", lpFilePart=0x0) returned 0x5b
	[0065.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", lpFilePart=0x0) returned 0x5c
	[0065.599] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.606] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.607] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1
	[0065.607] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824d3190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1
	[0065.608] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1
	[0065.608] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1
	[0065.609] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1
	[0065.609] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.610] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0065.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0065.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0065.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0065.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0065.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0065.619] GetFileType (hFile=0x22c) returned 0x1
	[0065.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0065.619] GetFileType (hFile=0x22c) returned 0x1
	[0065.619] WriteFile (in: hFile=0x22c, lpBuffer=0x27807f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x27807f0*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0065.624] CloseHandle (hObject=0x22c) returned 1
	[0065.625] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1
	[0065.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0065.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpFilePart=0x0) returned 0x56
	[0065.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", lpFilePart=0x0) returned 0x57
	[0065.626] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0065.634] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.634] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aapocclcgogkmnckokdopfmhonfmgoek", cAlternateFileName="AAPOCC~1")) returned 1
	[0065.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0065.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", lpFilePart=0x0) returned 0x77
	[0065.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", lpFilePart=0x0) returned 0x78
	[0065.635] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0065.641] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.641] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1
	[0065.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0065.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpFilePart=0x0) returned 0x7d
	[0065.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", lpFilePart=0x0) returned 0x7e
	[0065.642] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0065.650] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.650] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1
	[0065.651] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_16.png", cAlternateFileName="")) returned 1
	[0065.651] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b74730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1
	[0065.651] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js", cAlternateFileName="")) returned 1
	[0065.652] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0065.652] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0065.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0065.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpFilePart=0x0) returned 0x86
	[0065.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x87
	[0065.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0065.675] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.676] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0065.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x89
	[0065.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a
	[0065.677] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.678] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.678] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.678] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0065.679] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x89
	[0065.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a
	[0065.680] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.681] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.681] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.682] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.682] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0065.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0065.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.684] GetFileType (hFile=0x23c) returned 0x1
	[0065.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0065.684] GetFileType (hFile=0x23c) returned 0x1
	[0065.684] WriteFile (in: hFile=0x23c, lpBuffer=0x278b07c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x278b07c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.687] CloseHandle (hObject=0x23c) returned 1
	[0065.687] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0065.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x89
	[0065.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a
	[0065.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.690] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.690] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.691] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0065.691] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x89
	[0065.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a
	[0065.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.693] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.693] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.694] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.694] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0065.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0065.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.704] GetFileType (hFile=0x23c) returned 0x1
	[0065.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0065.704] GetFileType (hFile=0x23c) returned 0x1
	[0065.704] WriteFile (in: hFile=0x23c, lpBuffer=0x2790740*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2790740*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.707] CloseHandle (hObject=0x23c) returned 1
	[0065.707] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0065.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", lpFilePart=0x0) returned 0x89
	[0065.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a
	[0065.708] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.711] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.711] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.712] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0065.712] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", lpFilePart=0x0) returned 0x89
	[0065.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a
	[0065.714] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.714] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.715] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.715] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.716] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0065.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0065.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.717] GetFileType (hFile=0x23c) returned 0x1
	[0065.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0065.717] GetFileType (hFile=0x23c) returned 0x1
	[0065.717] WriteFile (in: hFile=0x23c, lpBuffer=0x2795e04*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2795e04*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.725] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0065.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", lpFilePart=0x0) returned 0x89
	[0065.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a
	[0065.726] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.727] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.727] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.728] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0065.728] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", lpFilePart=0x0) returned 0x89
	[0065.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a
	[0065.729] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.730] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.730] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.730] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.730] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0065.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0065.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.732] GetFileType (hFile=0x23c) returned 0x1
	[0065.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0065.732] GetFileType (hFile=0x23c) returned 0x1
	[0065.732] WriteFile (in: hFile=0x23c, lpBuffer=0x279b4c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x279b4c8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.735] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0065.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", lpFilePart=0x0) returned 0x89
	[0065.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a
	[0065.736] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.739] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.740] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.740] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0065.741] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", lpFilePart=0x0) returned 0x89
	[0065.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a
	[0065.742] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.743] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.743] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.744] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.744] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0065.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0065.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.745] GetFileType (hFile=0x23c) returned 0x1
	[0065.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0065.745] GetFileType (hFile=0x23c) returned 0x1
	[0065.745] WriteFile (in: hFile=0x23c, lpBuffer=0x27a0b8c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27a0b8c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.750] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0065.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", lpFilePart=0x0) returned 0x89
	[0065.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a
	[0065.751] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.752] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.752] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.752] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0065.753] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", lpFilePart=0x0) returned 0x89
	[0065.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a
	[0065.754] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.755] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.755] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.756] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0065.756] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0065.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0065.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.758] GetFileType (hFile=0x23c) returned 0x1
	[0065.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0065.758] GetFileType (hFile=0x23c) returned 0x1
	[0065.759] WriteFile (in: hFile=0x23c, lpBuffer=0x27a6250*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27a6250*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.762] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0065.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", lpFilePart=0x0) returned 0x89
	[0065.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a
	[0065.762] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.765] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0065.765] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0065.766] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", lpFilePart=0x0) returned 0x89
	[0065.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a
	[0065.767] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.768] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0065.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0065.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.769] GetFileType (hFile=0x23c) returned 0x1
	[0065.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0065.770] GetFileType (hFile=0x23c) returned 0x1
	[0065.770] WriteFile (in: hFile=0x23c, lpBuffer=0x27ab914*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27ab914*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.773] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c
	[0065.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d
	[0065.774] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.776] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c
	[0065.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d
	[0065.777] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.778] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0065.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0065.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.779] GetFileType (hFile=0x23c) returned 0x1
	[0065.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0065.780] GetFileType (hFile=0x23c) returned 0x1
	[0065.780] WriteFile (in: hFile=0x23c, lpBuffer=0x27b10dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27b10dc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c
	[0065.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d
	[0065.784] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.943] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c
	[0065.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d
	[0065.947] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.948] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0065.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0065.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.950] GetFileType (hFile=0x23c) returned 0x1
	[0065.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0065.950] GetFileType (hFile=0x23c) returned 0x1
	[0065.950] WriteFile (in: hFile=0x23c, lpBuffer=0x27b68a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27b68a4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", lpFilePart=0x0) returned 0x89
	[0065.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a
	[0065.954] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.959] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0065.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0065.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", lpFilePart=0x0) returned 0x89
	[0065.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a
	[0065.960] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.961] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0065.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0065.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.962] GetFileType (hFile=0x23c) returned 0x1
	[0065.963] GetFileType (hFile=0x23c) returned 0x1
	[0065.963] WriteFile (in: hFile=0x23c, lpBuffer=0x27bbf68*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27bbf68*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d
	[0065.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e
	[0065.967] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.968] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d
	[0065.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e
	[0065.969] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.970] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0065.970] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.971] GetFileType (hFile=0x23c) returned 0x1
	[0065.971] GetFileType (hFile=0x23c) returned 0x1
	[0065.971] WriteFile (in: hFile=0x23c, lpBuffer=0x27c175c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27c175c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", lpFilePart=0x0) returned 0x89
	[0065.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a
	[0065.975] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.978] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", lpFilePart=0x0) returned 0x89
	[0065.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a
	[0065.978] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.979] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0065.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.980] GetFileType (hFile=0x23c) returned 0x1
	[0065.981] GetFileType (hFile=0x23c) returned 0x1
	[0065.981] WriteFile (in: hFile=0x23c, lpBuffer=0x27c6e20*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27c6e20*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", lpFilePart=0x0) returned 0x89
	[0065.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a
	[0065.984] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.986] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", lpFilePart=0x0) returned 0x89
	[0065.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a
	[0065.986] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0065.987] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0065.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0065.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0065.988] GetFileType (hFile=0x23c) returned 0x1
	[0065.988] GetFileType (hFile=0x23c) returned 0x1
	[0065.988] WriteFile (in: hFile=0x23c, lpBuffer=0x27cc4e4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27cc4e4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0065.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a
	[0065.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b
	[0065.996] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.002] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a
	[0066.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b
	[0066.002] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.003] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0066.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.004] GetFileType (hFile=0x23c) returned 0x1
	[0066.004] GetFileType (hFile=0x23c) returned 0x1
	[0066.005] WriteFile (in: hFile=0x23c, lpBuffer=0x27d1c14*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27d1c14*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", lpFilePart=0x0) returned 0x89
	[0066.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a
	[0066.008] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.010] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.010] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", lpFilePart=0x0) returned 0x89
	[0066.010] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a
	[0066.011] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.012] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.013] GetFileType (hFile=0x23c) returned 0x1
	[0066.013] GetFileType (hFile=0x23c) returned 0x1
	[0066.013] WriteFile (in: hFile=0x23c, lpBuffer=0x27d72d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27d72d8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", lpFilePart=0x0) returned 0x89
	[0066.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a
	[0066.016] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.021] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", lpFilePart=0x0) returned 0x89
	[0066.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a
	[0066.022] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.023] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.024] GetFileType (hFile=0x23c) returned 0x1
	[0066.024] GetFileType (hFile=0x23c) returned 0x1
	[0066.025] WriteFile (in: hFile=0x23c, lpBuffer=0x27dc99c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27dc99c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", lpFilePart=0x0) returned 0x89
	[0066.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a
	[0066.029] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.030] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", lpFilePart=0x0) returned 0x89
	[0066.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a
	[0066.035] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.036] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.037] GetFileType (hFile=0x23c) returned 0x1
	[0066.037] GetFileType (hFile=0x23c) returned 0x1
	[0066.040] WriteFile (in: hFile=0x23c, lpBuffer=0x27e2060*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27e2060*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.044] CloseHandle (hObject=0x23c) returned 1
	[0066.045] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0066.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", lpFilePart=0x0) returned 0x89
	[0066.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a
	[0066.046] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.048] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.048] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.049] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.049] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", lpFilePart=0x0) returned 0x89
	[0066.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a
	[0066.050] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.051] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.052] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.052] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.052] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.054] GetFileType (hFile=0x23c) returned 0x1
	[0066.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.055] GetFileType (hFile=0x23c) returned 0x1
	[0066.055] WriteFile (in: hFile=0x23c, lpBuffer=0x27e7724*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27e7724*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.058] CloseHandle (hObject=0x23c) returned 1
	[0066.058] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0066.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", lpFilePart=0x0) returned 0x89
	[0066.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a
	[0066.060] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.060] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.061] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.062] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.062] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", lpFilePart=0x0) returned 0x89
	[0066.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a
	[0066.063] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.064] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.064] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.065] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.065] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.068] GetFileType (hFile=0x23c) returned 0x1
	[0066.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.068] GetFileType (hFile=0x23c) returned 0x1
	[0066.069] WriteFile (in: hFile=0x23c, lpBuffer=0x27ecde8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27ecde8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.074] CloseHandle (hObject=0x23c) returned 1
	[0066.074] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0066.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", lpFilePart=0x0) returned 0x89
	[0066.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a
	[0066.083] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.085] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.086] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.087] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.087] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", lpFilePart=0x0) returned 0x89
	[0066.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a
	[0066.088] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.089] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.089] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.090] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.090] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.091] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.092] GetFileType (hFile=0x23c) returned 0x1
	[0066.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.092] GetFileType (hFile=0x23c) returned 0x1
	[0066.092] WriteFile (in: hFile=0x23c, lpBuffer=0x25f408c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25f408c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.095] CloseHandle (hObject=0x23c) returned 1
	[0066.095] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0066.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.096] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", lpFilePart=0x0) returned 0x89
	[0066.096] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a
	[0066.096] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.097] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.097] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.098] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.098] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", lpFilePart=0x0) returned 0x89
	[0066.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a
	[0066.099] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.100] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.101] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.101] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.101] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.103] GetFileType (hFile=0x23c) returned 0x1
	[0066.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.103] GetFileType (hFile=0x23c) returned 0x1
	[0066.104] WriteFile (in: hFile=0x23c, lpBuffer=0x25f9750*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25f9750*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.106] CloseHandle (hObject=0x23c) returned 1
	[0066.107] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0066.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", lpFilePart=0x0) returned 0x89
	[0066.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a
	[0066.107] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.110] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.111] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.111] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.112] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", lpFilePart=0x0) returned 0x89
	[0066.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a
	[0066.112] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.113] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.114] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.114] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.114] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.117] GetFileType (hFile=0x23c) returned 0x1
	[0066.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.117] GetFileType (hFile=0x23c) returned 0x1
	[0066.117] WriteFile (in: hFile=0x23c, lpBuffer=0x25fee14*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25fee14*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.121] CloseHandle (hObject=0x23c) returned 1
	[0066.121] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0066.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", lpFilePart=0x0) returned 0x89
	[0066.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a
	[0066.122] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.123] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.124] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.124] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.125] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", lpFilePart=0x0) returned 0x89
	[0066.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a
	[0066.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.126] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.127] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.127] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.128] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.129] GetFileType (hFile=0x23c) returned 0x1
	[0066.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.129] GetFileType (hFile=0x23c) returned 0x1
	[0066.130] WriteFile (in: hFile=0x23c, lpBuffer=0x26044d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26044d8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.133] CloseHandle (hObject=0x23c) returned 1
	[0066.133] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0066.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", lpFilePart=0x0) returned 0x89
	[0066.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a
	[0066.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.148] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.149] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.149] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.150] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", lpFilePart=0x0) returned 0x89
	[0066.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a
	[0066.152] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.152] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.153] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.154] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.154] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.157] GetFileType (hFile=0x23c) returned 0x1
	[0066.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.157] GetFileType (hFile=0x23c) returned 0x1
	[0066.157] WriteFile (in: hFile=0x23c, lpBuffer=0x2609b9c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2609b9c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.160] CloseHandle (hObject=0x23c) returned 1
	[0066.160] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1
	[0066.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", lpFilePart=0x0) returned 0x89
	[0066.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a
	[0066.161] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.162] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.165] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.165] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.166] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", lpFilePart=0x0) returned 0x89
	[0066.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a
	[0066.167] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.168] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.168] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.168] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.169] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.170] GetFileType (hFile=0x23c) returned 0x1
	[0066.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.171] GetFileType (hFile=0x23c) returned 0x1
	[0066.171] WriteFile (in: hFile=0x23c, lpBuffer=0x260f260*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x260f260*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.174] CloseHandle (hObject=0x23c) returned 1
	[0066.174] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0066.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", lpFilePart=0x0) returned 0x89
	[0066.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a
	[0066.175] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.180] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.180] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.181] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.181] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", lpFilePart=0x0) returned 0x89
	[0066.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a
	[0066.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.183] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.183] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.183] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.184] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.185] GetFileType (hFile=0x23c) returned 0x1
	[0066.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.186] GetFileType (hFile=0x23c) returned 0x1
	[0066.186] WriteFile (in: hFile=0x23c, lpBuffer=0x2614924*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2614924*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.189] CloseHandle (hObject=0x23c) returned 1
	[0066.189] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0066.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", lpFilePart=0x0) returned 0x89
	[0066.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a
	[0066.190] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.191] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.192] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.192] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.193] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", lpFilePart=0x0) returned 0x89
	[0066.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a
	[0066.194] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.194] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.195] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.195] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.195] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.197] GetFileType (hFile=0x23c) returned 0x1
	[0066.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.197] GetFileType (hFile=0x23c) returned 0x1
	[0066.197] WriteFile (in: hFile=0x23c, lpBuffer=0x2619fe8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2619fe8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.200] CloseHandle (hObject=0x23c) returned 1
	[0066.201] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0066.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", lpFilePart=0x0) returned 0x89
	[0066.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a
	[0066.202] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.204] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.204] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.205] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.206] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", lpFilePart=0x0) returned 0x89
	[0066.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a
	[0066.207] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.207] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.208] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.208] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.209] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.210] GetFileType (hFile=0x23c) returned 0x1
	[0066.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.210] GetFileType (hFile=0x23c) returned 0x1
	[0066.211] WriteFile (in: hFile=0x23c, lpBuffer=0x261f6ac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x261f6ac*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.214] CloseHandle (hObject=0x23c) returned 1
	[0066.214] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0066.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c
	[0066.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d
	[0066.215] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.216] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.217] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.217] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.218] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c
	[0066.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d
	[0066.219] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.219] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.220] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.220] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.221] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0066.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.222] GetFileType (hFile=0x23c) returned 0x1
	[0066.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.222] GetFileType (hFile=0x23c) returned 0x1
	[0066.223] WriteFile (in: hFile=0x23c, lpBuffer=0x2624e74*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2624e74*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.226] CloseHandle (hObject=0x23c) returned 1
	[0066.226] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0066.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c
	[0066.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d
	[0066.227] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.230] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.230] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.231] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.231] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c
	[0066.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d
	[0066.232] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.233] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.233] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.233] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.234] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0066.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.234] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.235] GetFileType (hFile=0x23c) returned 0x1
	[0066.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.235] GetFileType (hFile=0x23c) returned 0x1
	[0066.235] WriteFile (in: hFile=0x23c, lpBuffer=0x262a63c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x262a63c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.243] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0066.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", lpFilePart=0x0) returned 0x89
	[0066.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a
	[0066.244] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.245] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.245] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.246] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.246] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", lpFilePart=0x0) returned 0x89
	[0066.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a
	[0066.247] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.248] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.248] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.249] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.249] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.250] GetFileType (hFile=0x23c) returned 0x1
	[0066.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.250] GetFileType (hFile=0x23c) returned 0x1
	[0066.251] WriteFile (in: hFile=0x23c, lpBuffer=0x262fd00*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x262fd00*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.254] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0066.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru", lpFilePart=0x0) returned 0x89
	[0066.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8a
	[0066.254] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.257] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.257] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.258] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.258] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru", lpFilePart=0x0) returned 0x89
	[0066.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8a
	[0066.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.260] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.260] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.261] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.261] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.262] GetFileType (hFile=0x23c) returned 0x1
	[0066.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.263] GetFileType (hFile=0x23c) returned 0x1
	[0066.263] WriteFile (in: hFile=0x23c, lpBuffer=0x26353c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26353c4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.266] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0066.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk", lpFilePart=0x0) returned 0x89
	[0066.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8a
	[0066.267] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.268] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.268] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.269] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.270] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk", lpFilePart=0x0) returned 0x89
	[0066.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8a
	[0066.270] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.271] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.272] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.272] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.273] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.274] GetFileType (hFile=0x23c) returned 0x1
	[0066.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.274] GetFileType (hFile=0x23c) returned 0x1
	[0066.275] WriteFile (in: hFile=0x23c, lpBuffer=0x263aa88*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x263aa88*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.278] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0066.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl", lpFilePart=0x0) returned 0x89
	[0066.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8a
	[0066.278] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.280] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.281] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.281] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.282] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl", lpFilePart=0x0) returned 0x89
	[0066.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8a
	[0066.282] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.283] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.283] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.284] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.284] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.285] GetFileType (hFile=0x23c) returned 0x1
	[0066.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.285] GetFileType (hFile=0x23c) returned 0x1
	[0066.285] WriteFile (in: hFile=0x23c, lpBuffer=0x264014c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x264014c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.289] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0066.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr", lpFilePart=0x0) returned 0x89
	[0066.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a
	[0066.290] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.290] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.291] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.292] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.292] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr", lpFilePart=0x0) returned 0x89
	[0066.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a
	[0066.293] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.293] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.293] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.294] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.294] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.313] GetFileType (hFile=0x23c) returned 0x1
	[0066.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.313] GetFileType (hFile=0x23c) returned 0x1
	[0066.314] WriteFile (in: hFile=0x23c, lpBuffer=0x2645810*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2645810*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.317] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0066.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv", lpFilePart=0x0) returned 0x89
	[0066.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8a
	[0066.317] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.319] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.320] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.320] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.321] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv", lpFilePart=0x0) returned 0x89
	[0066.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8a
	[0066.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.322] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.322] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.323] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.323] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.324] GetFileType (hFile=0x23c) returned 0x1
	[0066.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.325] GetFileType (hFile=0x23c) returned 0x1
	[0066.325] WriteFile (in: hFile=0x23c, lpBuffer=0x264aed4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x264aed4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.328] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0066.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th", lpFilePart=0x0) returned 0x89
	[0066.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a
	[0066.328] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.329] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.329] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.330] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.330] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th", lpFilePart=0x0) returned 0x89
	[0066.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a
	[0066.331] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.331] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.332] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.332] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.332] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.334] GetFileType (hFile=0x23c) returned 0x1
	[0066.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.335] GetFileType (hFile=0x23c) returned 0x1
	[0066.335] WriteFile (in: hFile=0x23c, lpBuffer=0x2650598*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2650598*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.338] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0066.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr", lpFilePart=0x0) returned 0x89
	[0066.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a
	[0066.338] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.341] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.341] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.342] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.342] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr", lpFilePart=0x0) returned 0x89
	[0066.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a
	[0066.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.343] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.344] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.344] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.344] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.346] GetFileType (hFile=0x23c) returned 0x1
	[0066.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.346] GetFileType (hFile=0x23c) returned 0x1
	[0066.346] WriteFile (in: hFile=0x23c, lpBuffer=0x2655c5c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2655c5c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.349] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0066.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk", lpFilePart=0x0) returned 0x89
	[0066.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a
	[0066.350] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.351] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.351] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.352] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.352] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk", lpFilePart=0x0) returned 0x89
	[0066.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a
	[0066.353] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.353] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.354] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.354] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.354] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.355] GetFileType (hFile=0x23c) returned 0x1
	[0066.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.356] GetFileType (hFile=0x23c) returned 0x1
	[0066.356] WriteFile (in: hFile=0x23c, lpBuffer=0x265b320*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x265b320*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.359] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0066.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi", lpFilePart=0x0) returned 0x89
	[0066.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a
	[0066.360] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.362] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.362] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.363] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.363] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi", lpFilePart=0x0) returned 0x89
	[0066.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a
	[0066.364] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.365] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.366] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.366] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.366] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.367] GetFileType (hFile=0x23c) returned 0x1
	[0066.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.368] GetFileType (hFile=0x23c) returned 0x1
	[0066.368] WriteFile (in: hFile=0x23c, lpBuffer=0x26609e4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26609e4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.371] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1
	[0066.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c
	[0066.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d
	[0066.372] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.372] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.373] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.373] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.373] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c
	[0066.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d
	[0066.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.375] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.375] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.376] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.376] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0066.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.377] GetFileType (hFile=0x23c) returned 0x1
	[0066.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.377] GetFileType (hFile=0x23c) returned 0x1
	[0066.377] WriteFile (in: hFile=0x23c, lpBuffer=0x26661ac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26661ac*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.380] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0066.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c
	[0066.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d
	[0066.455] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.459] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.459] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.460] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.460] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c
	[0066.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d
	[0066.461] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.462] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.462] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.462] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.462] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0066.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.464] GetFileType (hFile=0x23c) returned 0x1
	[0066.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.464] GetFileType (hFile=0x23c) returned 0x1
	[0066.465] WriteFile (in: hFile=0x23c, lpBuffer=0x266b974*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x266b974*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.468] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.468] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0066.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0066.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0066.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0066.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpFilePart=0x0) returned 0x86
	[0066.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x87
	[0066.469] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0066.469] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.470] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8248db0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8248db0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0066.470] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf826ef10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf826ef10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0066.470] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8295070, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8295070, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0066.471] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf82bb1d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf82bb1d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0066.471] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf82e1330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf82e1330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0066.472] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8307490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8307490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0066.472] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8307490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8307490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0066.472] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf832d5f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf832d5f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1
	[0066.473] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf84d0510, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf84d0510, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1
	[0066.473] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf84f6670, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf84f6670, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0066.473] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf84f6670, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf84f6670, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1
	[0066.474] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf851c7d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf851c7d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0066.474] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf851c7d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf851c7d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0066.474] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8542930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8542930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0066.475] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8568a90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8568a90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0066.475] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf858ebf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf858ebf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0066.475] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf858ebf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf858ebf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0066.476] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf85daeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf85daeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0066.476] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf85daeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf85daeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0066.477] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8627170, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8627170, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0066.477] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf864d2d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf864d2d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0066.477] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf864d2d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf864d2d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0066.478] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8673430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8673430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0066.478] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf86bf6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf86bf6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0066.478] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf86e5850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf86e5850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1
	[0066.478] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf870b9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf870b9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0066.479] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8731b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8731b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0066.479] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8757c70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8757c70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0066.479] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8757c70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8757c70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0066.480] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf877ddd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf877ddd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0066.480] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf87a3f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf87a3f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0066.481] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf87ca090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf87ca090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0066.481] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf87f01f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf87f01f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0066.481] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf87f01f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf87f01f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0066.481] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8816350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8816350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0066.482] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8862610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8862610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0066.482] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8862610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8862610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0066.482] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8888770, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8888770, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0066.482] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf88ae8d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf88ae8d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0066.483] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf88d4a30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf88d4a30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0066.483] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf88d4a30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf88d4a30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1
	[0066.483] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf89b9270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf89b9270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0066.484] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf89b9270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf89b9270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0
	[0066.484] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0066.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0066.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0066.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\Decrypt.txt", lpFilePart=0x0) returned 0x92
	[0066.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0066.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0066.485] GetFileType (hFile=0x238) returned 0x1
	[0066.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0066.485] GetFileType (hFile=0x238) returned 0x1
	[0066.486] WriteFile (in: hFile=0x238, lpBuffer=0x26757d4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x26757d4*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0066.489] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0066.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0066.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata", lpFilePart=0x0) returned 0x87
	[0066.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\", lpFilePart=0x0) returned 0x88
	[0066.489] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0066.492] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.492] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85d166b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1
	[0066.492] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1
	[0066.493] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0
	[0066.493] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0066.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0066.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0066.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0066.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata", lpFilePart=0x0) returned 0x87
	[0066.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\", lpFilePart=0x0) returned 0x88
	[0066.494] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0066.494] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.495] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85d166b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1
	[0066.495] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1
	[0066.495] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.495] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0066.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0066.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0066.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\Decrypt.txt", lpFilePart=0x0) returned 0x93
	[0066.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0066.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0066.501] GetFileType (hFile=0x238) returned 0x1
	[0066.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0066.501] GetFileType (hFile=0x238) returned 0x1
	[0066.501] WriteFile (in: hFile=0x238, lpBuffer=0x267b950*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x267b950*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0066.504] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.505] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0066.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0066.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0066.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0066.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpFilePart=0x0) returned 0x7d
	[0066.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", lpFilePart=0x0) returned 0x7e
	[0066.506] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0066.507] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.507] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1
	[0066.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x8a
	[0066.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0066.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0066.509] GetFileType (hFile=0x238) returned 0x1
	[0066.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0066.509] GetFileType (hFile=0x238) returned 0x1
	[0066.509] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0xd2c
	[0066.509] ReadFile (in: hFile=0x238, lpBuffer=0x267ee9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x267ee9c*, lpNumberOfBytesRead=0x26eac4*=0xd2c, lpOverlapped=0x0) returned 1
	[0066.526] CloseHandle (hObject=0x238) returned 1
	[0066.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.KEKW", lpFilePart=0x0) returned 0x8f
	[0066.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0066.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0066.530] GetFileType (hFile=0x238) returned 0x1
	[0066.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0066.530] GetFileType (hFile=0x238) returned 0x1
	[0066.535] WriteFile (in: hFile=0x238, lpBuffer=0x2681730*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2681730*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0066.539] CloseHandle (hObject=0x238) returned 1
	[0066.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x8a
	[0066.540] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 1
	[0066.544] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_16.png", cAlternateFileName="")) returned 1
	[0066.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x89
	[0066.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0066.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0066.547] GetFileType (hFile=0x238) returned 0x1
	[0066.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0066.548] GetFileType (hFile=0x238) returned 0x1
	[0066.548] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0xa0
	[0066.548] ReadFile (in: hFile=0x238, lpBuffer=0x2683104, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x2683104*, lpNumberOfBytesRead=0x26eac4*=0xa0, lpOverlapped=0x0) returned 1
	[0066.551] CloseHandle (hObject=0x238) returned 1
	[0066.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.KEKW", lpFilePart=0x0) returned 0x8e
	[0066.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0066.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0066.553] GetFileType (hFile=0x238) returned 0x1
	[0066.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0066.553] GetFileType (hFile=0x238) returned 0x1
	[0066.554] WriteFile (in: hFile=0x238, lpBuffer=0x268591c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x268591c*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0066.559] CloseHandle (hObject=0x238) returned 1
	[0066.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x89
	[0066.560] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 1
	[0066.563] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b74730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1
	[0066.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFilePart=0x0) returned 0x87
	[0066.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0066.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0066.565] GetFileType (hFile=0x238) returned 0x1
	[0066.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0066.565] GetFileType (hFile=0x238) returned 0x1
	[0066.565] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x5c
	[0066.565] ReadFile (in: hFile=0x238, lpBuffer=0x26872b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x26872b4*, lpNumberOfBytesRead=0x26eac4*=0x5c, lpOverlapped=0x0) returned 1
	[0066.569] CloseHandle (hObject=0x238) returned 1
	[0066.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.KEKW", lpFilePart=0x0) returned 0x8c
	[0066.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0066.570] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0066.572] GetFileType (hFile=0x238) returned 0x1
	[0066.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0066.572] GetFileType (hFile=0x238) returned 0x1
	[0066.572] WriteFile (in: hFile=0x238, lpBuffer=0x2689ac0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2689ac0*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0066.576] CloseHandle (hObject=0x238) returned 1
	[0066.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFilePart=0x0) returned 0x87
	[0066.576] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 1
	[0066.579] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js", cAlternateFileName="")) returned 1
	[0066.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", lpFilePart=0x0) returned 0x85
	[0066.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0066.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0066.581] GetFileType (hFile=0x238) returned 0x1
	[0066.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0066.581] GetFileType (hFile=0x238) returned 0x1
	[0066.581] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x5f
	[0066.582] ReadFile (in: hFile=0x238, lpBuffer=0x268b410, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x268b410*, lpNumberOfBytesRead=0x26eac4*=0x5f, lpOverlapped=0x0) returned 1
	[0066.585] CloseHandle (hObject=0x238) returned 1
	[0066.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.KEKW", lpFilePart=0x0) returned 0x8a
	[0066.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0066.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0066.586] GetFileType (hFile=0x238) returned 0x1
	[0066.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0066.586] GetFileType (hFile=0x238) returned 0x1
	[0066.587] WriteFile (in: hFile=0x238, lpBuffer=0x268dc10*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x268dc10*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0066.591] CloseHandle (hObject=0x238) returned 1
	[0066.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", lpFilePart=0x0) returned 0x85
	[0066.592] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 1
	[0066.595] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0066.595] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf89df3d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf89df3d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0066.596] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8a05530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8a05530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0066.596] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8a05530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8a05530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0
	[0066.597] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0066.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0066.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0066.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\Decrypt.txt", lpFilePart=0x0) returned 0x89
	[0066.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0066.598] GetFileType (hFile=0x234) returned 0x1
	[0066.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0066.599] GetFileType (hFile=0x234) returned 0x1
	[0066.599] WriteFile (in: hFile=0x234, lpBuffer=0x2691090*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x2691090*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0066.602] CloseHandle (hObject=0x234) returned 1
	[0066.603] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.603] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0066.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0066.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0066.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0066.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", lpFilePart=0x0) returned 0x77
	[0066.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", lpFilePart=0x0) returned 0x78
	[0066.605] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0066.606] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.606] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8ae9d70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8ae9d70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1
	[0066.607] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8ae9d70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8ae9d70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 0
	[0066.607] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0066.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0066.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0066.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\Decrypt.txt", lpFilePart=0x0) returned 0x83
	[0066.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0066.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0066.609] GetFileType (hFile=0x230) returned 0x1
	[0066.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0066.609] GetFileType (hFile=0x230) returned 0x1
	[0066.609] WriteFile (in: hFile=0x230, lpBuffer=0x26949b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x26949b4*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0066.612] CloseHandle (hObject=0x230) returned 1
	[0066.613] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aohghmighlieiainnegkcijnfilokake", cAlternateFileName="AOHGHM~1")) returned 1
	[0066.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0066.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake", lpFilePart=0x0) returned 0x77
	[0066.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\", lpFilePart=0x0) returned 0x78
	[0066.614] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0066.614] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.616] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1
	[0066.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0066.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0", lpFilePart=0x0) returned 0x7d
	[0066.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\", lpFilePart=0x0) returned 0x7e
	[0066.617] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0066.627] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.631] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1
	[0066.632] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_16.png", cAlternateFileName="")) returned 1
	[0066.632] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1
	[0066.633] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js", cAlternateFileName="")) returned 1
	[0066.634] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0066.634] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0066.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0066.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpFilePart=0x0) returned 0x86
	[0066.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x87
	[0066.635] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0066.642] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.643] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0066.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x89
	[0066.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a
	[0066.644] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.645] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.646] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.647] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.647] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x89
	[0066.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a
	[0066.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.649] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.650] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.651] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.651] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.653] GetFileType (hFile=0x23c) returned 0x1
	[0066.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.653] GetFileType (hFile=0x23c) returned 0x1
	[0066.654] WriteFile (in: hFile=0x23c, lpBuffer=0x269e468*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x269e468*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.657] CloseHandle (hObject=0x23c) returned 1
	[0066.658] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0066.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x89
	[0066.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a
	[0066.659] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.660] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.661] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.661] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.662] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x89
	[0066.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a
	[0066.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.664] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.665] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.666] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.666] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.668] GetFileType (hFile=0x23c) returned 0x1
	[0066.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.669] GetFileType (hFile=0x23c) returned 0x1
	[0066.669] WriteFile (in: hFile=0x23c, lpBuffer=0x26a3b2c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26a3b2c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.671] CloseHandle (hObject=0x23c) returned 1
	[0066.672] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0066.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", lpFilePart=0x0) returned 0x89
	[0066.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a
	[0066.673] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.690] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.691] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.692] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.692] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", lpFilePart=0x0) returned 0x89
	[0066.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a
	[0066.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.695] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.695] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.696] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.696] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.698] GetFileType (hFile=0x23c) returned 0x1
	[0066.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.698] GetFileType (hFile=0x23c) returned 0x1
	[0066.698] WriteFile (in: hFile=0x23c, lpBuffer=0x26a91f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26a91f0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.701] CloseHandle (hObject=0x23c) returned 1
	[0066.702] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0066.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", lpFilePart=0x0) returned 0x89
	[0066.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a
	[0066.703] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.703] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.704] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.705] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.705] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", lpFilePart=0x0) returned 0x89
	[0066.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a
	[0066.706] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.707] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.708] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.709] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.709] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.711] GetFileType (hFile=0x23c) returned 0x1
	[0066.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.711] GetFileType (hFile=0x23c) returned 0x1
	[0066.712] WriteFile (in: hFile=0x23c, lpBuffer=0x26ae8b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26ae8b4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.716] CloseHandle (hObject=0x23c) returned 1
	[0066.716] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0066.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", lpFilePart=0x0) returned 0x89
	[0066.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a
	[0066.717] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.719] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.720] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.721] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.721] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", lpFilePart=0x0) returned 0x89
	[0066.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a
	[0066.722] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.723] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.723] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.724] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.724] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.726] GetFileType (hFile=0x23c) returned 0x1
	[0066.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.726] GetFileType (hFile=0x23c) returned 0x1
	[0066.726] WriteFile (in: hFile=0x23c, lpBuffer=0x26b3f78*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26b3f78*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.729] CloseHandle (hObject=0x23c) returned 1
	[0066.730] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0066.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", lpFilePart=0x0) returned 0x89
	[0066.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a
	[0066.731] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.731] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.732] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.732] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.733] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", lpFilePart=0x0) returned 0x89
	[0066.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a
	[0066.734] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.734] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.735] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.735] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.735] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.737] GetFileType (hFile=0x23c) returned 0x1
	[0066.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.737] GetFileType (hFile=0x23c) returned 0x1
	[0066.737] WriteFile (in: hFile=0x23c, lpBuffer=0x26b963c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26b963c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.744] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0066.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", lpFilePart=0x0) returned 0x89
	[0066.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a
	[0066.744] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.749] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.750] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.750] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.751] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", lpFilePart=0x0) returned 0x89
	[0066.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a
	[0066.751] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.752] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.753] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.753] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.753] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.754] GetFileType (hFile=0x23c) returned 0x1
	[0066.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.755] GetFileType (hFile=0x23c) returned 0x1
	[0066.755] WriteFile (in: hFile=0x23c, lpBuffer=0x26bed00*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26bed00*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.758] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1
	[0066.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c
	[0066.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d
	[0066.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.761] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.761] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.762] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.762] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c
	[0066.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d
	[0066.763] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.764] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.764] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.765] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.765] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0066.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.766] GetFileType (hFile=0x23c) returned 0x1
	[0066.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.766] GetFileType (hFile=0x23c) returned 0x1
	[0066.767] WriteFile (in: hFile=0x23c, lpBuffer=0x26c44c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26c44c8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.769] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1
	[0066.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c
	[0066.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d
	[0066.770] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.772] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.773] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.773] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.774] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c
	[0066.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d
	[0066.775] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.775] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.776] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.776] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.776] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0066.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.777] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.778] GetFileType (hFile=0x23c) returned 0x1
	[0066.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.778] GetFileType (hFile=0x23c) returned 0x1
	[0066.778] WriteFile (in: hFile=0x23c, lpBuffer=0x26c9c90*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26c9c90*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.781] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0066.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", lpFilePart=0x0) returned 0x89
	[0066.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a
	[0066.782] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.784] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.785] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.785] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.786] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", lpFilePart=0x0) returned 0x89
	[0066.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a
	[0066.788] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.788] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.789] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.789] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.789] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.791] GetFileType (hFile=0x23c) returned 0x1
	[0066.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.791] GetFileType (hFile=0x23c) returned 0x1
	[0066.792] WriteFile (in: hFile=0x23c, lpBuffer=0x26cf354*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26cf354*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.795] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1
	[0066.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d
	[0066.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e
	[0066.796] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.796] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.797] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.797] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.798] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d
	[0066.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e
	[0066.799] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.799] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.800] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.800] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.800] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0066.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.802] GetFileType (hFile=0x23c) returned 0x1
	[0066.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.802] GetFileType (hFile=0x23c) returned 0x1
	[0066.802] WriteFile (in: hFile=0x23c, lpBuffer=0x26d4b48*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26d4b48*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.805] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0066.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", lpFilePart=0x0) returned 0x89
	[0066.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a
	[0066.806] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.810] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.811] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.811] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.811] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", lpFilePart=0x0) returned 0x89
	[0066.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a
	[0066.812] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.813] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.813] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.814] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.814] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.815] GetFileType (hFile=0x23c) returned 0x1
	[0066.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.815] GetFileType (hFile=0x23c) returned 0x1
	[0066.816] WriteFile (in: hFile=0x23c, lpBuffer=0x26da20c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26da20c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.820] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0066.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", lpFilePart=0x0) returned 0x89
	[0066.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a
	[0066.820] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.821] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.821] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.822] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.822] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", lpFilePart=0x0) returned 0x89
	[0066.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a
	[0066.826] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.826] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.827] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.827] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.828] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.829] GetFileType (hFile=0x23c) returned 0x1
	[0066.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.830] GetFileType (hFile=0x23c) returned 0x1
	[0066.830] WriteFile (in: hFile=0x23c, lpBuffer=0x26df8d0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26df8d0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.838] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0066.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a
	[0066.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b
	[0066.839] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.841] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.842] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.842] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.842] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a
	[0066.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b
	[0066.843] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.844] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.844] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.844] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.845] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0066.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.846] GetFileType (hFile=0x23c) returned 0x1
	[0066.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.846] GetFileType (hFile=0x23c) returned 0x1
	[0066.847] WriteFile (in: hFile=0x23c, lpBuffer=0x26e5000*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26e5000*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.850] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0066.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", lpFilePart=0x0) returned 0x89
	[0066.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a
	[0066.850] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.851] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.852] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.852] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.852] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", lpFilePart=0x0) returned 0x89
	[0066.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a
	[0066.853] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.854] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.854] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.854] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.854] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.855] GetFileType (hFile=0x23c) returned 0x1
	[0066.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.856] GetFileType (hFile=0x23c) returned 0x1
	[0066.856] WriteFile (in: hFile=0x23c, lpBuffer=0x26ea6c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26ea6c4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.859] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0066.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", lpFilePart=0x0) returned 0x89
	[0066.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a
	[0066.860] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.862] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.862] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.863] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.863] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", lpFilePart=0x0) returned 0x89
	[0066.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a
	[0066.864] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.864] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.865] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.866] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.866] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.866] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.867] GetFileType (hFile=0x23c) returned 0x1
	[0066.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.867] GetFileType (hFile=0x23c) returned 0x1
	[0066.868] WriteFile (in: hFile=0x23c, lpBuffer=0x26efd88*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26efd88*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.870] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0066.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", lpFilePart=0x0) returned 0x89
	[0066.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a
	[0066.871] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.871] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.874] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.874] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.875] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.875] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", lpFilePart=0x0) returned 0x89
	[0066.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a
	[0066.876] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.876] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.877] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.877] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.877] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.878] GetFileType (hFile=0x23c) returned 0x1
	[0066.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.878] GetFileType (hFile=0x23c) returned 0x1
	[0066.879] WriteFile (in: hFile=0x23c, lpBuffer=0x26f544c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26f544c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.883] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0066.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", lpFilePart=0x0) returned 0x89
	[0066.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a
	[0066.883] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.885] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.886] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.886] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.887] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.887] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", lpFilePart=0x0) returned 0x89
	[0066.887] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a
	[0066.887] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.888] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.888] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.889] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.889] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.890] GetFileType (hFile=0x23c) returned 0x1
	[0066.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.891] GetFileType (hFile=0x23c) returned 0x1
	[0066.891] WriteFile (in: hFile=0x23c, lpBuffer=0x26fab10*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26fab10*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.894] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0066.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", lpFilePart=0x0) returned 0x89
	[0066.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a
	[0066.895] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.895] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.896] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.896] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.897] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", lpFilePart=0x0) returned 0x89
	[0066.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a
	[0066.897] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.898] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.898] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.899] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.899] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.900] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.900] GetFileType (hFile=0x23c) returned 0x1
	[0066.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.900] GetFileType (hFile=0x23c) returned 0x1
	[0066.901] WriteFile (in: hFile=0x23c, lpBuffer=0x27001d4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27001d4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.904] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0066.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it", lpFilePart=0x0) returned 0x89
	[0066.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a
	[0066.904] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.906] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.907] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.908] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.908] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it", lpFilePart=0x0) returned 0x89
	[0066.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a
	[0066.909] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.909] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.910] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.910] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.910] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0066.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.911] GetFileType (hFile=0x23c) returned 0x1
	[0066.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.912] GetFileType (hFile=0x23c) returned 0x1
	[0066.912] WriteFile (in: hFile=0x23c, lpBuffer=0x2705898*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2705898*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0066.915] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0066.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja", lpFilePart=0x0) returned 0x89
	[0066.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a
	[0066.916] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.917] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.917] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.917] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.917] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja", lpFilePart=0x0) returned 0x89
	[0066.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a
	[0066.918] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0066.919] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.919] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.919] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.919] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0066.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.920] GetFileType (hFile=0x23c) returned 0x1
	[0066.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.920] GetFileType (hFile=0x23c) returned 0x1
	[0066.924] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0066.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.932] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.932] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.932] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.933] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.933] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.933] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.934] GetFileType (hFile=0x23c) returned 0x1
	[0066.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.934] GetFileType (hFile=0x23c) returned 0x1
	[0066.938] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0066.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.938] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.938] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.939] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.939] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.939] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.940] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.940] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.941] GetFileType (hFile=0x23c) returned 0x1
	[0066.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.941] GetFileType (hFile=0x23c) returned 0x1
	[0066.945] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0066.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.946] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.947] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.947] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.947] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.948] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.948] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.949] GetFileType (hFile=0x23c) returned 0x1
	[0066.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.949] GetFileType (hFile=0x23c) returned 0x1
	[0066.952] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1
	[0066.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.953] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.953] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.953] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.954] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.954] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.954] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.955] GetFileType (hFile=0x23c) returned 0x1
	[0066.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.956] GetFileType (hFile=0x23c) returned 0x1
	[0066.958] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0066.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.960] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.960] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.961] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.964] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.964] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.964] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.965] GetFileType (hFile=0x23c) returned 0x1
	[0066.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.965] GetFileType (hFile=0x23c) returned 0x1
	[0066.968] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0066.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.969] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.969] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.969] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.970] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.970] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.970] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.971] GetFileType (hFile=0x23c) returned 0x1
	[0066.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0066.971] GetFileType (hFile=0x23c) returned 0x1
	[0066.975] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0066.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.977] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.977] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.979] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0066.980] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.980] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.980] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0066.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0066.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0066.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.982] GetFileType (hFile=0x23c) returned 0x1
	[0066.982] GetFileType (hFile=0x23c) returned 0x1
	[0066.986] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0066.987] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.987] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.987] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0066.988] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0066.988] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0066.988] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0066.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0066.999] GetFileType (hFile=0x23c) returned 0x1
	[0066.999] GetFileType (hFile=0x23c) returned 0x1
	[0067.002] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0067.010] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.010] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.010] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.011] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.011] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.011] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.012] GetFileType (hFile=0x23c) returned 0x1
	[0067.013] GetFileType (hFile=0x23c) returned 0x1
	[0067.016] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0067.016] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.016] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.017] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.017] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.017] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.017] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.019] GetFileType (hFile=0x23c) returned 0x1
	[0067.019] GetFileType (hFile=0x23c) returned 0x1
	[0067.023] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0067.025] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.025] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.025] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.026] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.026] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.026] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.027] GetFileType (hFile=0x23c) returned 0x1
	[0067.028] GetFileType (hFile=0x23c) returned 0x1
	[0067.031] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0067.031] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.032] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.033] GetFileType (hFile=0x23c) returned 0x1
	[0067.033] GetFileType (hFile=0x23c) returned 0x1
	[0067.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.040] GetFileType (hFile=0x23c) returned 0x1
	[0067.040] GetFileType (hFile=0x23c) returned 0x1
	[0067.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.044] GetFileType (hFile=0x23c) returned 0x1
	[0067.044] GetFileType (hFile=0x23c) returned 0x1
	[0067.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.050] GetFileType (hFile=0x23c) returned 0x1
	[0067.050] GetFileType (hFile=0x23c) returned 0x1
	[0067.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.056] GetFileType (hFile=0x23c) returned 0x1
	[0067.056] GetFileType (hFile=0x23c) returned 0x1
	[0067.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.061] GetFileType (hFile=0x23c) returned 0x1
	[0067.062] GetFileType (hFile=0x23c) returned 0x1
	[0067.065] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.066] GetFileType (hFile=0x23c) returned 0x1
	[0067.066] GetFileType (hFile=0x23c) returned 0x1
	[0067.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.077] GetFileType (hFile=0x23c) returned 0x1
	[0067.077] GetFileType (hFile=0x23c) returned 0x1
	[0067.081] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.082] GetFileType (hFile=0x23c) returned 0x1
	[0067.082] GetFileType (hFile=0x23c) returned 0x1
	[0067.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.088] GetFileType (hFile=0x23c) returned 0x1
	[0067.088] GetFileType (hFile=0x23c) returned 0x1
	[0067.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0067.092] GetFileType (hFile=0x238) returned 0x1
	[0067.092] GetFileType (hFile=0x238) returned 0x1
	[0067.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0067.120] GetFileType (hFile=0x238) returned 0x1
	[0067.120] GetFileType (hFile=0x238) returned 0x1
	[0067.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0067.125] GetFileType (hFile=0x238) returned 0x1
	[0067.125] GetFileType (hFile=0x238) returned 0x1
	[0067.125] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0xc8d
	[0067.125] ReadFile (in: hFile=0x238, lpBuffer=0x279060c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x279060c*, lpNumberOfBytesRead=0x26eac4*=0xc8d, lpOverlapped=0x0) returned 1
	[0067.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0067.132] GetFileType (hFile=0x238) returned 0x1
	[0067.132] GetFileType (hFile=0x238) returned 0x1
	[0067.136] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 1
	[0067.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0067.141] GetFileType (hFile=0x238) returned 0x1
	[0067.141] GetFileType (hFile=0x238) returned 0x1
	[0067.141] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x8f
	[0067.142] ReadFile (in: hFile=0x238, lpBuffer=0x27947e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x27947e8*, lpNumberOfBytesRead=0x26eac4*=0x8f, lpOverlapped=0x0) returned 1
	[0067.145] CloseHandle (hObject=0x238) returned 1
	[0067.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0067.147] GetFileType (hFile=0x238) returned 0x1
	[0067.147] GetFileType (hFile=0x238) returned 0x1
	[0067.147] WriteFile (in: hFile=0x238, lpBuffer=0x2797000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2797000*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0067.151] CloseHandle (hObject=0x238) returned 1
	[0067.151] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 1
	[0067.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0067.156] GetFileType (hFile=0x238) returned 0x1
	[0067.156] GetFileType (hFile=0x238) returned 0x1
	[0067.156] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x5c
	[0067.156] ReadFile (in: hFile=0x238, lpBuffer=0x2798998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x2798998*, lpNumberOfBytesRead=0x26eac4*=0x5c, lpOverlapped=0x0) returned 1
	[0067.160] CloseHandle (hObject=0x238) returned 1
	[0067.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0067.161] GetFileType (hFile=0x238) returned 0x1
	[0067.161] GetFileType (hFile=0x238) returned 0x1
	[0067.162] WriteFile (in: hFile=0x238, lpBuffer=0x279b1a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x279b1a4*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0067.165] CloseHandle (hObject=0x238) returned 1
	[0067.165] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 1
	[0067.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0067.170] GetFileType (hFile=0x238) returned 0x1
	[0067.170] GetFileType (hFile=0x238) returned 0x1
	[0067.170] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x5b
	[0067.170] ReadFile (in: hFile=0x238, lpBuffer=0x279caf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x279caf0*, lpNumberOfBytesRead=0x26eac4*=0x5b, lpOverlapped=0x0) returned 1
	[0067.173] CloseHandle (hObject=0x238) returned 1
	[0067.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0067.175] GetFileType (hFile=0x238) returned 0x1
	[0067.175] GetFileType (hFile=0x238) returned 0x1
	[0067.175] WriteFile (in: hFile=0x238, lpBuffer=0x279f2f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x279f2f0*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0067.180] CloseHandle (hObject=0x238) returned 1
	[0067.180] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 1
	[0067.186] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0067.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Decrypt.txt", lpFilePart=0x0) returned 0x89
	[0067.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0067.188] GetFileType (hFile=0x234) returned 0x1
	[0067.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0067.188] GetFileType (hFile=0x234) returned 0x1
	[0067.189] WriteFile (in: hFile=0x234, lpBuffer=0x27a2770*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x27a2770*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0067.192] CloseHandle (hObject=0x234) returned 1
	[0067.193] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.194] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0067.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0067.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0067.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0067.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake", lpFilePart=0x0) returned 0x77
	[0067.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\", lpFilePart=0x0) returned 0x78
	[0067.195] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0067.196] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.196] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf90911b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf90911b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1
	[0067.197] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf90911b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf90911b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 0
	[0067.197] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0067.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0067.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0067.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Decrypt.txt", lpFilePart=0x0) returned 0x83
	[0067.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0067.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0067.198] GetFileType (hFile=0x230) returned 0x1
	[0067.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0067.198] GetFileType (hFile=0x230) returned 0x1
	[0067.199] WriteFile (in: hFile=0x230, lpBuffer=0x27a6094*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x27a6094*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0067.202] CloseHandle (hObject=0x230) returned 1
	[0067.202] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="apdfllckaahabafndbhieahigkjlhalf", cAlternateFileName="APDFLL~1")) returned 1
	[0067.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0067.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", lpFilePart=0x0) returned 0x77
	[0067.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", lpFilePart=0x0) returned 0x78
	[0067.203] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0067.205] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.205] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.1_0", cAlternateFileName="")) returned 1
	[0067.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0067.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", lpFilePart=0x0) returned 0x7e
	[0067.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", lpFilePart=0x0) returned 0x7f
	[0067.206] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0067.214] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.215] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a33, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1
	[0067.215] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8716c790, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0067.216] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0067.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0067.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpFilePart=0x0) returned 0x87
	[0067.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpFilePart=0x0) returned 0x88
	[0067.217] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0067.223] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.224] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0067.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x8a
	[0067.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8b
	[0067.225] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.226] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.226] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.227] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.228] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x8a
	[0067.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8b
	[0067.229] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.229] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.230] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.230] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.231] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.232] GetFileType (hFile=0x23c) returned 0x1
	[0067.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.233] GetFileType (hFile=0x23c) returned 0x1
	[0067.233] WriteFile (in: hFile=0x23c, lpBuffer=0x27af47c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27af47c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.236] CloseHandle (hObject=0x23c) returned 1
	[0067.237] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0067.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x8a
	[0067.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8b
	[0067.238] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.241] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.241] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.242] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.242] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x8a
	[0067.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8b
	[0067.243] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.244] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.245] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.245] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.246] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.247] GetFileType (hFile=0x23c) returned 0x1
	[0067.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.247] GetFileType (hFile=0x23c) returned 0x1
	[0067.248] WriteFile (in: hFile=0x23c, lpBuffer=0x27b4bb0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27b4bb0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.251] CloseHandle (hObject=0x23c) returned 1
	[0067.251] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0067.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x8a
	[0067.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8b
	[0067.252] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.253] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.253] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.254] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.256] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x8a
	[0067.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8b
	[0067.257] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.258] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.258] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.259] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.259] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.261] GetFileType (hFile=0x23c) returned 0x1
	[0067.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.262] GetFileType (hFile=0x23c) returned 0x1
	[0067.262] WriteFile (in: hFile=0x23c, lpBuffer=0x27ba2e4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27ba2e4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.265] CloseHandle (hObject=0x23c) returned 1
	[0067.265] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0067.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x8a
	[0067.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8b
	[0067.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.268] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.269] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.269] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.270] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x8a
	[0067.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8b
	[0067.271] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.272] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.272] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.273] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.273] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.275] GetFileType (hFile=0x23c) returned 0x1
	[0067.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.275] GetFileType (hFile=0x23c) returned 0x1
	[0067.275] WriteFile (in: hFile=0x23c, lpBuffer=0x27bfa18*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27bfa18*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.280] CloseHandle (hObject=0x23c) returned 1
	[0067.281] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0067.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", lpFilePart=0x0) returned 0x8a
	[0067.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8b
	[0067.282] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.283] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.283] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.284] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.284] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", lpFilePart=0x0) returned 0x8a
	[0067.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8b
	[0067.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.287] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.287] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.288] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.288] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.290] GetFileType (hFile=0x23c) returned 0x1
	[0067.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.290] GetFileType (hFile=0x23c) returned 0x1
	[0067.291] WriteFile (in: hFile=0x23c, lpBuffer=0x27c514c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27c514c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.294] CloseHandle (hObject=0x23c) returned 1
	[0067.295] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0067.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", lpFilePart=0x0) returned 0x8a
	[0067.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8b
	[0067.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.299] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.299] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.300] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.300] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", lpFilePart=0x0) returned 0x8a
	[0067.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8b
	[0067.301] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.302] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.303] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.303] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.303] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.305] GetFileType (hFile=0x23c) returned 0x1
	[0067.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.305] GetFileType (hFile=0x23c) returned 0x1
	[0067.306] WriteFile (in: hFile=0x23c, lpBuffer=0x27ca880*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27ca880*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.309] CloseHandle (hObject=0x23c) returned 1
	[0067.309] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0067.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", lpFilePart=0x0) returned 0x8a
	[0067.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8b
	[0067.310] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.311] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.311] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.312] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.312] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", lpFilePart=0x0) returned 0x8a
	[0067.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8b
	[0067.313] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.314] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.314] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.315] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.315] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.316] GetFileType (hFile=0x23c) returned 0x1
	[0067.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.316] GetFileType (hFile=0x23c) returned 0x1
	[0067.317] WriteFile (in: hFile=0x23c, lpBuffer=0x27cffb4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27cffb4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.323] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1
	[0067.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8d
	[0067.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8e
	[0067.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.326] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.326] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.327] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.327] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8d
	[0067.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8e
	[0067.328] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.329] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.329] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.330] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.330] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0067.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.331] GetFileType (hFile=0x23c) returned 0x1
	[0067.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.332] GetFileType (hFile=0x23c) returned 0x1
	[0067.332] WriteFile (in: hFile=0x23c, lpBuffer=0x27d57a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27d57a4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.336] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1
	[0067.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8d
	[0067.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8e
	[0067.337] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.338] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.338] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.339] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.339] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8d
	[0067.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8e
	[0067.340] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.340] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.341] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.342] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.342] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0067.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.343] GetFileType (hFile=0x23c) returned 0x1
	[0067.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.344] GetFileType (hFile=0x23c) returned 0x1
	[0067.344] WriteFile (in: hFile=0x23c, lpBuffer=0x27daf94*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27daf94*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.347] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0067.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es", lpFilePart=0x0) returned 0x8a
	[0067.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8b
	[0067.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.350] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.350] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.351] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.351] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es", lpFilePart=0x0) returned 0x8a
	[0067.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8b
	[0067.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.353] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.353] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.354] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.354] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.355] GetFileType (hFile=0x23c) returned 0x1
	[0067.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.356] GetFileType (hFile=0x23c) returned 0x1
	[0067.356] WriteFile (in: hFile=0x23c, lpBuffer=0x27e06c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27e06c8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.359] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1
	[0067.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8e
	[0067.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8f
	[0067.360] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.360] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.361] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.361] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.362] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8e
	[0067.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8f
	[0067.362] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.363] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.363] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.364] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.364] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\Decrypt.txt", lpFilePart=0x0) returned 0x9a
	[0067.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.365] GetFileType (hFile=0x23c) returned 0x1
	[0067.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.366] GetFileType (hFile=0x23c) returned 0x1
	[0067.366] WriteFile (in: hFile=0x23c, lpBuffer=0x27e5f2c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27e5f2c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.369] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0067.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et", lpFilePart=0x0) returned 0x8a
	[0067.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8b
	[0067.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.372] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.372] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.373] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.373] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et", lpFilePart=0x0) returned 0x8a
	[0067.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8b
	[0067.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.374] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.375] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.375] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.375] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.377] GetFileType (hFile=0x23c) returned 0x1
	[0067.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.377] GetFileType (hFile=0x23c) returned 0x1
	[0067.377] WriteFile (in: hFile=0x23c, lpBuffer=0x27eb660*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27eb660*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.429] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1
	[0067.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu", lpFilePart=0x0) returned 0x8a
	[0067.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\", lpFilePart=0x0) returned 0x8b
	[0067.430] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.430] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.431] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.431] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.432] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.432] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu", lpFilePart=0x0) returned 0x8a
	[0067.432] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\", lpFilePart=0x0) returned 0x8b
	[0067.433] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.433] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.434] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.434] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.435] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.435] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.436] GetFileType (hFile=0x23c) returned 0x1
	[0067.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.436] GetFileType (hFile=0x23c) returned 0x1
	[0067.443] WriteFile (in: hFile=0x23c, lpBuffer=0x25f2c2c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25f2c2c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.446] CloseHandle (hObject=0x23c) returned 1
	[0067.447] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0067.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.447] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi", lpFilePart=0x0) returned 0x8a
	[0067.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8b
	[0067.448] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.451] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.451] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.452] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.453] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.453] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi", lpFilePart=0x0) returned 0x8a
	[0067.453] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8b
	[0067.454] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.454] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.455] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.455] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.456] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.458] GetFileType (hFile=0x23c) returned 0x1
	[0067.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.458] GetFileType (hFile=0x23c) returned 0x1
	[0067.458] WriteFile (in: hFile=0x23c, lpBuffer=0x25f8360*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25f8360*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.461] CloseHandle (hObject=0x23c) returned 1
	[0067.462] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0067.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil", lpFilePart=0x0) returned 0x8b
	[0067.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8c
	[0067.463] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.464] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.464] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.465] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.465] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil", lpFilePart=0x0) returned 0x8b
	[0067.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8c
	[0067.466] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.467] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.467] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.468] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.468] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0067.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.470] GetFileType (hFile=0x23c) returned 0x1
	[0067.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.470] GetFileType (hFile=0x23c) returned 0x1
	[0067.470] WriteFile (in: hFile=0x23c, lpBuffer=0x25fdab8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25fdab8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.487] CloseHandle (hObject=0x23c) returned 1
	[0067.492] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0067.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr", lpFilePart=0x0) returned 0x8a
	[0067.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8b
	[0067.494] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.501] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.502] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.502] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.503] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr", lpFilePart=0x0) returned 0x8a
	[0067.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8b
	[0067.504] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.505] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.506] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.506] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.507] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.509] GetFileType (hFile=0x23c) returned 0x1
	[0067.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.510] GetFileType (hFile=0x23c) returned 0x1
	[0067.510] WriteFile (in: hFile=0x23c, lpBuffer=0x26031ec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26031ec*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.513] CloseHandle (hObject=0x23c) returned 1
	[0067.514] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0067.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he", lpFilePart=0x0) returned 0x8a
	[0067.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8b
	[0067.515] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.516] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.517] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.517] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.518] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he", lpFilePart=0x0) returned 0x8a
	[0067.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8b
	[0067.519] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.520] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.520] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.521] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.521] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.523] GetFileType (hFile=0x23c) returned 0x1
	[0067.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.523] GetFileType (hFile=0x23c) returned 0x1
	[0067.524] WriteFile (in: hFile=0x23c, lpBuffer=0x2608920*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2608920*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.527] CloseHandle (hObject=0x23c) returned 1
	[0067.527] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0067.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi", lpFilePart=0x0) returned 0x8a
	[0067.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8b
	[0067.528] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.531] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.531] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.532] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.532] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi", lpFilePart=0x0) returned 0x8a
	[0067.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8b
	[0067.533] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.534] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.534] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.535] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.535] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.537] GetFileType (hFile=0x23c) returned 0x1
	[0067.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.537] GetFileType (hFile=0x23c) returned 0x1
	[0067.538] WriteFile (in: hFile=0x23c, lpBuffer=0x260e054*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x260e054*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.541] CloseHandle (hObject=0x23c) returned 1
	[0067.541] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0067.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr", lpFilePart=0x0) returned 0x8a
	[0067.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8b
	[0067.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.543] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.544] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.545] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.545] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr", lpFilePart=0x0) returned 0x8a
	[0067.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8b
	[0067.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.547] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.548] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.548] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.549] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.551] GetFileType (hFile=0x23c) returned 0x1
	[0067.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.551] GetFileType (hFile=0x23c) returned 0x1
	[0067.551] WriteFile (in: hFile=0x23c, lpBuffer=0x2613788*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2613788*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.554] CloseHandle (hObject=0x23c) returned 1
	[0067.555] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0067.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu", lpFilePart=0x0) returned 0x8a
	[0067.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8b
	[0067.557] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.559] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.560] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.561] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.561] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu", lpFilePart=0x0) returned 0x8a
	[0067.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8b
	[0067.562] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.563] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.564] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.564] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.565] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.568] GetFileType (hFile=0x23c) returned 0x1
	[0067.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.568] GetFileType (hFile=0x23c) returned 0x1
	[0067.568] WriteFile (in: hFile=0x23c, lpBuffer=0x2618ebc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2618ebc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.571] CloseHandle (hObject=0x23c) returned 1
	[0067.572] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0067.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id", lpFilePart=0x0) returned 0x8a
	[0067.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8b
	[0067.573] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.574] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.574] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.575] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.575] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id", lpFilePart=0x0) returned 0x8a
	[0067.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8b
	[0067.576] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.577] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.578] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.578] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.579] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.581] GetFileType (hFile=0x23c) returned 0x1
	[0067.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.581] GetFileType (hFile=0x23c) returned 0x1
	[0067.581] WriteFile (in: hFile=0x23c, lpBuffer=0x261e5f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x261e5f0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.585] CloseHandle (hObject=0x23c) returned 1
	[0067.585] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0067.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it", lpFilePart=0x0) returned 0x8a
	[0067.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8b
	[0067.586] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.589] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.589] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.590] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.590] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it", lpFilePart=0x0) returned 0x8a
	[0067.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8b
	[0067.592] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.592] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.593] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.593] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.594] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.594] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.596] GetFileType (hFile=0x23c) returned 0x1
	[0067.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.596] GetFileType (hFile=0x23c) returned 0x1
	[0067.596] WriteFile (in: hFile=0x23c, lpBuffer=0x2623d24*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2623d24*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.599] CloseHandle (hObject=0x23c) returned 1
	[0067.599] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0067.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja", lpFilePart=0x0) returned 0x8a
	[0067.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8b
	[0067.601] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.602] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.603] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.603] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.604] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja", lpFilePart=0x0) returned 0x8a
	[0067.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8b
	[0067.605] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.605] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.606] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.606] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.606] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.608] GetFileType (hFile=0x23c) returned 0x1
	[0067.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.608] GetFileType (hFile=0x23c) returned 0x1
	[0067.608] WriteFile (in: hFile=0x23c, lpBuffer=0x2629458*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2629458*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.616] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0067.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko", lpFilePart=0x0) returned 0x8a
	[0067.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8b
	[0067.617] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.620] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.620] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.621] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.621] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko", lpFilePart=0x0) returned 0x8a
	[0067.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8b
	[0067.622] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.622] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.623] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.623] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.624] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.625] GetFileType (hFile=0x23c) returned 0x1
	[0067.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.625] GetFileType (hFile=0x23c) returned 0x1
	[0067.625] WriteFile (in: hFile=0x23c, lpBuffer=0x262eb8c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x262eb8c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.628] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0067.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt", lpFilePart=0x0) returned 0x8a
	[0067.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8b
	[0067.628] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.630] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.631] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.631] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.632] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt", lpFilePart=0x0) returned 0x8a
	[0067.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8b
	[0067.633] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.633] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.634] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.634] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.635] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.636] GetFileType (hFile=0x23c) returned 0x1
	[0067.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.636] GetFileType (hFile=0x23c) returned 0x1
	[0067.636] WriteFile (in: hFile=0x23c, lpBuffer=0x26342c0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26342c0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.639] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0067.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv", lpFilePart=0x0) returned 0x8a
	[0067.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8b
	[0067.640] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.642] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.643] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.643] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.644] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv", lpFilePart=0x0) returned 0x8a
	[0067.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8b
	[0067.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.645] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.646] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.646] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.647] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.648] GetFileType (hFile=0x23c) returned 0x1
	[0067.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.648] GetFileType (hFile=0x23c) returned 0x1
	[0067.649] WriteFile (in: hFile=0x23c, lpBuffer=0x26399f4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26399f4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.652] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1
	[0067.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms", lpFilePart=0x0) returned 0x8a
	[0067.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8b
	[0067.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.653] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.653] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.654] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.654] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.655] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms", lpFilePart=0x0) returned 0x8a
	[0067.655] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8b
	[0067.655] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.655] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.656] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.656] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.656] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.657] GetFileType (hFile=0x23c) returned 0x1
	[0067.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.658] GetFileType (hFile=0x23c) returned 0x1
	[0067.658] WriteFile (in: hFile=0x23c, lpBuffer=0x263f128*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x263f128*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.661] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0067.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x8a
	[0067.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8b
	[0067.661] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.667] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.668] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.668] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.668] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x8a
	[0067.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8b
	[0067.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.670] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.670] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.671] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.671] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.672] GetFileType (hFile=0x23c) returned 0x1
	[0067.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.673] GetFileType (hFile=0x23c) returned 0x1
	[0067.673] WriteFile (in: hFile=0x23c, lpBuffer=0x264485c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x264485c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.688] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0067.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no", lpFilePart=0x0) returned 0x8a
	[0067.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8b
	[0067.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.690] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.690] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.690] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.691] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no", lpFilePart=0x0) returned 0x8a
	[0067.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8b
	[0067.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.693] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.693] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.693] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.693] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.695] GetFileType (hFile=0x23c) returned 0x1
	[0067.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.695] GetFileType (hFile=0x23c) returned 0x1
	[0067.695] WriteFile (in: hFile=0x23c, lpBuffer=0x2649f90*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2649f90*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.699] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0067.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x8a
	[0067.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8b
	[0067.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.703] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.703] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.703] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.704] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x8a
	[0067.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8b
	[0067.705] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.705] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.706] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.706] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.706] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.708] GetFileType (hFile=0x23c) returned 0x1
	[0067.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.708] GetFileType (hFile=0x23c) returned 0x1
	[0067.708] WriteFile (in: hFile=0x23c, lpBuffer=0x264f6c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x264f6c4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.711] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0067.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8d
	[0067.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8e
	[0067.712] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.713] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.713] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.714] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.714] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8d
	[0067.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8e
	[0067.715] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.715] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.716] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.716] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.716] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0067.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.718] GetFileType (hFile=0x23c) returned 0x1
	[0067.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.718] GetFileType (hFile=0x23c) returned 0x1
	[0067.718] WriteFile (in: hFile=0x23c, lpBuffer=0x2654eb4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2654eb4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.721] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0067.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8d
	[0067.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8e
	[0067.722] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.724] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.724] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.725] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.725] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8d
	[0067.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8e
	[0067.726] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.727] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.727] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.727] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.728] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0067.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.729] GetFileType (hFile=0x23c) returned 0x1
	[0067.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.730] GetFileType (hFile=0x23c) returned 0x1
	[0067.730] WriteFile (in: hFile=0x23c, lpBuffer=0x265a6a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x265a6a4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.733] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0067.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x8a
	[0067.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8b
	[0067.733] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.734] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.734] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.735] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.735] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x8a
	[0067.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8b
	[0067.736] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.736] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.737] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.737] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.737] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.739] GetFileType (hFile=0x23c) returned 0x1
	[0067.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.740] GetFileType (hFile=0x23c) returned 0x1
	[0067.740] WriteFile (in: hFile=0x23c, lpBuffer=0x265fdd8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x265fdd8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.743] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0067.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru", lpFilePart=0x0) returned 0x8a
	[0067.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8b
	[0067.744] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.745] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.746] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.746] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.747] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru", lpFilePart=0x0) returned 0x8a
	[0067.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8b
	[0067.749] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.749] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.750] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.750] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.750] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.751] GetFileType (hFile=0x23c) returned 0x1
	[0067.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.751] GetFileType (hFile=0x23c) returned 0x1
	[0067.752] WriteFile (in: hFile=0x23c, lpBuffer=0x266550c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x266550c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.755] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0067.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk", lpFilePart=0x0) returned 0x8a
	[0067.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8b
	[0067.755] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.756] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.756] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.757] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.757] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk", lpFilePart=0x0) returned 0x8a
	[0067.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8b
	[0067.764] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.764] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.764] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.765] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.765] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.766] GetFileType (hFile=0x23c) returned 0x1
	[0067.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.766] GetFileType (hFile=0x23c) returned 0x1
	[0067.767] WriteFile (in: hFile=0x23c, lpBuffer=0x266ac40*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x266ac40*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0067.771] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0067.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl", lpFilePart=0x0) returned 0x8a
	[0067.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8b
	[0067.771] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.773] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.774] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.774] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.774] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl", lpFilePart=0x0) returned 0x8a
	[0067.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8b
	[0067.775] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.775] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.776] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.776] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.776] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.777] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0067.777] GetFileType (hFile=0x23c) returned 0x1
	[0067.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0067.777] GetFileType (hFile=0x23c) returned 0x1
	[0067.781] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0067.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr", lpFilePart=0x0) returned 0x8a
	[0067.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8b
	[0067.781] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.782] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.782] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.782] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0067.782] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0067.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr", lpFilePart=0x0) returned 0x8a
	[0067.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8b
	[0067.783] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0067.783] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0067.784] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0067.784] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0067.784] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0067.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0067.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0067.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0067.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0067.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.150] GetFileType (hFile=0x23c) returned 0x1
	[0068.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.166] GetFileType (hFile=0x23c) returned 0x1
	[0068.225] WriteFile (in: hFile=0x23c, lpBuffer=0x2675aa8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2675aa8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.254] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0068.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv", lpFilePart=0x0) returned 0x8a
	[0068.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8b
	[0068.254] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.281] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.282] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.282] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.282] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv", lpFilePart=0x0) returned 0x8a
	[0068.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8b
	[0068.283] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.284] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.285] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.285] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.285] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0068.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.287] GetFileType (hFile=0x23c) returned 0x1
	[0068.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.287] GetFileType (hFile=0x23c) returned 0x1
	[0068.287] WriteFile (in: hFile=0x23c, lpBuffer=0x267b1dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x267b1dc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.290] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0068.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th", lpFilePart=0x0) returned 0x8a
	[0068.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8b
	[0068.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.291] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.292] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.292] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.292] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th", lpFilePart=0x0) returned 0x8a
	[0068.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8b
	[0068.293] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.293] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.294] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.294] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.294] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0068.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.296] GetFileType (hFile=0x23c) returned 0x1
	[0068.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.296] GetFileType (hFile=0x23c) returned 0x1
	[0068.296] WriteFile (in: hFile=0x23c, lpBuffer=0x2680910*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2680910*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.299] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0068.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr", lpFilePart=0x0) returned 0x8a
	[0068.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8b
	[0068.300] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.436] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.436] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.437] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.437] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr", lpFilePart=0x0) returned 0x8a
	[0068.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8b
	[0068.438] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.438] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.438] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.439] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.439] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.439] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0068.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.439] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.453] GetFileType (hFile=0x23c) returned 0x1
	[0068.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.453] GetFileType (hFile=0x23c) returned 0x1
	[0068.453] WriteFile (in: hFile=0x23c, lpBuffer=0x2686044*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2686044*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.456] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0068.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk", lpFilePart=0x0) returned 0x8a
	[0068.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8b
	[0068.457] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.457] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.458] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.458] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.458] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk", lpFilePart=0x0) returned 0x8a
	[0068.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8b
	[0068.459] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.460] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.460] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.460] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.461] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0068.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.462] GetFileType (hFile=0x23c) returned 0x1
	[0068.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.462] GetFileType (hFile=0x23c) returned 0x1
	[0068.462] WriteFile (in: hFile=0x23c, lpBuffer=0x268b778*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x268b778*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.465] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0068.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi", lpFilePart=0x0) returned 0x8a
	[0068.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8b
	[0068.466] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.487] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.488] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.488] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.488] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi", lpFilePart=0x0) returned 0x8a
	[0068.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8b
	[0068.489] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.490] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.490] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.490] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.490] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.491] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0068.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.492] GetFileType (hFile=0x23c) returned 0x1
	[0068.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.492] GetFileType (hFile=0x23c) returned 0x1
	[0068.492] WriteFile (in: hFile=0x23c, lpBuffer=0x2690eac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2690eac*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.495] CloseHandle (hObject=0x23c) returned 1
	[0068.496] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1
	[0068.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8d
	[0068.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8e
	[0068.497] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.497] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.498] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.498] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.499] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8d
	[0068.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8e
	[0068.500] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.500] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.501] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.502] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.502] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0068.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.503] GetFileType (hFile=0x23c) returned 0x1
	[0068.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.504] GetFileType (hFile=0x23c) returned 0x1
	[0068.504] WriteFile (in: hFile=0x23c, lpBuffer=0x269669c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x269669c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.507] CloseHandle (hObject=0x23c) returned 1
	[0068.507] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0068.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8d
	[0068.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8e
	[0068.508] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.515] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.515] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.516] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.516] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8d
	[0068.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8e
	[0068.517] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.518] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.519] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.519] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.519] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0068.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.521] GetFileType (hFile=0x23c) returned 0x1
	[0068.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.521] GetFileType (hFile=0x23c) returned 0x1
	[0068.521] WriteFile (in: hFile=0x23c, lpBuffer=0x269be8c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x269be8c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.524] CloseHandle (hObject=0x23c) returned 1
	[0068.524] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.525] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0068.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0068.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0068.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0068.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpFilePart=0x0) returned 0x87
	[0068.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpFilePart=0x0) returned 0x88
	[0068.526] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0068.526] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.527] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf91035d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf91035d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0068.528] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9129730, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9129730, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0068.528] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf914f890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf914f890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0068.528] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf91759f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf91759f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0068.529] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf919bb50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf919bb50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0068.529] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf91c1cb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf91c1cb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0068.530] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf91c1cb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf91c1cb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0068.530] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf91e7e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf91e7e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1
	[0068.531] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf920df70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf920df70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1
	[0068.531] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf92340d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf92340d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0068.532] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf925a230, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf925a230, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1
	[0068.532] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf925a230, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf925a230, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0068.533] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf92f27b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf92f27b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1
	[0068.533] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9318910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9318910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0068.534] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf933ea70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf933ea70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0068.534] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf93b0e90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf93b0e90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0068.535] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf93d6ff0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf93d6ff0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0068.535] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf93fd150, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf93fd150, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0068.536] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf93fd150, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf93fd150, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0068.536] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf94232b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf94232b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0068.537] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9449410, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9449410, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0068.537] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf946f570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf946f570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0068.538] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf94956d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf94956d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0068.538] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf94bb830, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf94bb830, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0068.538] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf94e1990, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf94e1990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0068.539] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9507af0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9507af0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0068.539] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9507af0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9507af0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1
	[0068.540] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf952dc50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf952dc50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0068.540] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9579f10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9579f10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0068.541] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf95a0070, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf95a0070, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0068.541] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf95a0070, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf95a0070, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0068.542] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf95c61d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf95c61d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0068.542] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf95ec330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf95ec330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0068.543] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf95ec330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf95ec330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0068.543] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9612490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9612490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0068.544] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf96385f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf96385f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0068.544] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf96385f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf96385f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0068.545] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9b21350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9b21350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0068.545] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9b21350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9b21350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0068.546] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9c77fb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9c77fb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0068.546] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9cc4270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9cc4270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0068.547] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9d10530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9d10530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0068.547] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9d36690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9d36690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1
	[0068.548] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9d5c7f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9d5c7f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0068.548] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9d5c7f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9d5c7f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0
	[0068.548] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0068.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0068.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0068.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\Decrypt.txt", lpFilePart=0x0) returned 0x93
	[0068.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0068.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0068.561] GetFileType (hFile=0x238) returned 0x1
	[0068.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0068.561] GetFileType (hFile=0x238) returned 0x1
	[0068.561] WriteFile (in: hFile=0x238, lpBuffer=0x26a62f4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x26a62f4*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0068.564] CloseHandle (hObject=0x238) returned 1
	[0068.565] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0068.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0068.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata", lpFilePart=0x0) returned 0x88
	[0068.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\", lpFilePart=0x0) returned 0x89
	[0068.566] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0068.567] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.567] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1
	[0068.568] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0
	[0068.568] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0068.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0068.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0068.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0068.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata", lpFilePart=0x0) returned 0x88
	[0068.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\", lpFilePart=0x0) returned 0x89
	[0068.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0068.570] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.570] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1
	[0068.571] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.571] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0068.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0068.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0068.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\Decrypt.txt", lpFilePart=0x0) returned 0x94
	[0068.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0068.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0068.573] GetFileType (hFile=0x238) returned 0x1
	[0068.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0068.573] GetFileType (hFile=0x238) returned 0x1
	[0068.573] WriteFile (in: hFile=0x238, lpBuffer=0x26aba70*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x26aba70*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0068.576] CloseHandle (hObject=0x238) returned 1
	[0068.576] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.577] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0068.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0068.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0068.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0068.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", lpFilePart=0x0) returned 0x7e
	[0068.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", lpFilePart=0x0) returned 0x7f
	[0068.578] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0068.578] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.579] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a33, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1
	[0068.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", lpFilePart=0x0) returned 0x86
	[0068.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0068.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0068.580] GetFileType (hFile=0x238) returned 0x1
	[0068.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0068.580] GetFileType (hFile=0x238) returned 0x1
	[0068.580] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x1a33
	[0068.581] ReadFile (in: hFile=0x238, lpBuffer=0x26ae260, nNumberOfBytesToRead=0x1a33, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x26ae260*, lpNumberOfBytesRead=0x26eac4*=0x1a33, lpOverlapped=0x0) returned 1
	[0068.585] CloseHandle (hObject=0x238) returned 1
	[0068.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.KEKW", lpFilePart=0x0) returned 0x8b
	[0068.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0068.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0068.587] GetFileType (hFile=0x238) returned 0x1
	[0068.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0068.587] GetFileType (hFile=0x238) returned 0x1
	[0068.588] WriteFile (in: hFile=0x238, lpBuffer=0x26b1510*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x26b1510*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0068.591] CloseHandle (hObject=0x238) returned 1
	[0068.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", lpFilePart=0x0) returned 0x86
	[0068.592] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 1
	[0068.595] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8716c790, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0068.595] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9da8ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9da8ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0068.598] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9dcec10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9dcec10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0068.599] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9dcec10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9dcec10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0
	[0068.600] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0068.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0068.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0068.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\Decrypt.txt", lpFilePart=0x0) returned 0x8a
	[0068.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0068.601] GetFileType (hFile=0x234) returned 0x1
	[0068.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0068.601] GetFileType (hFile=0x234) returned 0x1
	[0068.602] WriteFile (in: hFile=0x234, lpBuffer=0x26b49b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x26b49b4*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0068.605] CloseHandle (hObject=0x234) returned 1
	[0068.605] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.605] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0068.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0068.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0068.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0068.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", lpFilePart=0x0) returned 0x77
	[0068.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", lpFilePart=0x0) returned 0x78
	[0068.606] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0068.607] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.608] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9e1aed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9e1aed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.1_0", cAlternateFileName="")) returned 1
	[0068.608] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9e1aed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9e1aed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.1_0", cAlternateFileName="")) returned 0
	[0068.608] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0068.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0068.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0068.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\Decrypt.txt", lpFilePart=0x0) returned 0x83
	[0068.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0068.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0068.610] GetFileType (hFile=0x230) returned 0x1
	[0068.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0068.610] GetFileType (hFile=0x230) returned 0x1
	[0068.610] WriteFile (in: hFile=0x230, lpBuffer=0x26b82e8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x26b82e8*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0068.614] CloseHandle (hObject=0x230) returned 1
	[0068.615] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="blpcfgokakmgnkcojhhkbfbldkacnbeo", cAlternateFileName="BLPCFG~1")) returned 1
	[0068.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0068.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo", lpFilePart=0x0) returned 0x77
	[0068.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\", lpFilePart=0x0) returned 0x78
	[0068.615] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0068.616] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.617] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 1
	[0068.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0068.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0", lpFilePart=0x0) returned 0x7f
	[0068.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\", lpFilePart=0x0) returned 0x80
	[0068.618] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0068.632] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.633] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1
	[0068.634] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0068.634] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0068.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0068.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales", lpFilePart=0x0) returned 0x88
	[0068.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\", lpFilePart=0x0) returned 0x89
	[0068.635] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0068.647] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.647] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0068.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar", lpFilePart=0x0) returned 0x8b
	[0068.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8c
	[0068.648] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.649] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.650] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.650] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.650] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar", lpFilePart=0x0) returned 0x8b
	[0068.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8c
	[0068.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.652] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.653] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.653] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.653] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.655] GetFileType (hFile=0x23c) returned 0x1
	[0068.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.655] GetFileType (hFile=0x23c) returned 0x1
	[0068.655] WriteFile (in: hFile=0x23c, lpBuffer=0x26c1768*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26c1768*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.661] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0068.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg", lpFilePart=0x0) returned 0x8b
	[0068.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8c
	[0068.662] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.666] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.666] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.667] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.667] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg", lpFilePart=0x0) returned 0x8b
	[0068.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8c
	[0068.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.669] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.669] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.670] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.670] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.671] GetFileType (hFile=0x23c) returned 0x1
	[0068.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.671] GetFileType (hFile=0x23c) returned 0x1
	[0068.672] WriteFile (in: hFile=0x23c, lpBuffer=0x26c6ed0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26c6ed0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.675] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0068.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca", lpFilePart=0x0) returned 0x8b
	[0068.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8c
	[0068.676] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.677] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.677] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.678] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.679] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca", lpFilePart=0x0) returned 0x8b
	[0068.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8c
	[0068.679] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.680] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.680] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.681] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.681] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.682] GetFileType (hFile=0x23c) returned 0x1
	[0068.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.683] GetFileType (hFile=0x23c) returned 0x1
	[0068.683] WriteFile (in: hFile=0x23c, lpBuffer=0x26cc638*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26cc638*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.686] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0068.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs", lpFilePart=0x0) returned 0x8b
	[0068.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8c
	[0068.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.703] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.703] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.704] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.704] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs", lpFilePart=0x0) returned 0x8b
	[0068.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8c
	[0068.705] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.706] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.706] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.707] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.707] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.709] GetFileType (hFile=0x23c) returned 0x1
	[0068.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.709] GetFileType (hFile=0x23c) returned 0x1
	[0068.709] WriteFile (in: hFile=0x23c, lpBuffer=0x26d1da0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26d1da0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.712] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0068.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da", lpFilePart=0x0) returned 0x8b
	[0068.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8c
	[0068.713] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.713] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.714] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.714] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.715] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da", lpFilePart=0x0) returned 0x8b
	[0068.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8c
	[0068.716] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.716] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.717] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.717] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.717] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.719] GetFileType (hFile=0x23c) returned 0x1
	[0068.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.719] GetFileType (hFile=0x23c) returned 0x1
	[0068.719] WriteFile (in: hFile=0x23c, lpBuffer=0x26d7508*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26d7508*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.722] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0068.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de", lpFilePart=0x0) returned 0x8b
	[0068.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8c
	[0068.723] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.729] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.729] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.730] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.730] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de", lpFilePart=0x0) returned 0x8b
	[0068.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8c
	[0068.731] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.731] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.732] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.732] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.733] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.734] GetFileType (hFile=0x23c) returned 0x1
	[0068.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.734] GetFileType (hFile=0x23c) returned 0x1
	[0068.735] WriteFile (in: hFile=0x23c, lpBuffer=0x26dcc70*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26dcc70*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.738] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0068.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.738] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el", lpFilePart=0x0) returned 0x8b
	[0068.738] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8c
	[0068.738] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.739] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.739] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.740] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.740] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el", lpFilePart=0x0) returned 0x8b
	[0068.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8c
	[0068.741] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.741] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.742] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.742] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.743] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.744] GetFileType (hFile=0x23c) returned 0x1
	[0068.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.744] GetFileType (hFile=0x23c) returned 0x1
	[0068.744] WriteFile (in: hFile=0x23c, lpBuffer=0x26e23d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26e23d8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.763] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1
	[0068.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en", lpFilePart=0x0) returned 0x8b
	[0068.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8c
	[0068.763] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.766] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.767] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.767] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.768] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en", lpFilePart=0x0) returned 0x8b
	[0068.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8c
	[0068.769] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.769] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.770] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.770] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.771] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.772] GetFileType (hFile=0x23c) returned 0x1
	[0068.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.772] GetFileType (hFile=0x23c) returned 0x1
	[0068.772] WriteFile (in: hFile=0x23c, lpBuffer=0x26e7b40*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26e7b40*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.775] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0068.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es", lpFilePart=0x0) returned 0x8b
	[0068.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8c
	[0068.776] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.777] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.777] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.778] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.778] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es", lpFilePart=0x0) returned 0x8b
	[0068.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8c
	[0068.779] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.779] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.780] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.780] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.780] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.782] GetFileType (hFile=0x23c) returned 0x1
	[0068.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.782] GetFileType (hFile=0x23c) returned 0x1
	[0068.782] WriteFile (in: hFile=0x23c, lpBuffer=0x26ed2a8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26ed2a8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.786] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0068.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi", lpFilePart=0x0) returned 0x8b
	[0068.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8c
	[0068.787] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.789] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.789] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.790] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.790] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi", lpFilePart=0x0) returned 0x8b
	[0068.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8c
	[0068.791] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.791] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.792] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.792] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.793] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.794] GetFileType (hFile=0x23c) returned 0x1
	[0068.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.794] GetFileType (hFile=0x23c) returned 0x1
	[0068.794] WriteFile (in: hFile=0x23c, lpBuffer=0x26f2a10*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26f2a10*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.797] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0068.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil", lpFilePart=0x0) returned 0x8c
	[0068.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8d
	[0068.797] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.798] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.799] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.803] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.803] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil", lpFilePart=0x0) returned 0x8c
	[0068.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8d
	[0068.804] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.804] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.805] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.805] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.805] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0068.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.806] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.807] GetFileType (hFile=0x23c) returned 0x1
	[0068.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.807] GetFileType (hFile=0x23c) returned 0x1
	[0068.807] WriteFile (in: hFile=0x23c, lpBuffer=0x26f81e4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26f81e4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.810] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0068.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.810] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr", lpFilePart=0x0) returned 0x8b
	[0068.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8c
	[0068.811] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.814] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.815] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.815] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.816] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr", lpFilePart=0x0) returned 0x8b
	[0068.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8c
	[0068.817] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.817] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.817] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.818] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.818] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.819] GetFileType (hFile=0x23c) returned 0x1
	[0068.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.819] GetFileType (hFile=0x23c) returned 0x1
	[0068.820] WriteFile (in: hFile=0x23c, lpBuffer=0x26fd94c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26fd94c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.823] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0068.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he", lpFilePart=0x0) returned 0x8b
	[0068.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8c
	[0068.823] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.824] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.824] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.825] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.825] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he", lpFilePart=0x0) returned 0x8b
	[0068.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8c
	[0068.826] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.826] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.827] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.827] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.827] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.828] GetFileType (hFile=0x23c) returned 0x1
	[0068.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.829] GetFileType (hFile=0x23c) returned 0x1
	[0068.829] WriteFile (in: hFile=0x23c, lpBuffer=0x27030b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27030b4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.832] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0068.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi", lpFilePart=0x0) returned 0x8b
	[0068.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8c
	[0068.833] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.840] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.840] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.840] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.841] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi", lpFilePart=0x0) returned 0x8b
	[0068.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8c
	[0068.841] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.842] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.842] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.843] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.843] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.844] GetFileType (hFile=0x23c) returned 0x1
	[0068.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.844] GetFileType (hFile=0x23c) returned 0x1
	[0068.844] WriteFile (in: hFile=0x23c, lpBuffer=0x270881c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x270881c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.850] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0068.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr", lpFilePart=0x0) returned 0x8b
	[0068.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8c
	[0068.850] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.851] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.851] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.852] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.852] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr", lpFilePart=0x0) returned 0x8b
	[0068.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8c
	[0068.853] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.853] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.854] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.854] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.854] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.856] GetFileType (hFile=0x23c) returned 0x1
	[0068.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.856] GetFileType (hFile=0x23c) returned 0x1
	[0068.856] WriteFile (in: hFile=0x23c, lpBuffer=0x270df84*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x270df84*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.858] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0068.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu", lpFilePart=0x0) returned 0x8b
	[0068.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8c
	[0068.859] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.897] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.897] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.897] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.898] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu", lpFilePart=0x0) returned 0x8b
	[0068.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8c
	[0068.899] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.899] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.899] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.900] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.900] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.901] GetFileType (hFile=0x23c) returned 0x1
	[0068.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.902] GetFileType (hFile=0x23c) returned 0x1
	[0068.902] WriteFile (in: hFile=0x23c, lpBuffer=0x27136ec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27136ec*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.906] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0068.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id", lpFilePart=0x0) returned 0x8b
	[0068.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8c
	[0068.907] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.908] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.908] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.908] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0068.909] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id", lpFilePart=0x0) returned 0x8b
	[0068.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8c
	[0068.910] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0068.910] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0068.910] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0068.911] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0068.911] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0068.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0068.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0068.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0068.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0068.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0068.912] GetFileType (hFile=0x23c) returned 0x1
	[0068.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0068.913] GetFileType (hFile=0x23c) returned 0x1
	[0068.913] WriteFile (in: hFile=0x23c, lpBuffer=0x2718e54*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2718e54*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0068.916] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0068.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0068.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it", lpFilePart=0x0) returned 0x8b
	[0068.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8c
	[0068.916] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.052] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.052] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.053] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.053] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it", lpFilePart=0x0) returned 0x8b
	[0069.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8c
	[0069.054] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.055] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.055] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.056] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.056] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.057] GetFileType (hFile=0x23c) returned 0x1
	[0069.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.057] GetFileType (hFile=0x23c) returned 0x1
	[0069.058] WriteFile (in: hFile=0x23c, lpBuffer=0x271e5bc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x271e5bc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.061] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0069.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja", lpFilePart=0x0) returned 0x8b
	[0069.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8c
	[0069.061] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.062] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.062] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.063] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.063] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja", lpFilePart=0x0) returned 0x8b
	[0069.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8c
	[0069.065] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.065] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.065] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.066] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.066] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.067] GetFileType (hFile=0x23c) returned 0x1
	[0069.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.067] GetFileType (hFile=0x23c) returned 0x1
	[0069.068] WriteFile (in: hFile=0x23c, lpBuffer=0x2723d24*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2723d24*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.070] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0069.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko", lpFilePart=0x0) returned 0x8b
	[0069.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8c
	[0069.071] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.209] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.209] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.210] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.210] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko", lpFilePart=0x0) returned 0x8b
	[0069.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8c
	[0069.211] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.212] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.212] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.212] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.212] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.216] GetFileType (hFile=0x23c) returned 0x1
	[0069.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.217] GetFileType (hFile=0x23c) returned 0x1
	[0069.217] WriteFile (in: hFile=0x23c, lpBuffer=0x272948c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x272948c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.226] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0069.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt", lpFilePart=0x0) returned 0x8b
	[0069.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8c
	[0069.227] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.227] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.228] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.228] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.228] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt", lpFilePart=0x0) returned 0x8b
	[0069.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8c
	[0069.229] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.229] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.230] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.230] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.230] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.231] GetFileType (hFile=0x23c) returned 0x1
	[0069.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.231] GetFileType (hFile=0x23c) returned 0x1
	[0069.237] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0069.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv", lpFilePart=0x0) returned 0x8b
	[0069.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8c
	[0069.237] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.242] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.242] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.242] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.242] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv", lpFilePart=0x0) returned 0x8b
	[0069.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8c
	[0069.243] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.244] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.244] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.244] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.244] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.245] GetFileType (hFile=0x23c) returned 0x1
	[0069.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.246] GetFileType (hFile=0x23c) returned 0x1
	[0069.248] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0069.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl", lpFilePart=0x0) returned 0x8b
	[0069.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8c
	[0069.249] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.250] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.250] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.250] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.250] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl", lpFilePart=0x0) returned 0x8b
	[0069.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8c
	[0069.251] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.252] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.252] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.252] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.252] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.253] GetFileType (hFile=0x23c) returned 0x1
	[0069.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.254] GetFileType (hFile=0x23c) returned 0x1
	[0069.256] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0069.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no", lpFilePart=0x0) returned 0x8b
	[0069.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8c
	[0069.257] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.259] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.259] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.259] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.260] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no", lpFilePart=0x0) returned 0x8b
	[0069.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8c
	[0069.260] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.261] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.261] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.261] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.261] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.263] GetFileType (hFile=0x23c) returned 0x1
	[0069.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.263] GetFileType (hFile=0x23c) returned 0x1
	[0069.266] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0069.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl", lpFilePart=0x0) returned 0x8b
	[0069.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8c
	[0069.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.268] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.268] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.268] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.268] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl", lpFilePart=0x0) returned 0x8b
	[0069.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8c
	[0069.269] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.269] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.269] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.270] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.270] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.271] GetFileType (hFile=0x23c) returned 0x1
	[0069.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.271] GetFileType (hFile=0x23c) returned 0x1
	[0069.274] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0069.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8e
	[0069.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8f
	[0069.274] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.276] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.277] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.277] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.277] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8e
	[0069.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8f
	[0069.278] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.278] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.278] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.278] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.278] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\Decrypt.txt", lpFilePart=0x0) returned 0x9a
	[0069.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.280] GetFileType (hFile=0x23c) returned 0x1
	[0069.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.280] GetFileType (hFile=0x23c) returned 0x1
	[0069.284] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0069.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8e
	[0069.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8f
	[0069.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.286] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.286] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.286] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.286] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8e
	[0069.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8f
	[0069.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.287] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.287] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.287] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.287] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\Decrypt.txt", lpFilePart=0x0) returned 0x9a
	[0069.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.289] GetFileType (hFile=0x23c) returned 0x1
	[0069.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.289] GetFileType (hFile=0x23c) returned 0x1
	[0069.292] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0069.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro", lpFilePart=0x0) returned 0x8b
	[0069.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8c
	[0069.292] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.297] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.297] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.297] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.298] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro", lpFilePart=0x0) returned 0x8b
	[0069.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8c
	[0069.299] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.299] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.299] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.299] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.300] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.301] GetFileType (hFile=0x23c) returned 0x1
	[0069.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.301] GetFileType (hFile=0x23c) returned 0x1
	[0069.304] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0069.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru", lpFilePart=0x0) returned 0x8b
	[0069.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8c
	[0069.304] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.305] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.305] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.305] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.305] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru", lpFilePart=0x0) returned 0x8b
	[0069.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8c
	[0069.306] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.306] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.307] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.307] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.307] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.308] GetFileType (hFile=0x23c) returned 0x1
	[0069.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.308] GetFileType (hFile=0x23c) returned 0x1
	[0069.311] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0069.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk", lpFilePart=0x0) returned 0x8b
	[0069.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8c
	[0069.312] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.315] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.315] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.315] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.315] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk", lpFilePart=0x0) returned 0x8b
	[0069.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8c
	[0069.316] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.316] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.316] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.317] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.317] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.318] GetFileType (hFile=0x23c) returned 0x1
	[0069.318] GetFileType (hFile=0x23c) returned 0x1
	[0069.321] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0069.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl", lpFilePart=0x0) returned 0x8b
	[0069.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8c
	[0069.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.322] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.322] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.322] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.323] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl", lpFilePart=0x0) returned 0x8b
	[0069.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8c
	[0069.323] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.323] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.324] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.324] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.324] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.325] GetFileType (hFile=0x23c) returned 0x1
	[0069.325] GetFileType (hFile=0x23c) returned 0x1
	[0069.328] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0069.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", lpFilePart=0x0) returned 0x8b
	[0069.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8c
	[0069.328] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.331] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.331] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.331] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.331] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", lpFilePart=0x0) returned 0x8b
	[0069.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8c
	[0069.332] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.332] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.332] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.332] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.333] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.334] GetFileType (hFile=0x23c) returned 0x1
	[0069.334] GetFileType (hFile=0x23c) returned 0x1
	[0069.337] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0069.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", lpFilePart=0x0) returned 0x8b
	[0069.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8c
	[0069.337] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.338] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.338] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.338] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.338] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", lpFilePart=0x0) returned 0x8b
	[0069.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8c
	[0069.342] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.342] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.342] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.342] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.343] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.344] GetFileType (hFile=0x23c) returned 0x1
	[0069.344] GetFileType (hFile=0x23c) returned 0x1
	[0069.347] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0069.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", lpFilePart=0x0) returned 0x8b
	[0069.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8c
	[0069.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.349] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.350] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", lpFilePart=0x0) returned 0x8b
	[0069.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8c
	[0069.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.351] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.353] GetFileType (hFile=0x23c) returned 0x1
	[0069.353] GetFileType (hFile=0x23c) returned 0x1
	[0069.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", lpFilePart=0x0) returned 0x8b
	[0069.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8c
	[0069.356] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.357] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", lpFilePart=0x0) returned 0x8b
	[0069.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8c
	[0069.357] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.358] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.358] GetFileType (hFile=0x23c) returned 0x1
	[0069.359] GetFileType (hFile=0x23c) returned 0x1
	[0069.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", lpFilePart=0x0) returned 0x8b
	[0069.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8c
	[0069.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.365] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", lpFilePart=0x0) returned 0x8b
	[0069.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8c
	[0069.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.366] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.367] GetFileType (hFile=0x23c) returned 0x1
	[0069.367] GetFileType (hFile=0x23c) returned 0x1
	[0069.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", lpFilePart=0x0) returned 0x8b
	[0069.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8c
	[0069.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.371] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", lpFilePart=0x0) returned 0x8b
	[0069.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8c
	[0069.372] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.372] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0069.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.373] GetFileType (hFile=0x23c) returned 0x1
	[0069.373] GetFileType (hFile=0x23c) returned 0x1
	[0069.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8e
	[0069.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8f
	[0069.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.379] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8e
	[0069.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8f
	[0069.380] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.380] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Decrypt.txt", lpFilePart=0x0) returned 0x9a
	[0069.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.381] GetFileType (hFile=0x23c) returned 0x1
	[0069.381] GetFileType (hFile=0x23c) returned 0x1
	[0069.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8e
	[0069.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8f
	[0069.384] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.385] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8e
	[0069.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8f
	[0069.386] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.386] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Decrypt.txt", lpFilePart=0x0) returned 0x9a
	[0069.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.387] GetFileType (hFile=0x23c) returned 0x1
	[0069.387] GetFileType (hFile=0x23c) returned 0x1
	[0069.390] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0069.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales", lpFilePart=0x0) returned 0x88
	[0069.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\", lpFilePart=0x0) returned 0x89
	[0069.390] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0069.391] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0069.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\Decrypt.txt", lpFilePart=0x0) returned 0x94
	[0069.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0069.438] GetFileType (hFile=0x238) returned 0x1
	[0069.438] GetFileType (hFile=0x238) returned 0x1
	[0069.442] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata", lpFilePart=0x0) returned 0x89
	[0069.442] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\", lpFilePart=0x0) returned 0x8a
	[0069.442] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0069.442] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0069.443] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata", lpFilePart=0x0) returned 0x89
	[0069.443] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\", lpFilePart=0x0) returned 0x8a
	[0069.443] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0069.443] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0069.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0069.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0069.444] GetFileType (hFile=0x238) returned 0x1
	[0069.445] GetFileType (hFile=0x238) returned 0x1
	[0069.448] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0069.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0", lpFilePart=0x0) returned 0x7f
	[0069.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\", lpFilePart=0x0) returned 0x80
	[0069.448] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0069.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", lpFilePart=0x0) returned 0x87
	[0069.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0069.449] GetFileType (hFile=0x238) returned 0x1
	[0069.449] GetFileType (hFile=0x238) returned 0x1
	[0069.450] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0xd4e
	[0069.450] ReadFile (in: hFile=0x238, lpBuffer=0x27a3ae0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x27a3ae0*, lpNumberOfBytesRead=0x26eac4*=0xd4e, lpOverlapped=0x0) returned 1
	[0069.455] CloseHandle (hObject=0x238) returned 1
	[0069.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0069.456] GetFileType (hFile=0x238) returned 0x1
	[0069.457] GetFileType (hFile=0x238) returned 0x1
	[0069.457] WriteFile (in: hFile=0x238, lpBuffer=0x27a62e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x27a62e8*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0069.460] CloseHandle (hObject=0x238) returned 1
	[0069.463] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 1
	[0069.469] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa623910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa623910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0069.469] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa623910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa623910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0
	[0069.470] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0069.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0069.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0069.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.471] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0069.472] GetFileType (hFile=0x234) returned 0x1
	[0069.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0069.472] GetFileType (hFile=0x234) returned 0x1
	[0069.473] WriteFile (in: hFile=0x234, lpBuffer=0x27a97a8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x27a97a8*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0069.476] CloseHandle (hObject=0x234) returned 1
	[0069.477] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.477] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0069.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0069.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0069.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0069.479] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0069.479] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.480] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa66fbd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa66fbd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 1
	[0069.480] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa66fbd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa66fbd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 0
	[0069.481] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0069.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0069.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0069.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0069.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0069.482] GetFileType (hFile=0x230) returned 0x1
	[0069.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0069.482] GetFileType (hFile=0x230) returned 0x1
	[0069.483] WriteFile (in: hFile=0x230, lpBuffer=0x27ad12c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x27ad12c*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0069.489] CloseHandle (hObject=0x230) returned 1
	[0069.489] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="felcaaldnbdncclmgdcncolpebgiejap", cAlternateFileName="FELCAA~1")) returned 1
	[0069.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0069.490] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0069.492] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.493] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 1
	[0069.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0069.494] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0069.502] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.502] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1
	[0069.503] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84239770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_16.png", cAlternateFileName="")) returned 1
	[0069.504] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8423be80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8423e590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1
	[0069.504] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84240ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84240ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js", cAlternateFileName="")) returned 1
	[0069.505] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x840205b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84245ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844aa770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0069.505] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0069.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0069.506] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0069.511] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.511] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0069.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.512] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.513] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.514] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.514] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.515] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.516] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.517] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.517] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.518] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.518] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0069.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.520] GetFileType (hFile=0x23c) returned 0x1
	[0069.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.520] GetFileType (hFile=0x23c) returned 0x1
	[0069.520] WriteFile (in: hFile=0x23c, lpBuffer=0x27b6be0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27b6be0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.523] CloseHandle (hObject=0x23c) returned 1
	[0069.524] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0069.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x89
	[0069.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a
	[0069.525] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.527] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.528] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.528] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.529] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x89
	[0069.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a
	[0069.530] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.531] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.531] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.532] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.532] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0069.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.534] GetFileType (hFile=0x23c) returned 0x1
	[0069.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.534] GetFileType (hFile=0x23c) returned 0x1
	[0069.534] WriteFile (in: hFile=0x23c, lpBuffer=0x27bc2a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27bc2a4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.537] CloseHandle (hObject=0x23c) returned 1
	[0069.538] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0069.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x89
	[0069.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a
	[0069.539] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.540] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.540] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.541] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.541] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x89
	[0069.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a
	[0069.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.543] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.543] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.544] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.545] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0069.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.547] GetFileType (hFile=0x23c) returned 0x1
	[0069.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.547] GetFileType (hFile=0x23c) returned 0x1
	[0069.548] WriteFile (in: hFile=0x23c, lpBuffer=0x27c1968*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27c1968*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.553] CloseHandle (hObject=0x23c) returned 1
	[0069.554] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0069.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x89
	[0069.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a
	[0069.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.585] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.586] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.587] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.588] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x89
	[0069.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a
	[0069.593] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.593] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.594] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.697] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.697] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0069.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.698] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.700] GetFileType (hFile=0x23c) returned 0x1
	[0069.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.700] GetFileType (hFile=0x23c) returned 0x1
	[0069.700] WriteFile (in: hFile=0x23c, lpBuffer=0x27c702c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27c702c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.710] CloseHandle (hObject=0x23c) returned 1
	[0069.711] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0069.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da", lpFilePart=0x0) returned 0x89
	[0069.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a
	[0069.712] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.713] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.713] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.714] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.714] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da", lpFilePart=0x0) returned 0x89
	[0069.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a
	[0069.715] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.716] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.716] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.717] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.717] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0069.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.718] GetFileType (hFile=0x23c) returned 0x1
	[0069.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.719] GetFileType (hFile=0x23c) returned 0x1
	[0069.719] WriteFile (in: hFile=0x23c, lpBuffer=0x27cc6f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27cc6f0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.722] CloseHandle (hObject=0x23c) returned 1
	[0069.723] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0069.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de", lpFilePart=0x0) returned 0x89
	[0069.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a
	[0069.724] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.726] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.726] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.727] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.727] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de", lpFilePart=0x0) returned 0x89
	[0069.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a
	[0069.728] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.729] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.730] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.730] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.730] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0069.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.732] GetFileType (hFile=0x23c) returned 0x1
	[0069.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.732] GetFileType (hFile=0x23c) returned 0x1
	[0069.733] WriteFile (in: hFile=0x23c, lpBuffer=0x27d1db4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27d1db4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.736] CloseHandle (hObject=0x23c) returned 1
	[0069.737] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0069.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el", lpFilePart=0x0) returned 0x89
	[0069.738] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a
	[0069.738] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.738] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.739] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.740] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.740] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el", lpFilePart=0x0) returned 0x89
	[0069.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a
	[0069.741] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.742] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.743] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.743] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.743] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0069.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.745] GetFileType (hFile=0x23c) returned 0x1
	[0069.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.746] GetFileType (hFile=0x23c) returned 0x1
	[0069.746] WriteFile (in: hFile=0x23c, lpBuffer=0x27d7478*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27d7478*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.750] CloseHandle (hObject=0x23c) returned 1
	[0069.750] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1
	[0069.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c
	[0069.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d
	[0069.752] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.754] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.755] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.755] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.756] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c
	[0069.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d
	[0069.757] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.757] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.758] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.758] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.759] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0069.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.760] GetFileType (hFile=0x23c) returned 0x1
	[0069.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.760] GetFileType (hFile=0x23c) returned 0x1
	[0069.761] WriteFile (in: hFile=0x23c, lpBuffer=0x27dcc40*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27dcc40*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.768] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1
	[0069.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c
	[0069.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d
	[0069.768] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.769] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.770] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.770] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.771] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c
	[0069.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d
	[0069.772] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.772] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.773] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.773] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.773] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0069.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.774] GetFileType (hFile=0x23c) returned 0x1
	[0069.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.775] GetFileType (hFile=0x23c) returned 0x1
	[0069.775] WriteFile (in: hFile=0x23c, lpBuffer=0x27e2408*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27e2408*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.778] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0069.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.778] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es", lpFilePart=0x0) returned 0x89
	[0069.778] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a
	[0069.779] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.781] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.782] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.782] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.783] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es", lpFilePart=0x0) returned 0x89
	[0069.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a
	[0069.784] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.784] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.785] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.785] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.785] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0069.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.787] GetFileType (hFile=0x23c) returned 0x1
	[0069.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.787] GetFileType (hFile=0x23c) returned 0x1
	[0069.787] WriteFile (in: hFile=0x23c, lpBuffer=0x27e7acc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27e7acc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.790] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1
	[0069.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d
	[0069.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e
	[0069.791] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.792] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.792] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.793] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.793] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d
	[0069.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e
	[0069.794] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.795] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.795] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.795] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.796] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0069.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.797] GetFileType (hFile=0x23c) returned 0x1
	[0069.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.798] GetFileType (hFile=0x23c) returned 0x1
	[0069.798] WriteFile (in: hFile=0x23c, lpBuffer=0x27ed2c0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27ed2c0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.801] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0069.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et", lpFilePart=0x0) returned 0x89
	[0069.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a
	[0069.802] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.804] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.805] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.805] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.805] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et", lpFilePart=0x0) returned 0x89
	[0069.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a
	[0069.806] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.807] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.807] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.808] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.808] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0069.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.809] GetFileType (hFile=0x23c) returned 0x1
	[0069.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.810] GetFileType (hFile=0x23c) returned 0x1
	[0069.811] WriteFile (in: hFile=0x23c, lpBuffer=0x27f2984*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27f2984*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.819] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0069.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi", lpFilePart=0x0) returned 0x89
	[0069.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a
	[0069.824] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.825] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.825] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.826] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0069.826] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.827] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi", lpFilePart=0x0) returned 0x89
	[0069.827] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a
	[0069.827] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0069.828] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0069.829] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0069.830] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0069.830] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0069.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0069.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0069.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0069.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0069.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0069.832] GetFileType (hFile=0x23c) returned 0x1
	[0069.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0069.832] GetFileType (hFile=0x23c) returned 0x1
	[0069.832] WriteFile (in: hFile=0x23c, lpBuffer=0x25f53a0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25f53a0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0069.835] CloseHandle (hObject=0x23c) returned 1
	[0069.836] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0069.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0069.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a
	[0069.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b
	[0069.837] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.042] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.043] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.043] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.044] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a
	[0070.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b
	[0070.045] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.045] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.046] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.046] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.053] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0070.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.055] GetFileType (hFile=0x23c) returned 0x1
	[0070.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.055] GetFileType (hFile=0x23c) returned 0x1
	[0070.056] WriteFile (in: hFile=0x23c, lpBuffer=0x25faad0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25faad0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.058] CloseHandle (hObject=0x23c) returned 1
	[0070.059] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0070.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr", lpFilePart=0x0) returned 0x89
	[0070.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a
	[0070.060] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.061] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.061] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.062] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.063] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr", lpFilePart=0x0) returned 0x89
	[0070.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a
	[0070.064] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.064] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.065] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.065] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.066] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.067] GetFileType (hFile=0x23c) returned 0x1
	[0070.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.067] GetFileType (hFile=0x23c) returned 0x1
	[0070.068] WriteFile (in: hFile=0x23c, lpBuffer=0x2600194*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2600194*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.070] CloseHandle (hObject=0x23c) returned 1
	[0070.071] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0070.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he", lpFilePart=0x0) returned 0x89
	[0070.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a
	[0070.072] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.109] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.110] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.111] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.111] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he", lpFilePart=0x0) returned 0x89
	[0070.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a
	[0070.112] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.113] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.114] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.114] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.114] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.116] GetFileType (hFile=0x23c) returned 0x1
	[0070.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.116] GetFileType (hFile=0x23c) returned 0x1
	[0070.117] WriteFile (in: hFile=0x23c, lpBuffer=0x2605858*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2605858*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.119] CloseHandle (hObject=0x23c) returned 1
	[0070.120] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0070.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi", lpFilePart=0x0) returned 0x89
	[0070.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a
	[0070.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.122] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.123] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.123] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.124] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi", lpFilePart=0x0) returned 0x89
	[0070.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a
	[0070.125] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.126] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.127] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.127] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.128] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.129] GetFileType (hFile=0x23c) returned 0x1
	[0070.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.130] GetFileType (hFile=0x23c) returned 0x1
	[0070.130] WriteFile (in: hFile=0x23c, lpBuffer=0x260af1c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x260af1c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.133] CloseHandle (hObject=0x23c) returned 1
	[0070.134] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0070.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu", lpFilePart=0x0) returned 0x89
	[0070.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a
	[0070.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.139] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.140] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.140] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.141] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu", lpFilePart=0x0) returned 0x89
	[0070.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a
	[0070.142] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.142] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.144] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.144] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.145] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.146] GetFileType (hFile=0x23c) returned 0x1
	[0070.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.147] GetFileType (hFile=0x23c) returned 0x1
	[0070.147] WriteFile (in: hFile=0x23c, lpBuffer=0x26105e0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26105e0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.150] CloseHandle (hObject=0x23c) returned 1
	[0070.150] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0070.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id", lpFilePart=0x0) returned 0x89
	[0070.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a
	[0070.151] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.153] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.153] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.153] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.154] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id", lpFilePart=0x0) returned 0x89
	[0070.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a
	[0070.155] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.156] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.157] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.158] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.158] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.160] GetFileType (hFile=0x23c) returned 0x1
	[0070.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.160] GetFileType (hFile=0x23c) returned 0x1
	[0070.160] WriteFile (in: hFile=0x23c, lpBuffer=0x2615ca4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2615ca4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.163] CloseHandle (hObject=0x23c) returned 1
	[0070.164] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0070.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it", lpFilePart=0x0) returned 0x89
	[0070.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a
	[0070.165] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.167] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.168] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.168] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.169] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it", lpFilePart=0x0) returned 0x89
	[0070.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a
	[0070.170] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.170] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.171] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.172] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.172] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.174] GetFileType (hFile=0x23c) returned 0x1
	[0070.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.174] GetFileType (hFile=0x23c) returned 0x1
	[0070.175] WriteFile (in: hFile=0x23c, lpBuffer=0x261b368*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x261b368*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.178] CloseHandle (hObject=0x23c) returned 1
	[0070.178] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0070.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja", lpFilePart=0x0) returned 0x89
	[0070.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a
	[0070.180] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.180] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.181] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.181] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.182] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja", lpFilePart=0x0) returned 0x89
	[0070.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a
	[0070.183] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.183] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.184] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.185] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.185] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.187] GetFileType (hFile=0x23c) returned 0x1
	[0070.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.187] GetFileType (hFile=0x23c) returned 0x1
	[0070.188] WriteFile (in: hFile=0x23c, lpBuffer=0x2620a2c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2620a2c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.192] CloseHandle (hObject=0x23c) returned 1
	[0070.192] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0070.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko", lpFilePart=0x0) returned 0x89
	[0070.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a
	[0070.193] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.195] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.196] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.196] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.197] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko", lpFilePart=0x0) returned 0x89
	[0070.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a
	[0070.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.198] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.199] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.200] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.200] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.201] GetFileType (hFile=0x23c) returned 0x1
	[0070.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.202] GetFileType (hFile=0x23c) returned 0x1
	[0070.202] WriteFile (in: hFile=0x23c, lpBuffer=0x26260f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26260f0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.234] CloseHandle (hObject=0x23c) returned 1
	[0070.235] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0070.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt", lpFilePart=0x0) returned 0x89
	[0070.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a
	[0070.235] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.236] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.237] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.238] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.238] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt", lpFilePart=0x0) returned 0x89
	[0070.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a
	[0070.239] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.239] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.240] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.240] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.241] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.242] GetFileType (hFile=0x23c) returned 0x1
	[0070.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.242] GetFileType (hFile=0x23c) returned 0x1
	[0070.242] WriteFile (in: hFile=0x23c, lpBuffer=0x262b7b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x262b7b4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.248] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0070.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv", lpFilePart=0x0) returned 0x89
	[0070.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a
	[0070.249] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.251] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.252] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.253] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.253] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv", lpFilePart=0x0) returned 0x89
	[0070.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a
	[0070.254] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.254] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.255] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.255] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.255] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.256] GetFileType (hFile=0x23c) returned 0x1
	[0070.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.257] GetFileType (hFile=0x23c) returned 0x1
	[0070.257] WriteFile (in: hFile=0x23c, lpBuffer=0x2630e78*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2630e78*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.260] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1
	[0070.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", lpFilePart=0x0) returned 0x89
	[0070.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a
	[0070.260] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.261] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.262] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.262] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.263] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", lpFilePart=0x0) returned 0x89
	[0070.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a
	[0070.264] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.264] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.265] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.266] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.266] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.267] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.267] GetFileType (hFile=0x23c) returned 0x1
	[0070.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.267] GetFileType (hFile=0x23c) returned 0x1
	[0070.268] WriteFile (in: hFile=0x23c, lpBuffer=0x263653c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x263653c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.270] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0070.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x89
	[0070.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a
	[0070.271] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.276] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.276] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.277] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.277] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x89
	[0070.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a
	[0070.278] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.279] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.279] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.280] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.280] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.281] GetFileType (hFile=0x23c) returned 0x1
	[0070.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.282] GetFileType (hFile=0x23c) returned 0x1
	[0070.282] WriteFile (in: hFile=0x23c, lpBuffer=0x263bc00*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x263bc00*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.285] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0070.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", lpFilePart=0x0) returned 0x89
	[0070.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a
	[0070.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.286] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.287] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.287] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.287] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", lpFilePart=0x0) returned 0x89
	[0070.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a
	[0070.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.289] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.289] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.289] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.290] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.291] GetFileType (hFile=0x23c) returned 0x1
	[0070.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.291] GetFileType (hFile=0x23c) returned 0x1
	[0070.291] WriteFile (in: hFile=0x23c, lpBuffer=0x26412c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26412c4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.294] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0070.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x89
	[0070.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a
	[0070.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.297] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.298] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.298] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.298] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x89
	[0070.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a
	[0070.299] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.300] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.300] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.301] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.301] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.302] GetFileType (hFile=0x23c) returned 0x1
	[0070.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.302] GetFileType (hFile=0x23c) returned 0x1
	[0070.303] WriteFile (in: hFile=0x23c, lpBuffer=0x2646988*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2646988*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.306] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0070.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c
	[0070.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d
	[0070.306] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.307] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.307] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.308] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.308] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c
	[0070.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d
	[0070.309] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.309] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.310] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.310] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.310] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0070.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.312] GetFileType (hFile=0x23c) returned 0x1
	[0070.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.312] GetFileType (hFile=0x23c) returned 0x1
	[0070.313] WriteFile (in: hFile=0x23c, lpBuffer=0x264c150*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x264c150*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.316] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0070.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c
	[0070.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d
	[0070.316] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.318] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.318] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.319] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.319] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c
	[0070.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d
	[0070.320] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.321] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.321] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.321] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.322] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0070.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.323] GetFileType (hFile=0x23c) returned 0x1
	[0070.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.323] GetFileType (hFile=0x23c) returned 0x1
	[0070.323] WriteFile (in: hFile=0x23c, lpBuffer=0x2651918*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2651918*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.329] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0070.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x89
	[0070.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a
	[0070.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.330] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.331] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.331] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.331] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x89
	[0070.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a
	[0070.332] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.333] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.333] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.333] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.334] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.335] GetFileType (hFile=0x23c) returned 0x1
	[0070.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.335] GetFileType (hFile=0x23c) returned 0x1
	[0070.335] WriteFile (in: hFile=0x23c, lpBuffer=0x2656fdc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2656fdc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.338] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0070.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru", lpFilePart=0x0) returned 0x89
	[0070.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8a
	[0070.339] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.341] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.341] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.342] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.342] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru", lpFilePart=0x0) returned 0x89
	[0070.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8a
	[0070.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.343] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.344] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.344] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.345] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.346] GetFileType (hFile=0x23c) returned 0x1
	[0070.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.346] GetFileType (hFile=0x23c) returned 0x1
	[0070.346] WriteFile (in: hFile=0x23c, lpBuffer=0x265c6a0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x265c6a0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.350] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0070.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk", lpFilePart=0x0) returned 0x89
	[0070.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8a
	[0070.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.351] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.352] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.352] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.352] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk", lpFilePart=0x0) returned 0x89
	[0070.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8a
	[0070.353] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.354] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.354] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.354] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.355] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.356] GetFileType (hFile=0x23c) returned 0x1
	[0070.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.356] GetFileType (hFile=0x23c) returned 0x1
	[0070.357] WriteFile (in: hFile=0x23c, lpBuffer=0x2661d64*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2661d64*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.360] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0070.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl", lpFilePart=0x0) returned 0x89
	[0070.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8a
	[0070.360] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.367] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.368] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.368] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.369] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl", lpFilePart=0x0) returned 0x89
	[0070.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8a
	[0070.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.370] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.371] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.371] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.371] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.373] GetFileType (hFile=0x23c) returned 0x1
	[0070.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.374] GetFileType (hFile=0x23c) returned 0x1
	[0070.374] WriteFile (in: hFile=0x23c, lpBuffer=0x2667428*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2667428*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.378] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0070.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr", lpFilePart=0x0) returned 0x89
	[0070.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a
	[0070.379] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.379] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.379] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.380] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.380] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr", lpFilePart=0x0) returned 0x89
	[0070.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a
	[0070.381] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.381] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.382] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.382] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.382] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.383] GetFileType (hFile=0x23c) returned 0x1
	[0070.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.383] GetFileType (hFile=0x23c) returned 0x1
	[0070.384] WriteFile (in: hFile=0x23c, lpBuffer=0x266caec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x266caec*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.387] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0070.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv", lpFilePart=0x0) returned 0x89
	[0070.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8a
	[0070.387] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.389] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.390] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.391] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.391] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv", lpFilePart=0x0) returned 0x89
	[0070.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8a
	[0070.392] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.392] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.393] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.393] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.393] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.395] GetFileType (hFile=0x23c) returned 0x1
	[0070.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.395] GetFileType (hFile=0x23c) returned 0x1
	[0070.395] WriteFile (in: hFile=0x23c, lpBuffer=0x26721b0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26721b0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.398] CloseHandle (hObject=0x23c) returned 1
	[0070.398] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0070.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th", lpFilePart=0x0) returned 0x89
	[0070.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a
	[0070.399] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.401] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.401] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.402] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.402] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th", lpFilePart=0x0) returned 0x89
	[0070.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a
	[0070.403] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.404] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.404] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.405] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.405] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.407] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.408] GetFileType (hFile=0x23c) returned 0x1
	[0070.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.408] GetFileType (hFile=0x23c) returned 0x1
	[0070.408] WriteFile (in: hFile=0x23c, lpBuffer=0x2677874*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2677874*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.412] CloseHandle (hObject=0x23c) returned 1
	[0070.412] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0070.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr", lpFilePart=0x0) returned 0x89
	[0070.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a
	[0070.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.415] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.416] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.416] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.417] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr", lpFilePart=0x0) returned 0x89
	[0070.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a
	[0070.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.418] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.419] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.419] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.420] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.477] GetFileType (hFile=0x23c) returned 0x1
	[0070.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.483] GetFileType (hFile=0x23c) returned 0x1
	[0070.483] WriteFile (in: hFile=0x23c, lpBuffer=0x267cf38*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x267cf38*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.486] CloseHandle (hObject=0x23c) returned 1
	[0070.487] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0070.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk", lpFilePart=0x0) returned 0x89
	[0070.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a
	[0070.488] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.489] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.490] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.491] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.491] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk", lpFilePart=0x0) returned 0x89
	[0070.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a
	[0070.493] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.493] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.494] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.494] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.495] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.497] GetFileType (hFile=0x23c) returned 0x1
	[0070.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.497] GetFileType (hFile=0x23c) returned 0x1
	[0070.498] WriteFile (in: hFile=0x23c, lpBuffer=0x26825fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26825fc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.502] CloseHandle (hObject=0x23c) returned 1
	[0070.502] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0070.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi", lpFilePart=0x0) returned 0x89
	[0070.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a
	[0070.503] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.506] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.506] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.507] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.507] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi", lpFilePart=0x0) returned 0x89
	[0070.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a
	[0070.508] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.509] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.510] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.510] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.510] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0070.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.512] GetFileType (hFile=0x23c) returned 0x1
	[0070.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.513] GetFileType (hFile=0x23c) returned 0x1
	[0070.513] WriteFile (in: hFile=0x23c, lpBuffer=0x2687cc0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2687cc0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.517] CloseHandle (hObject=0x23c) returned 1
	[0070.517] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1
	[0070.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c
	[0070.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d
	[0070.518] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.519] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.520] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.521] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.521] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c
	[0070.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d
	[0070.522] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.523] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.524] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.524] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.524] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0070.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.526] GetFileType (hFile=0x23c) returned 0x1
	[0070.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.527] GetFileType (hFile=0x23c) returned 0x1
	[0070.527] WriteFile (in: hFile=0x23c, lpBuffer=0x268d488*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x268d488*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.531] CloseHandle (hObject=0x23c) returned 1
	[0070.532] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0070.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c
	[0070.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d
	[0070.533] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.536] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.537] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.537] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0070.538] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c
	[0070.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d
	[0070.539] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0070.539] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.540] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0070.541] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.541] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0070.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0070.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0070.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0070.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0070.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0070.543] GetFileType (hFile=0x23c) returned 0x1
	[0070.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0070.543] GetFileType (hFile=0x23c) returned 0x1
	[0070.543] WriteFile (in: hFile=0x23c, lpBuffer=0x2692c50*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2692c50*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0070.547] CloseHandle (hObject=0x23c) returned 1
	[0070.547] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.548] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0070.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0070.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0070.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0070.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales", lpFilePart=0x0) returned 0x86
	[0070.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\", lpFilePart=0x0) returned 0x87
	[0070.549] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0070.549] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.550] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa6e1ff0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa6e1ff0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0070.550] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa708150, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa708150, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0070.551] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa708150, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa708150, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0070.551] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa838c50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa838c50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0070.552] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa85edb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa85edb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0070.552] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa884f10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa884f10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0070.553] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa8ab070, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa8ab070, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0070.553] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa8d11d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa8d11d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1
	[0070.554] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa8f7330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa8f7330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1
	[0070.554] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa91d490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa91d490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0070.555] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa91d490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa91d490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1
	[0070.555] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa9435f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa9435f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0070.556] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa98f8b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa98f8b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0070.556] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfaba4bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfaba4bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0070.557] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfabcad50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfabcad50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0070.557] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfac3d170, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfac3d170, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0070.558] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfac632d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfac632d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0070.558] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfac89430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfac89430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0070.559] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfacaf590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfacaf590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0070.560] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfacd56f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfacd56f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0070.560] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfacd56f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfacd56f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0070.561] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfacfb850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfacfb850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0070.561] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfad6dc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfad6dc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0070.563] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfad93dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfad93dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0070.563] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfadb9f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfadb9f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1
	[0070.564] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfade0090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfade0090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0070.564] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfade0090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfade0090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0070.565] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfae061f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfae061f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0070.565] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfae061f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfae061f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0070.566] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfae2c350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfae2c350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0070.566] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfae524b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfae524b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0070.567] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfae78610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfae78610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0070.567] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfae78610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfae78610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0070.567] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfae9e770, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfae9e770, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0070.568] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfaec48d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfaec48d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0070.568] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfaeeaa30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfaeeaa30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0070.569] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfaf10b90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfaf10b90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0070.569] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfaf10b90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfaf10b90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0070.573] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0070.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0070.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0070.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\Decrypt.txt", lpFilePart=0x0) returned 0x92
	[0070.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0070.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0070.576] GetFileType (hFile=0x238) returned 0x1
	[0070.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0070.576] GetFileType (hFile=0x238) returned 0x1
	[0070.576] WriteFile (in: hFile=0x238, lpBuffer=0x269cab0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x269cab0*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0070.579] CloseHandle (hObject=0x238) returned 1
	[0070.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0070.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata", lpFilePart=0x0) returned 0x87
	[0070.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\", lpFilePart=0x0) returned 0x88
	[0070.581] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0070.585] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0070.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0070.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata", lpFilePart=0x0) returned 0x87
	[0070.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\", lpFilePart=0x0) returned 0x88
	[0070.586] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0070.588] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0070.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\Decrypt.txt", lpFilePart=0x0) returned 0x93
	[0070.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0070.596] GetFileType (hFile=0x238) returned 0x1
	[0070.596] GetFileType (hFile=0x238) returned 0x1
	[0070.603] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0070.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0", lpFilePart=0x0) returned 0x7d
	[0070.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\", lpFilePart=0x0) returned 0x7e
	[0070.604] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0070.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", lpFilePart=0x0) returned 0x8a
	[0070.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0070.606] GetFileType (hFile=0x238) returned 0x1
	[0070.606] GetFileType (hFile=0x238) returned 0x1
	[0070.606] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0xd47
	[0070.607] ReadFile (in: hFile=0x238, lpBuffer=0x26a6194, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x26a6194*, lpNumberOfBytesRead=0x26eac4*=0xd47, lpOverlapped=0x0) returned 1
	[0070.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.KEKW", lpFilePart=0x0) returned 0x8f
	[0070.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0070.613] GetFileType (hFile=0x238) returned 0x1
	[0070.614] GetFileType (hFile=0x238) returned 0x1
	[0070.615] WriteFile (in: hFile=0x238, lpBuffer=0x26a8a28*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x26a8a28*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0070.618] CloseHandle (hObject=0x238) returned 1
	[0070.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", lpFilePart=0x0) returned 0x8a
	[0070.619] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 1
	[0070.623] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84239770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_16.png", cAlternateFileName="")) returned 1
	[0070.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", lpFilePart=0x0) returned 0x89
	[0070.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0070.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0070.624] GetFileType (hFile=0x238) returned 0x1
	[0070.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0070.625] GetFileType (hFile=0x238) returned 0x1
	[0070.625] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x9d
	[0070.625] ReadFile (in: hFile=0x238, lpBuffer=0x26aa3fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x26aa3fc*, lpNumberOfBytesRead=0x26eac4*=0x9d, lpOverlapped=0x0) returned 1
	[0070.628] CloseHandle (hObject=0x238) returned 1
	[0070.629] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.KEKW", lpFilePart=0x0) returned 0x8e
	[0070.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0070.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0070.630] GetFileType (hFile=0x238) returned 0x1
	[0070.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0070.630] GetFileType (hFile=0x238) returned 0x1
	[0070.631] WriteFile (in: hFile=0x238, lpBuffer=0x26acc14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x26acc14*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0070.634] CloseHandle (hObject=0x238) returned 1
	[0070.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", lpFilePart=0x0) returned 0x89
	[0070.635] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 1
	[0070.638] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8423be80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8423e590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1
	[0070.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", lpFilePart=0x0) returned 0x87
	[0070.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0070.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0070.640] GetFileType (hFile=0x238) returned 0x1
	[0070.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0070.640] GetFileType (hFile=0x238) returned 0x1
	[0070.640] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x5c
	[0070.641] ReadFile (in: hFile=0x238, lpBuffer=0x26ae5ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x26ae5ac*, lpNumberOfBytesRead=0x26eac4*=0x5c, lpOverlapped=0x0) returned 1
	[0070.644] CloseHandle (hObject=0x238) returned 1
	[0070.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.KEKW", lpFilePart=0x0) returned 0x8c
	[0070.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0070.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0070.645] GetFileType (hFile=0x238) returned 0x1
	[0070.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0070.646] GetFileType (hFile=0x238) returned 0x1
	[0070.646] WriteFile (in: hFile=0x238, lpBuffer=0x26b0db8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x26b0db8*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0070.649] CloseHandle (hObject=0x238) returned 1
	[0070.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", lpFilePart=0x0) returned 0x87
	[0070.650] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html")) returned 1
	[0070.654] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84240ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84240ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.js", cAlternateFileName="")) returned 1
	[0070.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", lpFilePart=0x0) returned 0x85
	[0070.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0070.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0070.655] GetFileType (hFile=0x238) returned 0x1
	[0070.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0070.657] GetFileType (hFile=0x238) returned 0x1
	[0070.657] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x5f
	[0070.658] ReadFile (in: hFile=0x238, lpBuffer=0x26b2708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x26b2708*, lpNumberOfBytesRead=0x26eac4*=0x5f, lpOverlapped=0x0) returned 1
	[0070.661] CloseHandle (hObject=0x238) returned 1
	[0070.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.KEKW", lpFilePart=0x0) returned 0x8a
	[0070.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0070.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0070.663] GetFileType (hFile=0x238) returned 0x1
	[0070.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0070.663] GetFileType (hFile=0x238) returned 0x1
	[0070.664] WriteFile (in: hFile=0x238, lpBuffer=0x26b4f08*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x26b4f08*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0070.667] CloseHandle (hObject=0x238) returned 1
	[0070.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", lpFilePart=0x0) returned 0x85
	[0070.669] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js")) returned 1
	[0070.672] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x840205b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84245ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844aa770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0070.672] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb08d950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb08d950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0070.673] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb0d9c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb0d9c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0070.674] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb0d9c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb0d9c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0
	[0070.674] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0070.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0070.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0070.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\Decrypt.txt", lpFilePart=0x0) returned 0x89
	[0070.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0070.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0070.676] GetFileType (hFile=0x234) returned 0x1
	[0070.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0070.676] GetFileType (hFile=0x234) returned 0x1
	[0070.677] WriteFile (in: hFile=0x234, lpBuffer=0x26b8388*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x26b8388*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0070.680] CloseHandle (hObject=0x234) returned 1
	[0070.681] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0070.681] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0070.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0070.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0070.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0070.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap", lpFilePart=0x0) returned 0x77
	[0070.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\", lpFilePart=0x0) returned 0x78
	[0070.684] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0070.685] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.686] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb1982f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb1982f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 1
	[0070.686] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb1982f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb1982f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 0
	[0070.687] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0070.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0070.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0070.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\Decrypt.txt", lpFilePart=0x0) returned 0x83
	[0070.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0070.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0070.688] GetFileType (hFile=0x230) returned 0x1
	[0070.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0070.688] GetFileType (hFile=0x230) returned 0x1
	[0070.689] WriteFile (in: hFile=0x230, lpBuffer=0x26bbcac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x26bbcac*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0070.692] CloseHandle (hObject=0x230) returned 1
	[0070.693] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1
	[0070.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0070.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpFilePart=0x0) returned 0x77
	[0070.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", lpFilePart=0x0) returned 0x78
	[0070.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0070.705] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.706] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4_0", cAlternateFileName="")) returned 1
	[0070.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0070.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", lpFilePart=0x0) returned 0x7d
	[0070.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\", lpFilePart=0x0) returned 0x7e
	[0070.706] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0070.712] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0070.713] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1
	[0070.713] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x0, dwReserved1=0x0, cFileName="contentscript_bin_prod.js", cAlternateFileName="CONTEN~1.JS")) returned 1
	[0070.714] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x0, cFileName="dasherSettingSchema.json", cAlternateFileName="DASHER~1.JSO")) returned 1
	[0070.715] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="eventpage_bin_prod.js", cAlternateFileName="EVENTP~1.JS")) returned 1
	[0070.715] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0070.716] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="page_embed_script.js", cAlternateFileName="PAGE_E~1.JS")) returned 1
	[0070.717] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0070.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0070.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", lpFilePart=0x0) returned 0x86
	[0070.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\", lpFilePart=0x0) returned 0x87
	[0070.718] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0071.056] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.065] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="af", cAlternateFileName="")) returned 1
	[0071.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", lpFilePart=0x0) returned 0x89
	[0071.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\", lpFilePart=0x0) returned 0x8a
	[0071.066] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.069] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.070] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.070] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.071] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", lpFilePart=0x0) returned 0x89
	[0071.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\", lpFilePart=0x0) returned 0x8a
	[0071.072] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.073] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.074] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.074] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.075] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.077] GetFileType (hFile=0x23c) returned 0x1
	[0071.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.078] GetFileType (hFile=0x23c) returned 0x1
	[0071.078] WriteFile (in: hFile=0x23c, lpBuffer=0x26c5b68*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26c5b68*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.081] CloseHandle (hObject=0x23c) returned 1
	[0071.082] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1
	[0071.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", lpFilePart=0x0) returned 0x89
	[0071.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\", lpFilePart=0x0) returned 0x8a
	[0071.083] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.084] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.085] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.085] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.086] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", lpFilePart=0x0) returned 0x89
	[0071.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\", lpFilePart=0x0) returned 0x8a
	[0071.087] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.087] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.088] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.088] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.089] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.090] GetFileType (hFile=0x23c) returned 0x1
	[0071.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.090] GetFileType (hFile=0x23c) returned 0x1
	[0071.091] WriteFile (in: hFile=0x23c, lpBuffer=0x26cb22c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26cb22c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.094] CloseHandle (hObject=0x23c) returned 1
	[0071.095] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0071.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.096] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", lpFilePart=0x0) returned 0x89
	[0071.096] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a
	[0071.096] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.098] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.099] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.099] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.100] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", lpFilePart=0x0) returned 0x89
	[0071.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a
	[0071.101] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.101] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.102] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.103] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.103] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.104] GetFileType (hFile=0x23c) returned 0x1
	[0071.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.105] GetFileType (hFile=0x23c) returned 0x1
	[0071.105] WriteFile (in: hFile=0x23c, lpBuffer=0x26d08f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26d08f0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.109] CloseHandle (hObject=0x23c) returned 1
	[0071.110] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="az", cAlternateFileName="")) returned 1
	[0071.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", lpFilePart=0x0) returned 0x89
	[0071.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\", lpFilePart=0x0) returned 0x8a
	[0071.111] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.111] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.112] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.112] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.113] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", lpFilePart=0x0) returned 0x89
	[0071.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\", lpFilePart=0x0) returned 0x8a
	[0071.114] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.115] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.116] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.116] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.116] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.120] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.121] GetFileType (hFile=0x23c) returned 0x1
	[0071.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.121] GetFileType (hFile=0x23c) returned 0x1
	[0071.121] WriteFile (in: hFile=0x23c, lpBuffer=0x26d5fb4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26d5fb4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.126] CloseHandle (hObject=0x23c) returned 1
	[0071.126] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0071.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", lpFilePart=0x0) returned 0x89
	[0071.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a
	[0071.127] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.129] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.130] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.130] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.131] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", lpFilePart=0x0) returned 0x89
	[0071.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a
	[0071.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.133] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.133] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.134] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.134] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.136] GetFileType (hFile=0x23c) returned 0x1
	[0071.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.136] GetFileType (hFile=0x23c) returned 0x1
	[0071.136] WriteFile (in: hFile=0x23c, lpBuffer=0x26db678*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26db678*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.141] CloseHandle (hObject=0x23c) returned 1
	[0071.142] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1
	[0071.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", lpFilePart=0x0) returned 0x89
	[0071.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\", lpFilePart=0x0) returned 0x8a
	[0071.143] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.143] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.144] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.145] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.145] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", lpFilePart=0x0) returned 0x89
	[0071.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\", lpFilePart=0x0) returned 0x8a
	[0071.146] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.147] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.147] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.148] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.148] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.149] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.150] GetFileType (hFile=0x23c) returned 0x1
	[0071.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.150] GetFileType (hFile=0x23c) returned 0x1
	[0071.150] WriteFile (in: hFile=0x23c, lpBuffer=0x26e0d3c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26e0d3c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.158] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0071.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", lpFilePart=0x0) returned 0x89
	[0071.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a
	[0071.159] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.161] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.162] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.162] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.163] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", lpFilePart=0x0) returned 0x89
	[0071.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a
	[0071.164] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.164] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.165] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.165] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.165] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.167] GetFileType (hFile=0x23c) returned 0x1
	[0071.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.167] GetFileType (hFile=0x23c) returned 0x1
	[0071.167] WriteFile (in: hFile=0x23c, lpBuffer=0x26e6400*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26e6400*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.170] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0071.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", lpFilePart=0x0) returned 0x89
	[0071.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a
	[0071.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.172] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.173] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.173] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.173] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", lpFilePart=0x0) returned 0x89
	[0071.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a
	[0071.174] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.175] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.175] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.176] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.176] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.178] GetFileType (hFile=0x23c) returned 0x1
	[0071.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.178] GetFileType (hFile=0x23c) returned 0x1
	[0071.178] WriteFile (in: hFile=0x23c, lpBuffer=0x26ebac4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26ebac4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.181] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0071.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", lpFilePart=0x0) returned 0x89
	[0071.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a
	[0071.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.187] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.187] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.188] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.188] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", lpFilePart=0x0) returned 0x89
	[0071.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a
	[0071.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.190] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.190] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.191] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.191] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.192] GetFileType (hFile=0x23c) returned 0x1
	[0071.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.192] GetFileType (hFile=0x23c) returned 0x1
	[0071.193] WriteFile (in: hFile=0x23c, lpBuffer=0x26f1188*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26f1188*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.195] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0071.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", lpFilePart=0x0) returned 0x89
	[0071.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a
	[0071.196] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.197] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.198] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.198] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.199] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", lpFilePart=0x0) returned 0x89
	[0071.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a
	[0071.200] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.200] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.201] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.202] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.202] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.203] GetFileType (hFile=0x23c) returned 0x1
	[0071.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.204] GetFileType (hFile=0x23c) returned 0x1
	[0071.204] WriteFile (in: hFile=0x23c, lpBuffer=0x26f684c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26f684c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.207] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0071.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", lpFilePart=0x0) returned 0x89
	[0071.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a
	[0071.207] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.210] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.210] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.211] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.211] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", lpFilePart=0x0) returned 0x89
	[0071.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a
	[0071.212] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.213] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.213] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.214] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.214] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.215] GetFileType (hFile=0x23c) returned 0x1
	[0071.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.215] GetFileType (hFile=0x23c) returned 0x1
	[0071.215] WriteFile (in: hFile=0x23c, lpBuffer=0x26fbf10*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26fbf10*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.219] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1
	[0071.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c
	[0071.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d
	[0071.219] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.220] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.221] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.221] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.222] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c
	[0071.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d
	[0071.223] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.223] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.223] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.224] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.224] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0071.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.225] GetFileType (hFile=0x23c) returned 0x1
	[0071.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.226] GetFileType (hFile=0x23c) returned 0x1
	[0071.226] WriteFile (in: hFile=0x23c, lpBuffer=0x27016d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27016d8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.229] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1
	[0071.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c
	[0071.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d
	[0071.229] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.232] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.232] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.233] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.233] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c
	[0071.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d
	[0071.234] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.234] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.234] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.235] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.235] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0071.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.236] GetFileType (hFile=0x23c) returned 0x1
	[0071.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.237] GetFileType (hFile=0x23c) returned 0x1
	[0071.237] WriteFile (in: hFile=0x23c, lpBuffer=0x2706ea0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2706ea0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.240] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0071.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", lpFilePart=0x0) returned 0x89
	[0071.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a
	[0071.241] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.242] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.242] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.242] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.243] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", lpFilePart=0x0) returned 0x89
	[0071.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a
	[0071.244] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.244] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.245] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.245] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.245] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.246] GetFileType (hFile=0x23c) returned 0x1
	[0071.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.247] GetFileType (hFile=0x23c) returned 0x1
	[0071.247] WriteFile (in: hFile=0x23c, lpBuffer=0x270c564*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x270c564*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.251] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1
	[0071.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d
	[0071.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e
	[0071.251] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.253] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.254] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.254] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.254] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d
	[0071.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e
	[0071.255] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.256] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.256] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.257] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.257] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0071.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.258] GetFileType (hFile=0x23c) returned 0x1
	[0071.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.259] GetFileType (hFile=0x23c) returned 0x1
	[0071.259] WriteFile (in: hFile=0x23c, lpBuffer=0x2711d58*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2711d58*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.262] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0071.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", lpFilePart=0x0) returned 0x89
	[0071.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a
	[0071.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.264] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.264] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.264] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.265] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", lpFilePart=0x0) returned 0x89
	[0071.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a
	[0071.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.266] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.267] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.267] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.267] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.268] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.268] GetFileType (hFile=0x23c) returned 0x1
	[0071.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.269] GetFileType (hFile=0x23c) returned 0x1
	[0071.269] WriteFile (in: hFile=0x23c, lpBuffer=0x271741c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x271741c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.274] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1
	[0071.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", lpFilePart=0x0) returned 0x89
	[0071.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\", lpFilePart=0x0) returned 0x8a
	[0071.275] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.277] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.277] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.278] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.278] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", lpFilePart=0x0) returned 0x89
	[0071.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\", lpFilePart=0x0) returned 0x8a
	[0071.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.280] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.280] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.281] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.281] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.282] GetFileType (hFile=0x23c) returned 0x1
	[0071.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.283] GetFileType (hFile=0x23c) returned 0x1
	[0071.283] WriteFile (in: hFile=0x23c, lpBuffer=0x271cae0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x271cae0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.286] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1
	[0071.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", lpFilePart=0x0) returned 0x89
	[0071.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\", lpFilePart=0x0) returned 0x8a
	[0071.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.287] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.288] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.288] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.289] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", lpFilePart=0x0) returned 0x89
	[0071.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\", lpFilePart=0x0) returned 0x8a
	[0071.290] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.290] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.291] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.291] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.291] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.292] GetFileType (hFile=0x23c) returned 0x1
	[0071.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.292] GetFileType (hFile=0x23c) returned 0x1
	[0071.293] WriteFile (in: hFile=0x23c, lpBuffer=0x27221a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27221a4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.296] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0071.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", lpFilePart=0x0) returned 0x89
	[0071.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a
	[0071.297] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.299] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.300] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.300] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.300] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", lpFilePart=0x0) returned 0x89
	[0071.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a
	[0071.301] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.302] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.302] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.303] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.303] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.304] GetFileType (hFile=0x23c) returned 0x1
	[0071.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.304] GetFileType (hFile=0x23c) returned 0x1
	[0071.305] WriteFile (in: hFile=0x23c, lpBuffer=0x2727868*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2727868*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.308] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0071.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a
	[0071.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b
	[0071.308] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.309] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.309] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.310] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.310] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a
	[0071.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b
	[0071.311] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.312] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.312] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.312] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.312] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0071.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.313] GetFileType (hFile=0x23c) returned 0x1
	[0071.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.314] GetFileType (hFile=0x23c) returned 0x1
	[0071.318] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0071.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", lpFilePart=0x0) returned 0x89
	[0071.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a
	[0071.318] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.320] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.320] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.320] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.321] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", lpFilePart=0x0) returned 0x89
	[0071.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a
	[0071.321] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.322] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.322] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.322] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.322] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.323] GetFileType (hFile=0x23c) returned 0x1
	[0071.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.324] GetFileType (hFile=0x23c) returned 0x1
	[0071.327] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_CA", cAlternateFileName="")) returned 1
	[0071.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", lpFilePart=0x0) returned 0x8c
	[0071.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\", lpFilePart=0x0) returned 0x8d
	[0071.328] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.330] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.330] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.330] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.330] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", lpFilePart=0x0) returned 0x8c
	[0071.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\", lpFilePart=0x0) returned 0x8d
	[0071.331] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.332] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.332] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.332] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.332] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0071.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.334] GetFileType (hFile=0x23c) returned 0x1
	[0071.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.334] GetFileType (hFile=0x23c) returned 0x1
	[0071.337] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1
	[0071.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", lpFilePart=0x0) returned 0x89
	[0071.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\", lpFilePart=0x0) returned 0x8a
	[0071.337] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.338] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.338] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.338] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.338] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", lpFilePart=0x0) returned 0x89
	[0071.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\", lpFilePart=0x0) returned 0x8a
	[0071.339] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.339] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.339] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.340] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.340] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.341] GetFileType (hFile=0x23c) returned 0x1
	[0071.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.341] GetFileType (hFile=0x23c) returned 0x1
	[0071.346] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1
	[0071.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", lpFilePart=0x0) returned 0x89
	[0071.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\", lpFilePart=0x0) returned 0x8a
	[0071.346] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.348] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.348] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.348] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.349] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", lpFilePart=0x0) returned 0x89
	[0071.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\", lpFilePart=0x0) returned 0x8a
	[0071.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.350] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.350] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.350] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.350] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.353] GetFileType (hFile=0x23c) returned 0x1
	[0071.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.353] GetFileType (hFile=0x23c) returned 0x1
	[0071.356] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0071.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", lpFilePart=0x0) returned 0x89
	[0071.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a
	[0071.356] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.357] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.357] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.357] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.357] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", lpFilePart=0x0) returned 0x89
	[0071.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a
	[0071.358] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.358] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.359] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.359] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.359] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.360] GetFileType (hFile=0x23c) returned 0x1
	[0071.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.360] GetFileType (hFile=0x23c) returned 0x1
	[0071.363] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0071.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", lpFilePart=0x0) returned 0x89
	[0071.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8a
	[0071.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.366] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.366] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.366] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.366] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", lpFilePart=0x0) returned 0x89
	[0071.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8a
	[0071.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.367] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.367] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.368] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.368] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.369] GetFileType (hFile=0x23c) returned 0x1
	[0071.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.369] GetFileType (hFile=0x23c) returned 0x1
	[0071.373] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0071.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", lpFilePart=0x0) returned 0x89
	[0071.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a
	[0071.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.375] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.375] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.375] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.375] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", lpFilePart=0x0) returned 0x89
	[0071.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a
	[0071.376] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.376] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.377] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.377] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.377] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.378] GetFileType (hFile=0x23c) returned 0x1
	[0071.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.379] GetFileType (hFile=0x23c) returned 0x1
	[0071.382] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hy", cAlternateFileName="")) returned 1
	[0071.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", lpFilePart=0x0) returned 0x89
	[0071.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\", lpFilePart=0x0) returned 0x8a
	[0071.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.384] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.385] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.385] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.385] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", lpFilePart=0x0) returned 0x89
	[0071.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\", lpFilePart=0x0) returned 0x8a
	[0071.386] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.386] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.386] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.386] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.387] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.387] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.388] GetFileType (hFile=0x23c) returned 0x1
	[0071.389] GetFileType (hFile=0x23c) returned 0x1
	[0071.392] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0071.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", lpFilePart=0x0) returned 0x89
	[0071.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a
	[0071.392] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.393] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.393] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.393] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.394] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", lpFilePart=0x0) returned 0x89
	[0071.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a
	[0071.394] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.395] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.395] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.395] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.395] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.396] GetFileType (hFile=0x23c) returned 0x1
	[0071.396] GetFileType (hFile=0x23c) returned 0x1
	[0071.402] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is", cAlternateFileName="")) returned 1
	[0071.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", lpFilePart=0x0) returned 0x89
	[0071.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\", lpFilePart=0x0) returned 0x8a
	[0071.402] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.405] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.405] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.405] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.405] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", lpFilePart=0x0) returned 0x89
	[0071.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\", lpFilePart=0x0) returned 0x8a
	[0071.406] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.406] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.406] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.407] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.407] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.407] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.408] GetFileType (hFile=0x23c) returned 0x1
	[0071.408] GetFileType (hFile=0x23c) returned 0x1
	[0071.413] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0071.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", lpFilePart=0x0) returned 0x89
	[0071.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a
	[0071.414] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.414] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.415] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.415] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.415] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", lpFilePart=0x0) returned 0x89
	[0071.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a
	[0071.415] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.416] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.416] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.416] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.416] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.418] GetFileType (hFile=0x23c) returned 0x1
	[0071.418] GetFileType (hFile=0x23c) returned 0x1
	[0071.504] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1
	[0071.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw", lpFilePart=0x0) returned 0x89
	[0071.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\", lpFilePart=0x0) returned 0x8a
	[0071.504] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.506] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.506] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.507] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.507] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw", lpFilePart=0x0) returned 0x89
	[0071.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\", lpFilePart=0x0) returned 0x8a
	[0071.508] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.508] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.508] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.508] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.508] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.511] GetFileType (hFile=0x23c) returned 0x1
	[0071.511] GetFileType (hFile=0x23c) returned 0x1
	[0071.515] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0071.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja", lpFilePart=0x0) returned 0x89
	[0071.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a
	[0071.515] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.516] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.517] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja", lpFilePart=0x0) returned 0x89
	[0071.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a
	[0071.517] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.518] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.519] GetFileType (hFile=0x23c) returned 0x1
	[0071.519] GetFileType (hFile=0x23c) returned 0x1
	[0071.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka", lpFilePart=0x0) returned 0x89
	[0071.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\", lpFilePart=0x0) returned 0x8a
	[0071.522] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.524] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka", lpFilePart=0x0) returned 0x89
	[0071.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\", lpFilePart=0x0) returned 0x8a
	[0071.524] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.525] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.526] GetFileType (hFile=0x23c) returned 0x1
	[0071.526] GetFileType (hFile=0x23c) returned 0x1
	[0071.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km", lpFilePart=0x0) returned 0x89
	[0071.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\", lpFilePart=0x0) returned 0x8a
	[0071.530] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.530] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km", lpFilePart=0x0) returned 0x89
	[0071.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\", lpFilePart=0x0) returned 0x8a
	[0071.531] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.531] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.532] GetFileType (hFile=0x23c) returned 0x1
	[0071.532] GetFileType (hFile=0x23c) returned 0x1
	[0071.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn", lpFilePart=0x0) returned 0x89
	[0071.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\", lpFilePart=0x0) returned 0x8a
	[0071.535] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.538] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn", lpFilePart=0x0) returned 0x89
	[0071.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\", lpFilePart=0x0) returned 0x8a
	[0071.538] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.539] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.540] GetFileType (hFile=0x23c) returned 0x1
	[0071.540] GetFileType (hFile=0x23c) returned 0x1
	[0071.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko", lpFilePart=0x0) returned 0x89
	[0071.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a
	[0071.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.543] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko", lpFilePart=0x0) returned 0x89
	[0071.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a
	[0071.544] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.545] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.546] GetFileType (hFile=0x23c) returned 0x1
	[0071.546] GetFileType (hFile=0x23c) returned 0x1
	[0071.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo", lpFilePart=0x0) returned 0x89
	[0071.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\", lpFilePart=0x0) returned 0x8a
	[0071.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.552] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo", lpFilePart=0x0) returned 0x89
	[0071.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\", lpFilePart=0x0) returned 0x8a
	[0071.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.553] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.554] GetFileType (hFile=0x23c) returned 0x1
	[0071.554] GetFileType (hFile=0x23c) returned 0x1
	[0071.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt", lpFilePart=0x0) returned 0x89
	[0071.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a
	[0071.560] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.561] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt", lpFilePart=0x0) returned 0x89
	[0071.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a
	[0071.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.562] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.571] GetFileType (hFile=0x23c) returned 0x1
	[0071.571] GetFileType (hFile=0x23c) returned 0x1
	[0071.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv", lpFilePart=0x0) returned 0x89
	[0071.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a
	[0071.574] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.577] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv", lpFilePart=0x0) returned 0x89
	[0071.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a
	[0071.578] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.578] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.579] GetFileType (hFile=0x23c) returned 0x1
	[0071.579] GetFileType (hFile=0x23c) returned 0x1
	[0071.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml", lpFilePart=0x0) returned 0x89
	[0071.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\", lpFilePart=0x0) returned 0x8a
	[0071.582] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.583] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml", lpFilePart=0x0) returned 0x89
	[0071.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\", lpFilePart=0x0) returned 0x8a
	[0071.584] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.584] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.585] GetFileType (hFile=0x23c) returned 0x1
	[0071.585] GetFileType (hFile=0x23c) returned 0x1
	[0071.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn", lpFilePart=0x0) returned 0x89
	[0071.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\", lpFilePart=0x0) returned 0x8a
	[0071.589] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.591] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn", lpFilePart=0x0) returned 0x89
	[0071.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\", lpFilePart=0x0) returned 0x8a
	[0071.592] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.592] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.593] GetFileType (hFile=0x23c) returned 0x1
	[0071.593] GetFileType (hFile=0x23c) returned 0x1
	[0071.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr", lpFilePart=0x0) returned 0x89
	[0071.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\", lpFilePart=0x0) returned 0x8a
	[0071.597] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.597] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr", lpFilePart=0x0) returned 0x89
	[0071.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\", lpFilePart=0x0) returned 0x8a
	[0071.598] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.598] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.599] GetFileType (hFile=0x23c) returned 0x1
	[0071.599] GetFileType (hFile=0x23c) returned 0x1
	[0071.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms", lpFilePart=0x0) returned 0x89
	[0071.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a
	[0071.603] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.603] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms", lpFilePart=0x0) returned 0x89
	[0071.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a
	[0071.604] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.604] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.605] GetFileType (hFile=0x23c) returned 0x1
	[0071.605] GetFileType (hFile=0x23c) returned 0x1
	[0071.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne", lpFilePart=0x0) returned 0x89
	[0071.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\", lpFilePart=0x0) returned 0x8a
	[0071.609] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.611] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne", lpFilePart=0x0) returned 0x89
	[0071.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\", lpFilePart=0x0) returned 0x8a
	[0071.612] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.612] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.613] GetFileType (hFile=0x23c) returned 0x1
	[0071.613] GetFileType (hFile=0x23c) returned 0x1
	[0071.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl", lpFilePart=0x0) returned 0x89
	[0071.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a
	[0071.616] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.618] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl", lpFilePart=0x0) returned 0x89
	[0071.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a
	[0071.619] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.619] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.621] GetFileType (hFile=0x23c) returned 0x1
	[0071.621] GetFileType (hFile=0x23c) returned 0x1
	[0071.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no", lpFilePart=0x0) returned 0x89
	[0071.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a
	[0071.625] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.625] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no", lpFilePart=0x0) returned 0x89
	[0071.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a
	[0071.626] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.626] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.627] GetFileType (hFile=0x23c) returned 0x1
	[0071.627] GetFileType (hFile=0x23c) returned 0x1
	[0071.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl", lpFilePart=0x0) returned 0x89
	[0071.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a
	[0071.631] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.633] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl", lpFilePart=0x0) returned 0x89
	[0071.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a
	[0071.634] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.635] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.636] GetFileType (hFile=0x23c) returned 0x1
	[0071.636] GetFileType (hFile=0x23c) returned 0x1
	[0071.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c
	[0071.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d
	[0071.639] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.640] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c
	[0071.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d
	[0071.641] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.641] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0071.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.642] GetFileType (hFile=0x23c) returned 0x1
	[0071.643] GetFileType (hFile=0x23c) returned 0x1
	[0071.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c
	[0071.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d
	[0071.647] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.648] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c
	[0071.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d
	[0071.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.649] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.651] GetFileType (hFile=0x23c) returned 0x1
	[0071.651] GetFileType (hFile=0x23c) returned 0x1
	[0071.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.659] GetFileType (hFile=0x23c) returned 0x1
	[0071.659] GetFileType (hFile=0x23c) returned 0x1
	[0071.664] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.664] GetFileType (hFile=0x23c) returned 0x1
	[0071.665] GetFileType (hFile=0x23c) returned 0x1
	[0071.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.671] GetFileType (hFile=0x23c) returned 0x1
	[0071.671] GetFileType (hFile=0x23c) returned 0x1
	[0071.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.677] GetFileType (hFile=0x23c) returned 0x1
	[0071.677] GetFileType (hFile=0x23c) returned 0x1
	[0071.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.681] GetFileType (hFile=0x23c) returned 0x1
	[0071.681] GetFileType (hFile=0x23c) returned 0x1
	[0071.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.688] GetFileType (hFile=0x23c) returned 0x1
	[0071.688] GetFileType (hFile=0x23c) returned 0x1
	[0071.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.695] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.695] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.696] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.697] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv", lpFilePart=0x0) returned 0x89
	[0071.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8a
	[0071.698] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.698] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.699] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.699] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.700] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.701] GetFileType (hFile=0x23c) returned 0x1
	[0071.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.702] GetFileType (hFile=0x23c) returned 0x1
	[0071.702] WriteFile (in: hFile=0x23c, lpBuffer=0x25f4f14*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25f4f14*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.706] CloseHandle (hObject=0x23c) returned 1
	[0071.706] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1
	[0071.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", lpFilePart=0x0) returned 0x89
	[0071.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\", lpFilePart=0x0) returned 0x8a
	[0071.707] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.719] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.720] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.721] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.721] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", lpFilePart=0x0) returned 0x89
	[0071.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\", lpFilePart=0x0) returned 0x8a
	[0071.722] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.723] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.723] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.724] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.724] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.726] GetFileType (hFile=0x23c) returned 0x1
	[0071.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.726] GetFileType (hFile=0x23c) returned 0x1
	[0071.727] WriteFile (in: hFile=0x23c, lpBuffer=0x25fa5d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25fa5d8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.729] CloseHandle (hObject=0x23c) returned 1
	[0071.730] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1
	[0071.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", lpFilePart=0x0) returned 0x89
	[0071.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\", lpFilePart=0x0) returned 0x8a
	[0071.731] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.733] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.734] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.735] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.735] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", lpFilePart=0x0) returned 0x89
	[0071.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\", lpFilePart=0x0) returned 0x8a
	[0071.736] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.736] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.737] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.737] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.738] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.738] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.739] GetFileType (hFile=0x23c) returned 0x1
	[0071.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.739] GetFileType (hFile=0x23c) returned 0x1
	[0071.740] WriteFile (in: hFile=0x23c, lpBuffer=0x25ffc9c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25ffc9c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.742] CloseHandle (hObject=0x23c) returned 1
	[0071.743] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1
	[0071.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", lpFilePart=0x0) returned 0x89
	[0071.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\", lpFilePart=0x0) returned 0x8a
	[0071.744] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.746] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.747] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.749] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.749] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", lpFilePart=0x0) returned 0x89
	[0071.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\", lpFilePart=0x0) returned 0x8a
	[0071.750] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.751] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.751] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.752] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.752] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.753] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.754] GetFileType (hFile=0x23c) returned 0x1
	[0071.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.754] GetFileType (hFile=0x23c) returned 0x1
	[0071.754] WriteFile (in: hFile=0x23c, lpBuffer=0x2605360*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2605360*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.757] CloseHandle (hObject=0x23c) returned 1
	[0071.758] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0071.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", lpFilePart=0x0) returned 0x89
	[0071.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a
	[0071.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.760] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.760] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.761] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.761] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", lpFilePart=0x0) returned 0x89
	[0071.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a
	[0071.762] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.763] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.764] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.764] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.765] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.766] GetFileType (hFile=0x23c) returned 0x1
	[0071.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.767] GetFileType (hFile=0x23c) returned 0x1
	[0071.767] WriteFile (in: hFile=0x23c, lpBuffer=0x260aa24*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x260aa24*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.770] CloseHandle (hObject=0x23c) returned 1
	[0071.770] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0071.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr", lpFilePart=0x0) returned 0x89
	[0071.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a
	[0071.771] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.774] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.774] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.775] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.775] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr", lpFilePart=0x0) returned 0x89
	[0071.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a
	[0071.776] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.777] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.777] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.778] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.779] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.780] GetFileType (hFile=0x23c) returned 0x1
	[0071.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.780] GetFileType (hFile=0x23c) returned 0x1
	[0071.781] WriteFile (in: hFile=0x23c, lpBuffer=0x26100e8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26100e8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.784] CloseHandle (hObject=0x23c) returned 1
	[0071.785] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0071.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk", lpFilePart=0x0) returned 0x89
	[0071.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a
	[0071.785] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.786] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.787] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.787] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.788] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk", lpFilePart=0x0) returned 0x89
	[0071.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a
	[0071.789] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.790] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.790] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.791] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.791] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.792] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.793] GetFileType (hFile=0x23c) returned 0x1
	[0071.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.793] GetFileType (hFile=0x23c) returned 0x1
	[0071.793] WriteFile (in: hFile=0x23c, lpBuffer=0x26157ac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26157ac*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0071.796] CloseHandle (hObject=0x23c) returned 1
	[0071.797] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ur", cAlternateFileName="")) returned 1
	[0071.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur", lpFilePart=0x0) returned 0x89
	[0071.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\", lpFilePart=0x0) returned 0x8a
	[0071.798] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.800] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.801] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.801] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0071.802] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0071.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur", lpFilePart=0x0) returned 0x89
	[0071.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\", lpFilePart=0x0) returned 0x8a
	[0071.803] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0071.803] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0071.804] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0071.804] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0071.805] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0071.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0071.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0071.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0071.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0071.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0071.806] GetFileType (hFile=0x23c) returned 0x1
	[0071.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0071.806] GetFileType (hFile=0x23c) returned 0x1
	[0071.807] WriteFile (in: hFile=0x23c, lpBuffer=0x261ae70*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x261ae70*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.127] CloseHandle (hObject=0x23c) returned 1
	[0072.130] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0072.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi", lpFilePart=0x0) returned 0x89
	[0072.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a
	[0072.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.136] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.137] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.137] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.138] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi", lpFilePart=0x0) returned 0x89
	[0072.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a
	[0072.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.140] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.140] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.143] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.144] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0072.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.146] GetFileType (hFile=0x23c) returned 0x1
	[0072.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.147] GetFileType (hFile=0x23c) returned 0x1
	[0072.147] WriteFile (in: hFile=0x23c, lpBuffer=0x2620534*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2620534*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.151] CloseHandle (hObject=0x23c) returned 1
	[0072.151] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1
	[0072.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c
	[0072.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d
	[0072.152] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.155] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.155] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.156] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.156] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c
	[0072.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d
	[0072.158] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.158] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.159] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.159] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.160] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0072.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.161] GetFileType (hFile=0x23c) returned 0x1
	[0072.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.161] GetFileType (hFile=0x23c) returned 0x1
	[0072.162] WriteFile (in: hFile=0x23c, lpBuffer=0x2625cfc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2625cfc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.165] CloseHandle (hObject=0x23c) returned 1
	[0072.165] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_HK", cAlternateFileName="")) returned 1
	[0072.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK", lpFilePart=0x0) returned 0x8c
	[0072.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\", lpFilePart=0x0) returned 0x8d
	[0072.166] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.167] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.168] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.170] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.170] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK", lpFilePart=0x0) returned 0x8c
	[0072.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\", lpFilePart=0x0) returned 0x8d
	[0072.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.172] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.173] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.173] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.174] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0072.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.175] GetFileType (hFile=0x23c) returned 0x1
	[0072.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.175] GetFileType (hFile=0x23c) returned 0x1
	[0072.175] WriteFile (in: hFile=0x23c, lpBuffer=0x262b4c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x262b4c4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.181] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0072.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c
	[0072.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d
	[0072.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.184] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.185] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.185] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.186] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c
	[0072.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d
	[0072.187] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.187] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.188] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.188] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.189] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0072.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.190] GetFileType (hFile=0x23c) returned 0x1
	[0072.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.190] GetFileType (hFile=0x23c) returned 0x1
	[0072.191] WriteFile (in: hFile=0x23c, lpBuffer=0x2630c8c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2630c8c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.194] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu", cAlternateFileName="")) returned 1
	[0072.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu", lpFilePart=0x0) returned 0x89
	[0072.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\", lpFilePart=0x0) returned 0x8a
	[0072.195] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.196] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.196] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.197] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.198] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu", lpFilePart=0x0) returned 0x89
	[0072.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\", lpFilePart=0x0) returned 0x8a
	[0072.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.199] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.200] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.200] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.201] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0072.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.202] GetFileType (hFile=0x23c) returned 0x1
	[0072.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.202] GetFileType (hFile=0x23c) returned 0x1
	[0072.203] WriteFile (in: hFile=0x23c, lpBuffer=0x2636350*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2636350*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.206] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.206] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0072.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0072.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0072.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0072.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", lpFilePart=0x0) returned 0x86
	[0072.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\", lpFilePart=0x0) returned 0x87
	[0072.207] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0072.208] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.209] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb5766b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb5766b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="af", cAlternateFileName="")) returned 1
	[0072.209] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb5766b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb5766b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1
	[0072.209] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb59c810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb59c810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0072.210] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb5c2970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb5c2970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="az", cAlternateFileName="")) returned 1
	[0072.211] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb5e8ad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb5e8ad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0072.211] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb60ec30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb60ec30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1
	[0072.212] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb634d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb634d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0072.212] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb65aef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb65aef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0072.212] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb681050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb681050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0072.213] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb6a71b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb6a71b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0072.213] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb6a71b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb6a71b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0072.213] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb6cd310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb6cd310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1
	[0072.214] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb6f3470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb6f3470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1
	[0072.214] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb6f3470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb6f3470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0072.215] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb7195d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb7195d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1
	[0072.217] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb73f730, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb73f730, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0072.217] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb765890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb765890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1
	[0072.217] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb765890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb765890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1
	[0072.218] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb78b9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb78b9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0072.218] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb7b1b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb7b1b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0072.219] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb7b1b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb7b1b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0072.219] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb7d7cb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb7d7cb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_CA", cAlternateFileName="")) returned 1
	[0072.220] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb7d7cb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb7d7cb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1
	[0072.220] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb7fde10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb7fde10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1
	[0072.220] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb823f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb823f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0072.221] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb823f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb823f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0072.221] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb84a0d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb84a0d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0072.222] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb84a0d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb84a0d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hy", cAlternateFileName="")) returned 1
	[0072.222] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb870230, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb870230, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0072.223] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb896390, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb896390, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="is", cAlternateFileName="")) returned 1
	[0072.223] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb896390, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb896390, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0072.223] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb97abd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb97abd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1
	[0072.224] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb9a0d30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb9a0d30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0072.224] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb9a0d30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb9a0d30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ka", cAlternateFileName="")) returned 1
	[0072.225] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb9c6e90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb9c6e90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="km", cAlternateFileName="")) returned 1
	[0072.225] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb9c6e90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb9c6e90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1
	[0072.225] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb9ecff0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb9ecff0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0072.226] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb9ecff0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb9ecff0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lo", cAlternateFileName="")) returned 1
	[0072.226] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfba13150, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfba13150, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0072.227] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfba392b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfba392b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0072.227] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfba392b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfba392b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1
	[0072.227] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfba5f410, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfba5f410, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mn", cAlternateFileName="")) returned 1
	[0072.228] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfba5f410, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfba5f410, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1
	[0072.228] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfba5f410, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfba5f410, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1
	[0072.229] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfba85570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfba85570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ne", cAlternateFileName="")) returned 1
	[0072.229] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfba85570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfba85570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0072.229] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbaab6d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbaab6d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0072.230] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbaab6d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbaab6d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0072.230] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbad1830, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbad1830, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0072.231] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbad1830, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbad1830, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0072.231] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbaf7990, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbaf7990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0072.232] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbaf7990, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbaf7990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0072.232] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbb1daf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbb1daf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1
	[0072.232] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbb1daf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbb1daf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0072.233] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbb1daf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbb1daf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0072.233] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbb43c50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbb43c50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0072.233] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbb69db0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbb69db0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0072.234] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbb8ff10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbb8ff10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1
	[0072.234] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbbb6070, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbbb6070, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1
	[0072.235] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbbdc1d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbbdc1d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1
	[0072.235] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbc02330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbc02330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0072.235] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbc28490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbc28490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0072.236] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbc28490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbc28490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0072.236] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbc4e5f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbc4e5f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ur", cAlternateFileName="")) returned 1
	[0072.236] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbf94430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbf94430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0072.237] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbfba590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbfba590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1
	[0072.237] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfbfe06f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfbfe06f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_HK", cAlternateFileName="")) returned 1
	[0072.237] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc006850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc006850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0072.238] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc02c9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc02c9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu", cAlternateFileName="")) returned 1
	[0072.238] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc02c9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc02c9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zu", cAlternateFileName="")) returned 0
	[0072.238] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0072.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0072.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0072.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\Decrypt.txt", lpFilePart=0x0) returned 0x92
	[0072.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0072.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0072.240] GetFileType (hFile=0x238) returned 0x1
	[0072.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0072.241] GetFileType (hFile=0x238) returned 0x1
	[0072.241] WriteFile (in: hFile=0x238, lpBuffer=0x26442cc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x26442cc*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0072.244] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0072.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0072.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata", lpFilePart=0x0) returned 0x87
	[0072.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\", lpFilePart=0x0) returned 0x88
	[0072.245] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0072.248] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.249] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8636e710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1
	[0072.249] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1
	[0072.249] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0
	[0072.250] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0072.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0072.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0072.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0072.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata", lpFilePart=0x0) returned 0x87
	[0072.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\", lpFilePart=0x0) returned 0x88
	[0072.251] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0072.251] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.252] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8636e710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1
	[0072.252] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1
	[0072.252] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.252] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0072.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0072.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0072.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\Decrypt.txt", lpFilePart=0x0) returned 0x93
	[0072.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0072.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0072.258] GetFileType (hFile=0x238) returned 0x1
	[0072.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0072.258] GetFileType (hFile=0x238) returned 0x1
	[0072.258] WriteFile (in: hFile=0x238, lpBuffer=0x264a448*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x264a448*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0072.261] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.262] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0072.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0072.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0072.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0072.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", lpFilePart=0x0) returned 0x7d
	[0072.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\", lpFilePart=0x0) returned 0x7e
	[0072.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0072.263] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.264] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1
	[0072.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", lpFilePart=0x0) returned 0x85
	[0072.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0072.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0072.265] GetFileType (hFile=0x238) returned 0x1
	[0072.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0072.265] GetFileType (hFile=0x238) returned 0x1
	[0072.265] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x1378
	[0072.266] ReadFile (in: hFile=0x238, lpBuffer=0x264cc00, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x264cc00*, lpNumberOfBytesRead=0x26eac4*=0x1378, lpOverlapped=0x0) returned 1
	[0072.270] CloseHandle (hObject=0x238) returned 1
	[0072.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.KEKW", lpFilePart=0x0) returned 0x8a
	[0072.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0072.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0072.272] GetFileType (hFile=0x238) returned 0x1
	[0072.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0072.272] GetFileType (hFile=0x238) returned 0x1
	[0072.275] WriteFile (in: hFile=0x238, lpBuffer=0x264f7f4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x264f7f4*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0072.278] CloseHandle (hObject=0x238) returned 1
	[0072.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", lpFilePart=0x0) returned 0x85
	[0072.279] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 1
	[0072.282] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x0, dwReserved1=0x0, cFileName="contentscript_bin_prod.js", cAlternateFileName="CONTEN~1.JS")) returned 1
	[0072.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", lpFilePart=0x0) returned 0x97
	[0072.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0072.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0072.285] GetFileType (hFile=0x238) returned 0x1
	[0072.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0072.285] GetFileType (hFile=0x238) returned 0x1
	[0072.285] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x1103
	[0072.286] ReadFile (in: hFile=0x238, lpBuffer=0x2651218, nNumberOfBytesToRead=0x1103, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x2651218*, lpNumberOfBytesRead=0x26eac4*=0x1103, lpOverlapped=0x0) returned 1
	[0072.290] CloseHandle (hObject=0x238) returned 1
	[0072.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.KEKW", lpFilePart=0x0) returned 0x9c
	[0072.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0072.291] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0072.291] GetFileType (hFile=0x238) returned 0x1
	[0072.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0072.292] GetFileType (hFile=0x238) returned 0x1
	[0072.292] WriteFile (in: hFile=0x238, lpBuffer=0x2653b88*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2653b88*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0072.295] CloseHandle (hObject=0x238) returned 1
	[0072.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", lpFilePart=0x0) returned 0x97
	[0072.296] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 1
	[0072.299] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x0, cFileName="dasherSettingSchema.json", cAlternateFileName="DASHER~1.JSO")) returned 1
	[0072.299] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="eventpage_bin_prod.js", cAlternateFileName="EVENTP~1.JS")) returned 1
	[0072.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", lpFilePart=0x0) returned 0x93
	[0072.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0072.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0072.301] GetFileType (hFile=0x238) returned 0x1
	[0072.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0072.301] GetFileType (hFile=0x238) returned 0x1
	[0072.301] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x5b6c
	[0072.302] ReadFile (in: hFile=0x238, lpBuffer=0x2655cb8, nNumberOfBytesToRead=0x5b6c, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x2655cb8*, lpNumberOfBytesRead=0x26eac4*=0x5b6c, lpOverlapped=0x0) returned 1
	[0072.306] CloseHandle (hObject=0x238) returned 1
	[0072.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.KEKW", lpFilePart=0x0) returned 0x98
	[0072.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0072.307] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0072.308] GetFileType (hFile=0x238) returned 0x1
	[0072.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0072.308] GetFileType (hFile=0x238) returned 0x1
	[0072.308] WriteFile (in: hFile=0x238, lpBuffer=0x265d078*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x265d078*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0072.312] CloseHandle (hObject=0x238) returned 1
	[0072.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", lpFilePart=0x0) returned 0x93
	[0072.312] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js")) returned 1
	[0072.316] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0072.316] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="page_embed_script.js", cAlternateFileName="PAGE_E~1.JS")) returned 1
	[0072.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", lpFilePart=0x0) returned 0x92
	[0072.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0072.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0072.318] GetFileType (hFile=0x238) returned 0x1
	[0072.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0072.318] GetFileType (hFile=0x238) returned 0x1
	[0072.318] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0xe0
	[0072.318] ReadFile (in: hFile=0x238, lpBuffer=0x265f1fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x265f1fc*, lpNumberOfBytesRead=0x26eac4*=0xe0, lpOverlapped=0x0) returned 1
	[0072.322] CloseHandle (hObject=0x238) returned 1
	[0072.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.KEKW", lpFilePart=0x0) returned 0x97
	[0072.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0072.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0072.323] GetFileType (hFile=0x238) returned 0x1
	[0072.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0072.323] GetFileType (hFile=0x238) returned 0x1
	[0072.324] WriteFile (in: hFile=0x238, lpBuffer=0x2661a44*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2661a44*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0072.327] CloseHandle (hObject=0x238) returned 1
	[0072.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", lpFilePart=0x0) returned 0x92
	[0072.327] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js")) returned 1
	[0072.331] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc078c70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc078c70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0072.331] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc09edd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc09edd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0072.332] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc09edd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc09edd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0
	[0072.332] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0072.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0072.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0072.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\Decrypt.txt", lpFilePart=0x0) returned 0x89
	[0072.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0072.334] GetFileType (hFile=0x234) returned 0x1
	[0072.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0072.334] GetFileType (hFile=0x234) returned 0x1
	[0072.334] WriteFile (in: hFile=0x234, lpBuffer=0x2664840*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x2664840*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0072.337] CloseHandle (hObject=0x234) returned 1
	[0072.338] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.338] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0072.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0072.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0072.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0072.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpFilePart=0x0) returned 0x77
	[0072.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", lpFilePart=0x0) returned 0x78
	[0072.339] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0072.340] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.341] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc15d4b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc15d4b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4_0", cAlternateFileName="")) returned 1
	[0072.341] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc15d4b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc15d4b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.4_0", cAlternateFileName="")) returned 0
	[0072.342] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0072.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0072.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0072.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Decrypt.txt", lpFilePart=0x0) returned 0x83
	[0072.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0072.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0072.343] GetFileType (hFile=0x230) returned 0x1
	[0072.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0072.343] GetFileType (hFile=0x230) returned 0x1
	[0072.344] WriteFile (in: hFile=0x230, lpBuffer=0x2668164*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x2668164*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0072.347] CloseHandle (hObject=0x230) returned 1
	[0072.347] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nmmhkkegccagdldgiimedpiccmgmieda", cAlternateFileName="NMMHKK~1")) returned 1
	[0072.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0072.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda", lpFilePart=0x0) returned 0x77
	[0072.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\", lpFilePart=0x0) returned 0x78
	[0072.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0072.351] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.352] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 1
	[0072.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0072.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0", lpFilePart=0x0) returned 0x81
	[0072.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\", lpFilePart=0x0) returned 0x82
	[0072.353] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0072.362] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.363] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82888510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8288ac20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x32a2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_background.js", cAlternateFileName="CRAW_B~1.JS")) returned 1
	[0072.363] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8288d330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82892150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x3b059, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.js", cAlternateFileName="CRAW_W~1.JS")) returned 1
	[0072.364] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1
	[0072.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0072.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css", lpFilePart=0x0) returned 0x85
	[0072.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\", lpFilePart=0x0) returned 0x86
	[0072.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0072.367] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.368] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 1
	[0072.368] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 0
	[0072.369] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0072.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0072.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0072.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0072.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css", lpFilePart=0x0) returned 0x85
	[0072.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\", lpFilePart=0x0) returned 0x86
	[0072.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0072.370] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.371] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 1
	[0072.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", lpFilePart=0x0) returned 0x95
	[0072.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0072.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.372] GetFileType (hFile=0x23c) returned 0x1
	[0072.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0072.373] GetFileType (hFile=0x23c) returned 0x1
	[0072.373] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x6cd
	[0072.373] ReadFile (in: hFile=0x23c, lpBuffer=0x266f27c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x266f27c*, lpNumberOfBytesRead=0x26ea24*=0x6cd, lpOverlapped=0x0) returned 1
	[0072.377] CloseHandle (hObject=0x23c) returned 1
	[0072.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.KEKW", lpFilePart=0x0) returned 0x9a
	[0072.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0072.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.379] GetFileType (hFile=0x23c) returned 0x1
	[0072.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0072.379] GetFileType (hFile=0x23c) returned 0x1
	[0072.379] WriteFile (in: hFile=0x23c, lpBuffer=0x2671acc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x2671acc*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0072.382] CloseHandle (hObject=0x23c) returned 1
	[0072.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", lpFilePart=0x0) returned 0x95
	[0072.383] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css")) returned 1
	[0072.386] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.386] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0072.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0072.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0072.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\Decrypt.txt", lpFilePart=0x0) returned 0x91
	[0072.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0072.387] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0072.388] GetFileType (hFile=0x238) returned 0x1
	[0072.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0072.388] GetFileType (hFile=0x238) returned 0x1
	[0072.388] WriteFile (in: hFile=0x238, lpBuffer=0x26743b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x26743b4*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0072.391] CloseHandle (hObject=0x238) returned 1
	[0072.391] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="html", cAlternateFileName="")) returned 1
	[0072.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0072.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html", lpFilePart=0x0) returned 0x86
	[0072.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\", lpFilePart=0x0) returned 0x87
	[0072.392] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0072.393] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.393] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 1
	[0072.394] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 0
	[0072.394] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0072.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0072.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0072.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0072.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html", lpFilePart=0x0) returned 0x86
	[0072.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\", lpFilePart=0x0) returned 0x87
	[0072.395] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0072.396] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.396] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 1
	[0072.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", lpFilePart=0x0) returned 0x97
	[0072.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0072.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.399] GetFileType (hFile=0x23c) returned 0x1
	[0072.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0072.399] GetFileType (hFile=0x23c) returned 0x1
	[0072.399] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x32a
	[0072.400] ReadFile (in: hFile=0x23c, lpBuffer=0x2678770, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x2678770*, lpNumberOfBytesRead=0x26ea24*=0x32a, lpOverlapped=0x0) returned 1
	[0072.404] CloseHandle (hObject=0x23c) returned 1
	[0072.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.KEKW", lpFilePart=0x0) returned 0x9c
	[0072.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0072.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.405] GetFileType (hFile=0x23c) returned 0x1
	[0072.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0072.406] GetFileType (hFile=0x23c) returned 0x1
	[0072.406] WriteFile (in: hFile=0x23c, lpBuffer=0x267afc8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x267afc8*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0072.409] CloseHandle (hObject=0x23c) returned 1
	[0072.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", lpFilePart=0x0) returned 0x97
	[0072.409] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 1
	[0072.412] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.412] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0072.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0072.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0072.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\Decrypt.txt", lpFilePart=0x0) returned 0x92
	[0072.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0072.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0072.414] GetFileType (hFile=0x238) returned 0x1
	[0072.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0072.414] GetFileType (hFile=0x238) returned 0x1
	[0072.414] WriteFile (in: hFile=0x238, lpBuffer=0x267d8bc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x267d8bc*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0072.417] CloseHandle (hObject=0x238) returned 1
	[0072.442] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0072.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0072.442] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images", lpFilePart=0x0) returned 0x88
	[0072.442] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\", lpFilePart=0x0) returned 0x89
	[0072.443] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0072.448] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.448] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a80e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828aa7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x112dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="flapper.gif", cAlternateFileName="")) returned 1
	[0072.449] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828af610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1
	[0072.449] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828c7cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_16.png", cAlternateFileName="")) returned 1
	[0072.450] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ccad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ccad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button.png", cAlternateFileName="TOPBAR~1.PNG")) returned 1
	[0072.451] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828cf1e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d18f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_close.png", cAlternateFileName="TOPBAR~2.PNG")) returned 1
	[0072.451] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d6710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d6710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_hover.png", cAlternateFileName="TOPBAR~3.PNG")) returned 1
	[0072.452] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d8e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d8e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_maximize.png", cAlternateFileName="TOPBAR~4.PNG")) returned 1
	[0072.452] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 1
	[0072.453] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 0
	[0072.453] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0072.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0072.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0072.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0072.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images", lpFilePart=0x0) returned 0x88
	[0072.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\", lpFilePart=0x0) returned 0x89
	[0072.456] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0072.460] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.460] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a80e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828aa7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x112dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="flapper.gif", cAlternateFileName="")) returned 1
	[0072.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif", lpFilePart=0x0) returned 0x94
	[0072.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0072.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.462] GetFileType (hFile=0x23c) returned 0x1
	[0072.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0072.462] GetFileType (hFile=0x23c) returned 0x1
	[0072.462] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x112dc
	[0072.463] ReadFile (in: hFile=0x23c, lpBuffer=0x2682f04, nNumberOfBytesToRead=0x112dc, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x2682f04*, lpNumberOfBytesRead=0x26ea24*=0x112dc, lpOverlapped=0x0) returned 1
	[0072.469] CloseHandle (hObject=0x23c) returned 1
	[0072.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.KEKW", lpFilePart=0x0) returned 0x99
	[0072.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0072.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.470] GetFileType (hFile=0x23c) returned 0x1
	[0072.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0072.471] GetFileType (hFile=0x23c) returned 0x1
	[0072.471] WriteFile (in: hFile=0x23c, lpBuffer=0x2695a20*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x2695a20*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0072.474] CloseHandle (hObject=0x23c) returned 1
	[0072.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif", lpFilePart=0x0) returned 0x94
	[0072.475] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif")) returned 1
	[0072.479] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828af610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1
	[0072.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFilePart=0x0) returned 0x95
	[0072.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0072.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.481] GetFileType (hFile=0x23c) returned 0x1
	[0072.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0072.481] GetFileType (hFile=0x23c) returned 0x1
	[0072.481] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x1109
	[0072.481] ReadFile (in: hFile=0x23c, lpBuffer=0x2697414, nNumberOfBytesToRead=0x1109, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x2697414*, lpNumberOfBytesRead=0x26ea24*=0x1109, lpOverlapped=0x0) returned 1
	[0072.486] CloseHandle (hObject=0x23c) returned 1
	[0072.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.KEKW", lpFilePart=0x0) returned 0x9a
	[0072.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0072.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.487] GetFileType (hFile=0x23c) returned 0x1
	[0072.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0072.488] GetFileType (hFile=0x23c) returned 0x1
	[0072.488] WriteFile (in: hFile=0x23c, lpBuffer=0x2699d68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x2699d68*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0072.491] CloseHandle (hObject=0x23c) returned 1
	[0072.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFilePart=0x0) returned 0x95
	[0072.492] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 1
	[0072.495] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828c7cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_16.png", cAlternateFileName="")) returned 1
	[0072.495] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFilePart=0x0) returned 0x94
	[0072.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0072.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.497] GetFileType (hFile=0x23c) returned 0x1
	[0072.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0072.497] GetFileType (hFile=0x23c) returned 0x1
	[0072.497] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x22c
	[0072.498] ReadFile (in: hFile=0x23c, lpBuffer=0x269b988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x269b988*, lpNumberOfBytesRead=0x26ea24*=0x22c, lpOverlapped=0x0) returned 1
	[0072.501] CloseHandle (hObject=0x23c) returned 1
	[0072.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.KEKW", lpFilePart=0x0) returned 0x99
	[0072.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0072.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.502] GetFileType (hFile=0x23c) returned 0x1
	[0072.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0072.502] GetFileType (hFile=0x23c) returned 0x1
	[0072.503] WriteFile (in: hFile=0x23c, lpBuffer=0x269e1c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x269e1c8*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0072.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFilePart=0x0) returned 0x94
	[0072.509] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 1
	[0072.512] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ccad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ccad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button.png", cAlternateFileName="TOPBAR~1.PNG")) returned 1
	[0072.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFilePart=0x0) returned 0xa3
	[0072.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0072.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.513] GetFileType (hFile=0x23c) returned 0x1
	[0072.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0072.514] GetFileType (hFile=0x23c) returned 0x1
	[0072.514] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0xa0
	[0072.514] ReadFile (in: hFile=0x23c, lpBuffer=0x269fd70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x269fd70*, lpNumberOfBytesRead=0x26ea24*=0xa0, lpOverlapped=0x0) returned 1
	[0072.517] CloseHandle (hObject=0x23c) returned 1
	[0072.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.KEKW", lpFilePart=0x0) returned 0xa8
	[0072.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0072.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.519] GetFileType (hFile=0x23c) returned 0x1
	[0072.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0072.519] GetFileType (hFile=0x23c) returned 0x1
	[0072.519] WriteFile (in: hFile=0x23c, lpBuffer=0x26a260c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26a260c*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0072.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFilePart=0x0) returned 0xa3
	[0072.523] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 1
	[0072.526] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828cf1e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d18f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_close.png", cAlternateFileName="TOPBAR~2.PNG")) returned 1
	[0072.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFilePart=0x0) returned 0xa9
	[0072.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0072.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.528] GetFileType (hFile=0x23c) returned 0x1
	[0072.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0072.528] GetFileType (hFile=0x23c) returned 0x1
	[0072.528] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0xfc
	[0072.528] ReadFile (in: hFile=0x23c, lpBuffer=0x26a428c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26a428c*, lpNumberOfBytesRead=0x26ea24*=0xfc, lpOverlapped=0x0) returned 1
	[0072.531] CloseHandle (hObject=0x23c) returned 1
	[0072.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.KEKW", lpFilePart=0x0) returned 0xae
	[0072.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0072.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.532] GetFileType (hFile=0x23c) returned 0x1
	[0072.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0072.533] GetFileType (hFile=0x23c) returned 0x1
	[0072.533] WriteFile (in: hFile=0x23c, lpBuffer=0x26a6b4c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26a6b4c*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0072.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFilePart=0x0) returned 0xa9
	[0072.536] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 1
	[0072.539] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d6710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d6710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_hover.png", cAlternateFileName="TOPBAR~3.PNG")) returned 1
	[0072.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFilePart=0x0) returned 0xa9
	[0072.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0072.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.541] GetFileType (hFile=0x23c) returned 0x1
	[0072.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0072.541] GetFileType (hFile=0x23c) returned 0x1
	[0072.541] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0xa0
	[0072.541] ReadFile (in: hFile=0x23c, lpBuffer=0x26a877c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26a877c*, lpNumberOfBytesRead=0x26ea24*=0xa0, lpOverlapped=0x0) returned 1
	[0072.545] CloseHandle (hObject=0x23c) returned 1
	[0072.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.KEKW", lpFilePart=0x0) returned 0xae
	[0072.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0072.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.546] GetFileType (hFile=0x23c) returned 0x1
	[0072.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0072.546] GetFileType (hFile=0x23c) returned 0x1
	[0072.547] WriteFile (in: hFile=0x23c, lpBuffer=0x26ab03c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26ab03c*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0072.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFilePart=0x0) returned 0xa9
	[0072.550] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 1
	[0072.558] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d8e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d8e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_maximize.png", cAlternateFileName="TOPBAR~4.PNG")) returned 1
	[0072.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFilePart=0x0) returned 0xac
	[0072.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0072.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.561] GetFileType (hFile=0x23c) returned 0x1
	[0072.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0072.562] GetFileType (hFile=0x23c) returned 0x1
	[0072.562] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0xa6
	[0072.562] ReadFile (in: hFile=0x23c, lpBuffer=0x26acca8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26acca8*, lpNumberOfBytesRead=0x26ea24*=0xa6, lpOverlapped=0x0) returned 1
	[0072.565] CloseHandle (hObject=0x23c) returned 1
	[0072.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.KEKW", lpFilePart=0x0) returned 0xb1
	[0072.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0072.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.567] GetFileType (hFile=0x23c) returned 0x1
	[0072.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0072.567] GetFileType (hFile=0x23c) returned 0x1
	[0072.567] WriteFile (in: hFile=0x23c, lpBuffer=0x26af578*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26af578*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0072.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFilePart=0x0) returned 0xac
	[0072.571] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 1
	[0072.574] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 1
	[0072.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFilePart=0x0) returned 0xab
	[0072.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0072.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.575] GetFileType (hFile=0x23c) returned 0x1
	[0072.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0072.575] GetFileType (hFile=0x23c) returned 0x1
	[0072.575] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0xa0
	[0072.576] ReadFile (in: hFile=0x23c, lpBuffer=0x26b11d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26b11d0*, lpNumberOfBytesRead=0x26ea24*=0xa0, lpOverlapped=0x0) returned 1
	[0072.579] CloseHandle (hObject=0x23c) returned 1
	[0072.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.KEKW", lpFilePart=0x0) returned 0xb0
	[0072.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0072.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0072.580] GetFileType (hFile=0x23c) returned 0x1
	[0072.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0072.580] GetFileType (hFile=0x23c) returned 0x1
	[0072.581] WriteFile (in: hFile=0x23c, lpBuffer=0x26b3a9c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26b3a9c*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0072.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFilePart=0x0) returned 0xab
	[0072.584] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 1
	[0072.587] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.587] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0072.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0072.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0072.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Decrypt.txt", lpFilePart=0x0) returned 0x94
	[0072.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0072.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0072.588] GetFileType (hFile=0x238) returned 0x1
	[0072.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0072.589] GetFileType (hFile=0x238) returned 0x1
	[0072.589] WriteFile (in: hFile=0x238, lpBuffer=0x26b63c0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x26b63c0*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0072.592] CloseHandle (hObject=0x238) returned 1
	[0072.593] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826545a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e2a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aa3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0072.593] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0072.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0072.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", lpFilePart=0x0) returned 0x8a
	[0072.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", lpFilePart=0x0) returned 0x8b
	[0072.594] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0072.599] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.600] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0072.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", lpFilePart=0x0) returned 0x8d
	[0072.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8e
	[0072.601] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.601] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.602] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.603] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.603] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", lpFilePart=0x0) returned 0x8d
	[0072.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8e
	[0072.604] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.605] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.606] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.606] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.607] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.609] GetFileType (hFile=0x23c) returned 0x1
	[0072.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.609] GetFileType (hFile=0x23c) returned 0x1
	[0072.609] WriteFile (in: hFile=0x23c, lpBuffer=0x26bd254*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26bd254*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.613] CloseHandle (hObject=0x23c) returned 1
	[0072.613] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0072.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", lpFilePart=0x0) returned 0x8d
	[0072.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8e
	[0072.614] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.616] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.617] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.618] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.618] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", lpFilePart=0x0) returned 0x8d
	[0072.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8e
	[0072.619] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.620] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.620] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.621] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.622] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.623] GetFileType (hFile=0x23c) returned 0x1
	[0072.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.623] GetFileType (hFile=0x23c) returned 0x1
	[0072.624] WriteFile (in: hFile=0x23c, lpBuffer=0x26c2a60*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26c2a60*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.626] CloseHandle (hObject=0x23c) returned 1
	[0072.627] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0072.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", lpFilePart=0x0) returned 0x8d
	[0072.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8e
	[0072.628] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.629] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.630] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.630] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.630] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", lpFilePart=0x0) returned 0x8d
	[0072.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8e
	[0072.631] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.632] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.632] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.633] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.633] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.635] GetFileType (hFile=0x23c) returned 0x1
	[0072.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.635] GetFileType (hFile=0x23c) returned 0x1
	[0072.635] WriteFile (in: hFile=0x23c, lpBuffer=0x26c826c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26c826c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.638] CloseHandle (hObject=0x23c) returned 1
	[0072.639] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0072.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", lpFilePart=0x0) returned 0x8d
	[0072.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8e
	[0072.640] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.642] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.643] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.643] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.644] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", lpFilePart=0x0) returned 0x8d
	[0072.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8e
	[0072.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.645] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.646] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.647] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.647] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.648] GetFileType (hFile=0x23c) returned 0x1
	[0072.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.649] GetFileType (hFile=0x23c) returned 0x1
	[0072.649] WriteFile (in: hFile=0x23c, lpBuffer=0x26cda78*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26cda78*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.653] CloseHandle (hObject=0x23c) returned 1
	[0072.654] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0072.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", lpFilePart=0x0) returned 0x8d
	[0072.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8e
	[0072.655] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.655] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.656] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.657] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.657] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", lpFilePart=0x0) returned 0x8d
	[0072.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8e
	[0072.658] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.659] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.660] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.660] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.660] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.662] GetFileType (hFile=0x23c) returned 0x1
	[0072.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.662] GetFileType (hFile=0x23c) returned 0x1
	[0072.663] WriteFile (in: hFile=0x23c, lpBuffer=0x26d3284*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26d3284*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.666] CloseHandle (hObject=0x23c) returned 1
	[0072.667] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0072.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", lpFilePart=0x0) returned 0x8d
	[0072.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8e
	[0072.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.670] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.671] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.671] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.672] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", lpFilePart=0x0) returned 0x8d
	[0072.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8e
	[0072.673] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.674] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.674] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.675] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.675] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.676] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.677] GetFileType (hFile=0x23c) returned 0x1
	[0072.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.677] GetFileType (hFile=0x23c) returned 0x1
	[0072.677] WriteFile (in: hFile=0x23c, lpBuffer=0x26d8a90*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26d8a90*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.680] CloseHandle (hObject=0x23c) returned 1
	[0072.681] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1
	[0072.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", lpFilePart=0x0) returned 0x8d
	[0072.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8e
	[0072.682] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.683] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.684] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.684] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.685] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", lpFilePart=0x0) returned 0x8d
	[0072.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8e
	[0072.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.686] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.687] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.687] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.688] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.689] GetFileType (hFile=0x23c) returned 0x1
	[0072.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.689] GetFileType (hFile=0x23c) returned 0x1
	[0072.690] WriteFile (in: hFile=0x23c, lpBuffer=0x26de29c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26de29c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.693] CloseHandle (hObject=0x23c) returned 1
	[0072.693] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1
	[0072.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x90
	[0072.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x91
	[0072.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.697] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.697] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.697] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.698] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x90
	[0072.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x91
	[0072.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.699] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.700] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.700] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.701] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Decrypt.txt", lpFilePart=0x0) returned 0x9c
	[0072.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.702] GetFileType (hFile=0x23c) returned 0x1
	[0072.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.703] GetFileType (hFile=0x23c) returned 0x1
	[0072.703] WriteFile (in: hFile=0x23c, lpBuffer=0x26e3bac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26e3bac*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.706] CloseHandle (hObject=0x23c) returned 1
	[0072.717] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0072.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", lpFilePart=0x0) returned 0x8d
	[0072.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8e
	[0072.718] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.719] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.719] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.720] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.720] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", lpFilePart=0x0) returned 0x8d
	[0072.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8e
	[0072.721] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.722] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.722] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.723] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.723] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.724] GetFileType (hFile=0x23c) returned 0x1
	[0072.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.724] GetFileType (hFile=0x23c) returned 0x1
	[0072.725] WriteFile (in: hFile=0x23c, lpBuffer=0x26e93b8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26e93b8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.728] CloseHandle (hObject=0x23c) returned 1
	[0072.728] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1
	[0072.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", lpFilePart=0x0) returned 0x91
	[0072.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x92
	[0072.729] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.731] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.731] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.732] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.732] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", lpFilePart=0x0) returned 0x91
	[0072.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x92
	[0072.733] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.734] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.734] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.735] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.735] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Decrypt.txt", lpFilePart=0x0) returned 0x9d
	[0072.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.736] GetFileType (hFile=0x23c) returned 0x1
	[0072.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.736] GetFileType (hFile=0x23c) returned 0x1
	[0072.737] WriteFile (in: hFile=0x23c, lpBuffer=0x26eecf4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26eecf4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.754] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0072.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", lpFilePart=0x0) returned 0x8d
	[0072.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8e
	[0072.754] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.755] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.756] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.756] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.756] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", lpFilePart=0x0) returned 0x8d
	[0072.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8e
	[0072.757] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.758] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.758] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.759] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.759] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.760] GetFileType (hFile=0x23c) returned 0x1
	[0072.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.761] GetFileType (hFile=0x23c) returned 0x1
	[0072.761] WriteFile (in: hFile=0x23c, lpBuffer=0x26f4500*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26f4500*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.765] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0072.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", lpFilePart=0x0) returned 0x8d
	[0072.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8e
	[0072.766] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.768] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.768] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.769] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.769] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", lpFilePart=0x0) returned 0x8d
	[0072.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8e
	[0072.770] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.771] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.771] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.772] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.772] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.773] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.773] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.774] GetFileType (hFile=0x23c) returned 0x1
	[0072.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.774] GetFileType (hFile=0x23c) returned 0x1
	[0072.774] WriteFile (in: hFile=0x23c, lpBuffer=0x26f9d0c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26f9d0c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.778] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0072.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", lpFilePart=0x0) returned 0x8e
	[0072.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8f
	[0072.779] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.780] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.780] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.781] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.781] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", lpFilePart=0x0) returned 0x8e
	[0072.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8f
	[0072.782] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.782] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.783] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.784] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.784] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Decrypt.txt", lpFilePart=0x0) returned 0x9a
	[0072.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.785] GetFileType (hFile=0x23c) returned 0x1
	[0072.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.785] GetFileType (hFile=0x23c) returned 0x1
	[0072.786] WriteFile (in: hFile=0x23c, lpBuffer=0x26ff584*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26ff584*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.789] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0072.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", lpFilePart=0x0) returned 0x8d
	[0072.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8e
	[0072.790] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.792] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.793] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.793] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.794] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", lpFilePart=0x0) returned 0x8d
	[0072.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8e
	[0072.794] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.795] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.795] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.796] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.796] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.797] GetFileType (hFile=0x23c) returned 0x1
	[0072.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.798] GetFileType (hFile=0x23c) returned 0x1
	[0072.798] WriteFile (in: hFile=0x23c, lpBuffer=0x2704d90*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2704d90*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.801] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0072.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", lpFilePart=0x0) returned 0x8d
	[0072.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8e
	[0072.802] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.803] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.803] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.804] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.804] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", lpFilePart=0x0) returned 0x8d
	[0072.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8e
	[0072.805] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.806] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.807] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.807] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.807] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.809] GetFileType (hFile=0x23c) returned 0x1
	[0072.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.809] GetFileType (hFile=0x23c) returned 0x1
	[0072.809] WriteFile (in: hFile=0x23c, lpBuffer=0x270a59c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x270a59c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.812] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0072.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", lpFilePart=0x0) returned 0x8d
	[0072.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8e
	[0072.813] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.816] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.817] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.817] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.817] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", lpFilePart=0x0) returned 0x8d
	[0072.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8e
	[0072.818] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.819] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.819] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.820] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.820] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.821] GetFileType (hFile=0x23c) returned 0x1
	[0072.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.822] GetFileType (hFile=0x23c) returned 0x1
	[0072.822] WriteFile (in: hFile=0x23c, lpBuffer=0x270fda8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x270fda8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.826] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0072.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", lpFilePart=0x0) returned 0x8d
	[0072.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8e
	[0072.827] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.827] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.828] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.829] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.829] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", lpFilePart=0x0) returned 0x8d
	[0072.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8e
	[0072.830] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.830] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.831] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.831] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.832] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.832] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.833] GetFileType (hFile=0x23c) returned 0x1
	[0072.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.833] GetFileType (hFile=0x23c) returned 0x1
	[0072.834] WriteFile (in: hFile=0x23c, lpBuffer=0x27155b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27155b4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.837] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0072.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", lpFilePart=0x0) returned 0x8d
	[0072.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8e
	[0072.837] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.841] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.841] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.842] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.842] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", lpFilePart=0x0) returned 0x8d
	[0072.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8e
	[0072.843] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.844] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.844] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.845] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.845] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.846] GetFileType (hFile=0x23c) returned 0x1
	[0072.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.847] GetFileType (hFile=0x23c) returned 0x1
	[0072.847] WriteFile (in: hFile=0x23c, lpBuffer=0x271adc0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x271adc0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0072.850] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0072.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", lpFilePart=0x0) returned 0x8d
	[0072.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8e
	[0072.851] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.852] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.852] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.852] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.853] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", lpFilePart=0x0) returned 0x8d
	[0072.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8e
	[0072.854] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.854] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.854] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.855] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.856] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.856] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.857] GetFileType (hFile=0x23c) returned 0x1
	[0072.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0072.857] GetFileType (hFile=0x23c) returned 0x1
	[0072.862] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0072.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", lpFilePart=0x0) returned 0x8d
	[0072.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8e
	[0072.862] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.865] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.865] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.865] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.866] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0072.866] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", lpFilePart=0x0) returned 0x8d
	[0072.866] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8e
	[0072.867] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.867] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.867] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.868] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.868] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0072.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0072.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0072.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.869] GetFileType (hFile=0x23c) returned 0x1
	[0072.870] GetFileType (hFile=0x23c) returned 0x1
	[0072.873] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0072.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", lpFilePart=0x0) returned 0x8d
	[0072.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8e
	[0072.873] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.874] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.875] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.875] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.875] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", lpFilePart=0x0) returned 0x8d
	[0072.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8e
	[0072.876] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.876] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.877] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.877] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.877] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.878] GetFileType (hFile=0x23c) returned 0x1
	[0072.878] GetFileType (hFile=0x23c) returned 0x1
	[0072.881] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0072.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", lpFilePart=0x0) returned 0x8d
	[0072.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8e
	[0072.882] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.884] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.885] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.885] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.885] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", lpFilePart=0x0) returned 0x8d
	[0072.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8e
	[0072.887] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.887] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.887] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.888] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.888] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.889] GetFileType (hFile=0x23c) returned 0x1
	[0072.889] GetFileType (hFile=0x23c) returned 0x1
	[0072.892] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0072.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", lpFilePart=0x0) returned 0x8d
	[0072.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8e
	[0072.893] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.894] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.894] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.894] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.895] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", lpFilePart=0x0) returned 0x8d
	[0072.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8e
	[0072.895] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.896] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.896] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.896] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.897] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.898] GetFileType (hFile=0x23c) returned 0x1
	[0072.898] GetFileType (hFile=0x23c) returned 0x1
	[0072.901] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb", cAlternateFileName="")) returned 1
	[0072.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", lpFilePart=0x0) returned 0x8d
	[0072.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", lpFilePart=0x0) returned 0x8e
	[0072.903] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.905] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.905] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.905] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.906] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", lpFilePart=0x0) returned 0x8d
	[0072.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", lpFilePart=0x0) returned 0x8e
	[0072.906] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.907] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.907] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.907] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.908] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.908] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.909] GetFileType (hFile=0x23c) returned 0x1
	[0072.910] GetFileType (hFile=0x23c) returned 0x1
	[0072.913] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0072.914] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", lpFilePart=0x0) returned 0x8d
	[0072.914] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8e
	[0072.914] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.915] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.915] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.915] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.916] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", lpFilePart=0x0) returned 0x8d
	[0072.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8e
	[0072.916] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.917] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.917] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.918] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.918] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.919] GetFileType (hFile=0x23c) returned 0x1
	[0072.919] GetFileType (hFile=0x23c) returned 0x1
	[0072.922] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0072.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", lpFilePart=0x0) returned 0x8d
	[0072.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8e
	[0072.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.924] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.924] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.924] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.925] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", lpFilePart=0x0) returned 0x8d
	[0072.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8e
	[0072.925] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.926] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.926] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.926] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.926] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.927] GetFileType (hFile=0x23c) returned 0x1
	[0072.928] GetFileType (hFile=0x23c) returned 0x1
	[0072.931] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0072.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x90
	[0072.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x91
	[0072.931] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.932] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.932] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.932] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.932] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x90
	[0072.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x91
	[0072.933] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.933] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.933] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.934] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0072.934] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Decrypt.txt", lpFilePart=0x0) returned 0x9c
	[0072.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.935] GetFileType (hFile=0x23c) returned 0x1
	[0072.935] GetFileType (hFile=0x23c) returned 0x1
	[0072.938] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0072.938] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x90
	[0072.938] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x91
	[0072.938] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.940] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0072.941] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0072.941] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0072.941] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x90
	[0072.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x91
	[0072.941] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.943] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.943] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Decrypt.txt", lpFilePart=0x0) returned 0x9c
	[0072.943] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.944] GetFileType (hFile=0x23c) returned 0x1
	[0072.944] GetFileType (hFile=0x23c) returned 0x1
	[0072.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", lpFilePart=0x0) returned 0x8d
	[0072.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8e
	[0072.947] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.947] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", lpFilePart=0x0) returned 0x8d
	[0072.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8e
	[0072.948] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.949] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.950] GetFileType (hFile=0x23c) returned 0x1
	[0072.950] GetFileType (hFile=0x23c) returned 0x1
	[0072.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", lpFilePart=0x0) returned 0x8d
	[0072.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8e
	[0072.953] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.955] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", lpFilePart=0x0) returned 0x8d
	[0072.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8e
	[0072.956] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.956] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.957] GetFileType (hFile=0x23c) returned 0x1
	[0072.957] GetFileType (hFile=0x23c) returned 0x1
	[0072.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk", lpFilePart=0x0) returned 0x8d
	[0072.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8e
	[0072.961] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.961] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk", lpFilePart=0x0) returned 0x8d
	[0072.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8e
	[0072.962] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.962] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.963] GetFileType (hFile=0x23c) returned 0x1
	[0072.963] GetFileType (hFile=0x23c) returned 0x1
	[0072.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl", lpFilePart=0x0) returned 0x8d
	[0072.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8e
	[0072.967] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.969] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl", lpFilePart=0x0) returned 0x8d
	[0072.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8e
	[0072.970] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.970] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.971] GetFileType (hFile=0x23c) returned 0x1
	[0072.972] GetFileType (hFile=0x23c) returned 0x1
	[0072.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr", lpFilePart=0x0) returned 0x8d
	[0072.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8e
	[0072.975] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.976] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.979] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr", lpFilePart=0x0) returned 0x8d
	[0072.979] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8e
	[0072.980] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.980] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.981] GetFileType (hFile=0x23c) returned 0x1
	[0072.981] GetFileType (hFile=0x23c) returned 0x1
	[0072.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv", lpFilePart=0x0) returned 0x8d
	[0072.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8e
	[0072.984] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.987] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv", lpFilePart=0x0) returned 0x8d
	[0072.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8e
	[0072.987] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.987] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.989] GetFileType (hFile=0x23c) returned 0x1
	[0072.989] GetFileType (hFile=0x23c) returned 0x1
	[0072.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th", lpFilePart=0x0) returned 0x8d
	[0072.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8e
	[0072.992] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.993] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th", lpFilePart=0x0) returned 0x8d
	[0072.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8e
	[0072.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0072.994] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0072.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0072.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0072.995] GetFileType (hFile=0x23c) returned 0x1
	[0072.996] GetFileType (hFile=0x23c) returned 0x1
	[0072.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr", lpFilePart=0x0) returned 0x8d
	[0072.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8e
	[0072.999] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.000] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr", lpFilePart=0x0) returned 0x8d
	[0073.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8e
	[0073.001] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.001] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0073.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.003] GetFileType (hFile=0x23c) returned 0x1
	[0073.003] GetFileType (hFile=0x23c) returned 0x1
	[0073.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk", lpFilePart=0x0) returned 0x8d
	[0073.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8e
	[0073.006] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.007] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk", lpFilePart=0x0) returned 0x8d
	[0073.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8e
	[0073.007] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.008] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0073.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.011] GetFileType (hFile=0x23c) returned 0x1
	[0073.011] GetFileType (hFile=0x23c) returned 0x1
	[0073.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi", lpFilePart=0x0) returned 0x8d
	[0073.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8e
	[0073.014] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.016] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi", lpFilePart=0x0) returned 0x8d
	[0073.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8e
	[0073.017] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.017] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\Decrypt.txt", lpFilePart=0x0) returned 0x99
	[0073.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.018] GetFileType (hFile=0x23c) returned 0x1
	[0073.018] GetFileType (hFile=0x23c) returned 0x1
	[0073.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x90
	[0073.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x91
	[0073.022] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.023] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x90
	[0073.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x91
	[0073.023] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.023] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.024] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\Decrypt.txt", lpFilePart=0x0) returned 0x9c
	[0073.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.024] GetFileType (hFile=0x23c) returned 0x1
	[0073.024] GetFileType (hFile=0x23c) returned 0x1
	[0073.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x90
	[0073.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x91
	[0073.029] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.032] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x90
	[0073.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x91
	[0073.032] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.033] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\Decrypt.txt", lpFilePart=0x0) returned 0x9c
	[0073.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.034] GetFileType (hFile=0x23c) returned 0x1
	[0073.034] GetFileType (hFile=0x23c) returned 0x1
	[0073.038] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0073.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", lpFilePart=0x0) returned 0x8a
	[0073.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", lpFilePart=0x0) returned 0x8b
	[0073.039] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0073.039] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0073.040] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0073.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0073.073] GetFileType (hFile=0x238) returned 0x1
	[0073.073] GetFileType (hFile=0x238) returned 0x1
	[0073.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata", lpFilePart=0x0) returned 0x8b
	[0073.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\", lpFilePart=0x0) returned 0x8c
	[0073.077] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0073.077] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0073.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata", lpFilePart=0x0) returned 0x8b
	[0073.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\", lpFilePart=0x0) returned 0x8c
	[0073.078] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0073.078] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0073.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Decrypt.txt", lpFilePart=0x0) returned 0x97
	[0073.079] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0073.079] GetFileType (hFile=0x238) returned 0x1
	[0073.079] GetFileType (hFile=0x238) returned 0x1
	[0073.082] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0073.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0", lpFilePart=0x0) returned 0x81
	[0073.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\", lpFilePart=0x0) returned 0x82
	[0073.083] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0073.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", lpFilePart=0x0) returned 0x94
	[0073.083] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0073.084] GetFileType (hFile=0x238) returned 0x1
	[0073.084] GetFileType (hFile=0x238) returned 0x1
	[0073.084] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x32a2e
	[0073.086] ReadFile (in: hFile=0x238, lpBuffer=0x36871b8, nNumberOfBytesToRead=0x32a2e, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x36871b8*, lpNumberOfBytesRead=0x26eac4*=0x32a2e, lpOverlapped=0x0) returned 1
	[0073.112] CloseHandle (hObject=0x238) returned 1
	[0073.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.KEKW", lpFilePart=0x0) returned 0x99
	[0073.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0073.115] GetFileType (hFile=0x238) returned 0x1
	[0073.115] GetFileType (hFile=0x238) returned 0x1
	[0073.115] WriteFile (in: hFile=0x238, lpBuffer=0x27a7940*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x27a7940*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0073.118] CloseHandle (hObject=0x238) returned 1
	[0073.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", lpFilePart=0x0) returned 0x94
	[0073.119] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 1
	[0073.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", lpFilePart=0x0) returned 0x90
	[0073.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0073.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0073.127] GetFileType (hFile=0x238) returned 0x1
	[0073.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0073.127] GetFileType (hFile=0x238) returned 0x1
	[0073.127] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x3b059
	[0073.129] ReadFile (in: hFile=0x238, lpBuffer=0x36b9c08, nNumberOfBytesToRead=0x3b059, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x36b9c08*, lpNumberOfBytesRead=0x26eac4*=0x3b059, lpOverlapped=0x0) returned 1
	[0073.148] CloseHandle (hObject=0x238) returned 1
	[0073.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.KEKW", lpFilePart=0x0) returned 0x95
	[0073.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0073.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0073.149] GetFileType (hFile=0x238) returned 0x1
	[0073.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0073.149] GetFileType (hFile=0x238) returned 0x1
	[0073.150] WriteFile (in: hFile=0x238, lpBuffer=0x27aab54*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x27aab54*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0073.153] CloseHandle (hObject=0x238) returned 1
	[0073.154] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", lpFilePart=0x0) returned 0x90
	[0073.154] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js")) returned 1
	[0073.162] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc1f5a30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc1f5a30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1
	[0073.163] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc21bb90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc21bb90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="html", cAlternateFileName="")) returned 1
	[0073.163] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc3beab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc3beab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1
	[0073.164] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826545a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e2a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aa3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0073.164] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc85b550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc85b550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0073.165] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc8816b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc8816b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0073.165] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc8816b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc8816b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0
	[0073.165] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0073.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0073.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0073.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Decrypt.txt", lpFilePart=0x0) returned 0x8d
	[0073.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0073.167] GetFileType (hFile=0x234) returned 0x1
	[0073.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0073.168] GetFileType (hFile=0x234) returned 0x1
	[0073.168] WriteFile (in: hFile=0x234, lpBuffer=0x27ae790*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x27ae790*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0073.171] CloseHandle (hObject=0x234) returned 1
	[0073.172] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.172] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0073.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0073.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0073.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0073.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda", lpFilePart=0x0) returned 0x77
	[0073.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\", lpFilePart=0x0) returned 0x78
	[0073.173] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0073.174] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.175] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc965ef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc965ef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 1
	[0073.175] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc965ef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc965ef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 0
	[0073.176] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0073.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0073.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0073.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Decrypt.txt", lpFilePart=0x0) returned 0x83
	[0073.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0073.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0073.178] GetFileType (hFile=0x230) returned 0x1
	[0073.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0073.178] GetFileType (hFile=0x230) returned 0x1
	[0073.178] WriteFile (in: hFile=0x230, lpBuffer=0x27b2114*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x27b2114*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0073.181] CloseHandle (hObject=0x230) returned 1
	[0073.182] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pjkljhegncpnkpknbcohdijeoejaedia", cAlternateFileName="PJKLJH~1")) returned 1
	[0073.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0073.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", lpFilePart=0x0) returned 0x77
	[0073.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", lpFilePart=0x0) returned 0x78
	[0073.184] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0073.185] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.186] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.1_0", cAlternateFileName="")) returned 1
	[0073.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0073.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0", lpFilePart=0x0) returned 0x7d
	[0073.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\", lpFilePart=0x0) returned 0x7e
	[0073.187] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0073.194] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.195] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1
	[0073.195] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x869b0fb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0073.196] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0073.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0073.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales", lpFilePart=0x0) returned 0x86
	[0073.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\", lpFilePart=0x0) returned 0x87
	[0073.197] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0073.205] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.205] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0073.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x89
	[0073.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a
	[0073.206] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.210] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.211] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.211] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.212] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x89
	[0073.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a
	[0073.213] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.216] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.216] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.217] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.217] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.218] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.219] GetFileType (hFile=0x23c) returned 0x1
	[0073.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.219] GetFileType (hFile=0x23c) returned 0x1
	[0073.220] WriteFile (in: hFile=0x23c, lpBuffer=0x27bb43c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27bb43c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.223] CloseHandle (hObject=0x23c) returned 1
	[0073.223] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0073.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x89
	[0073.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a
	[0073.224] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.225] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.226] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.226] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.227] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x89
	[0073.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a
	[0073.228] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.229] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.230] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.231] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.231] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.232] GetFileType (hFile=0x23c) returned 0x1
	[0073.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.233] GetFileType (hFile=0x23c) returned 0x1
	[0073.233] WriteFile (in: hFile=0x23c, lpBuffer=0x27c0b00*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27c0b00*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.236] CloseHandle (hObject=0x23c) returned 1
	[0073.237] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0073.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x89
	[0073.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a
	[0073.238] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.241] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.241] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.242] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.242] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x89
	[0073.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a
	[0073.243] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.244] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.245] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.245] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.246] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.247] GetFileType (hFile=0x23c) returned 0x1
	[0073.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.248] GetFileType (hFile=0x23c) returned 0x1
	[0073.248] WriteFile (in: hFile=0x23c, lpBuffer=0x27c61c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27c61c4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.252] CloseHandle (hObject=0x23c) returned 1
	[0073.253] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0073.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x89
	[0073.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a
	[0073.253] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.256] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.256] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.257] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.258] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x89
	[0073.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a
	[0073.258] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.259] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.260] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.261] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.261] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.263] GetFileType (hFile=0x23c) returned 0x1
	[0073.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.263] GetFileType (hFile=0x23c) returned 0x1
	[0073.263] WriteFile (in: hFile=0x23c, lpBuffer=0x27cb888*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27cb888*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.266] CloseHandle (hObject=0x23c) returned 1
	[0073.267] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0073.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da", lpFilePart=0x0) returned 0x89
	[0073.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a
	[0073.268] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.270] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.271] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.271] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.272] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da", lpFilePart=0x0) returned 0x89
	[0073.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a
	[0073.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.274] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.274] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.275] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.275] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.276] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.277] GetFileType (hFile=0x23c) returned 0x1
	[0073.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.277] GetFileType (hFile=0x23c) returned 0x1
	[0073.278] WriteFile (in: hFile=0x23c, lpBuffer=0x27d0f4c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27d0f4c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.281] CloseHandle (hObject=0x23c) returned 1
	[0073.281] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0073.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de", lpFilePart=0x0) returned 0x89
	[0073.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a
	[0073.282] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.284] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.285] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.285] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.286] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de", lpFilePart=0x0) returned 0x89
	[0073.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a
	[0073.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.287] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.288] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.288] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.289] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.290] GetFileType (hFile=0x23c) returned 0x1
	[0073.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.291] GetFileType (hFile=0x23c) returned 0x1
	[0073.291] WriteFile (in: hFile=0x23c, lpBuffer=0x27d6610*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27d6610*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.294] CloseHandle (hObject=0x23c) returned 1
	[0073.295] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0073.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el", lpFilePart=0x0) returned 0x89
	[0073.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a
	[0073.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.299] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.299] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.300] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.300] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el", lpFilePart=0x0) returned 0x89
	[0073.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a
	[0073.302] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.302] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.303] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.304] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.304] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.305] GetFileType (hFile=0x23c) returned 0x1
	[0073.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.306] GetFileType (hFile=0x23c) returned 0x1
	[0073.306] WriteFile (in: hFile=0x23c, lpBuffer=0x27dbcd4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27dbcd4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.314] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1
	[0073.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.315] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en", lpFilePart=0x0) returned 0x89
	[0073.315] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8a
	[0073.315] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.316] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.317] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.317] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.318] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en", lpFilePart=0x0) returned 0x89
	[0073.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8a
	[0073.319] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.319] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.320] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.320] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.321] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.321] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.322] GetFileType (hFile=0x23c) returned 0x1
	[0073.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.323] GetFileType (hFile=0x23c) returned 0x1
	[0073.324] WriteFile (in: hFile=0x23c, lpBuffer=0x27e1398*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27e1398*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.327] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0073.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es", lpFilePart=0x0) returned 0x89
	[0073.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a
	[0073.327] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.328] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.329] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.329] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.330] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es", lpFilePart=0x0) returned 0x89
	[0073.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a
	[0073.331] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.331] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.332] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.332] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.332] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.334] GetFileType (hFile=0x23c) returned 0x1
	[0073.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.334] GetFileType (hFile=0x23c) returned 0x1
	[0073.334] WriteFile (in: hFile=0x23c, lpBuffer=0x27e6a5c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27e6a5c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.337] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0073.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi", lpFilePart=0x0) returned 0x89
	[0073.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a
	[0073.339] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.341] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.342] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.342] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.343] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi", lpFilePart=0x0) returned 0x89
	[0073.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a
	[0073.344] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.344] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.345] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.345] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.346] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.347] GetFileType (hFile=0x23c) returned 0x1
	[0073.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.348] GetFileType (hFile=0x23c) returned 0x1
	[0073.348] WriteFile (in: hFile=0x23c, lpBuffer=0x27ec120*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27ec120*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.351] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0073.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a
	[0073.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b
	[0073.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.354] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.355] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.356] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.356] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a
	[0073.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b
	[0073.357] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.358] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.358] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.359] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.359] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Decrypt.txt", lpFilePart=0x0) returned 0x96
	[0073.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.361] GetFileType (hFile=0x23c) returned 0x1
	[0073.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.361] GetFileType (hFile=0x23c) returned 0x1
	[0073.367] WriteFile (in: hFile=0x23c, lpBuffer=0x25f2c20*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25f2c20*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.371] CloseHandle (hObject=0x23c) returned 1
	[0073.372] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0073.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr", lpFilePart=0x0) returned 0x89
	[0073.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a
	[0073.373] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.374] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.374] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.375] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.375] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr", lpFilePart=0x0) returned 0x89
	[0073.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a
	[0073.376] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.377] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.378] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.378] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.378] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.380] GetFileType (hFile=0x23c) returned 0x1
	[0073.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.380] GetFileType (hFile=0x23c) returned 0x1
	[0073.380] WriteFile (in: hFile=0x23c, lpBuffer=0x25f82e4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25f82e4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.383] CloseHandle (hObject=0x23c) returned 1
	[0073.384] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0073.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi", lpFilePart=0x0) returned 0x89
	[0073.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a
	[0073.385] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.386] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.387] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.387] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.388] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi", lpFilePart=0x0) returned 0x89
	[0073.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a
	[0073.389] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.389] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.390] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.390] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.391] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.392] GetFileType (hFile=0x23c) returned 0x1
	[0073.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.392] GetFileType (hFile=0x23c) returned 0x1
	[0073.393] WriteFile (in: hFile=0x23c, lpBuffer=0x25fd9a8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25fd9a8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.396] CloseHandle (hObject=0x23c) returned 1
	[0073.396] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0073.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr", lpFilePart=0x0) returned 0x89
	[0073.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8a
	[0073.397] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.398] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.398] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.399] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.399] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr", lpFilePart=0x0) returned 0x89
	[0073.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8a
	[0073.401] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.401] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.402] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.403] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.404] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.405] GetFileType (hFile=0x23c) returned 0x1
	[0073.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.405] GetFileType (hFile=0x23c) returned 0x1
	[0073.406] WriteFile (in: hFile=0x23c, lpBuffer=0x260306c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x260306c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.409] CloseHandle (hObject=0x23c) returned 1
	[0073.409] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0073.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu", lpFilePart=0x0) returned 0x89
	[0073.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a
	[0073.410] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.411] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.412] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.412] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.413] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu", lpFilePart=0x0) returned 0x89
	[0073.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a
	[0073.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.414] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.415] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.415] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.416] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.467] GetFileType (hFile=0x23c) returned 0x1
	[0073.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.467] GetFileType (hFile=0x23c) returned 0x1
	[0073.467] WriteFile (in: hFile=0x23c, lpBuffer=0x2608730*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2608730*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.470] CloseHandle (hObject=0x23c) returned 1
	[0073.470] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0073.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id", lpFilePart=0x0) returned 0x89
	[0073.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a
	[0073.471] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.472] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.473] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.473] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.474] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id", lpFilePart=0x0) returned 0x89
	[0073.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a
	[0073.475] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.475] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.476] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.476] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.477] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.478] GetFileType (hFile=0x23c) returned 0x1
	[0073.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.478] GetFileType (hFile=0x23c) returned 0x1
	[0073.479] WriteFile (in: hFile=0x23c, lpBuffer=0x260ddf4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x260ddf4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.482] CloseHandle (hObject=0x23c) returned 1
	[0073.482] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0073.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it", lpFilePart=0x0) returned 0x89
	[0073.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a
	[0073.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.486] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.486] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.487] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.487] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it", lpFilePart=0x0) returned 0x89
	[0073.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a
	[0073.489] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.489] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.490] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.490] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.491] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.491] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.492] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.492] GetFileType (hFile=0x23c) returned 0x1
	[0073.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.493] GetFileType (hFile=0x23c) returned 0x1
	[0073.493] WriteFile (in: hFile=0x23c, lpBuffer=0x26134b8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26134b8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.497] CloseHandle (hObject=0x23c) returned 1
	[0073.497] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0073.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja", lpFilePart=0x0) returned 0x89
	[0073.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a
	[0073.498] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.499] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.500] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.500] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.501] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja", lpFilePart=0x0) returned 0x89
	[0073.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a
	[0073.502] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.502] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.503] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.503] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.504] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.505] GetFileType (hFile=0x23c) returned 0x1
	[0073.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.505] GetFileType (hFile=0x23c) returned 0x1
	[0073.506] WriteFile (in: hFile=0x23c, lpBuffer=0x2618b7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2618b7c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.508] CloseHandle (hObject=0x23c) returned 1
	[0073.509] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0073.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko", lpFilePart=0x0) returned 0x89
	[0073.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a
	[0073.510] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.511] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.512] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.513] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.513] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko", lpFilePart=0x0) returned 0x89
	[0073.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a
	[0073.514] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.515] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.515] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.516] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.516] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.516] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.518] GetFileType (hFile=0x23c) returned 0x1
	[0073.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.518] GetFileType (hFile=0x23c) returned 0x1
	[0073.518] WriteFile (in: hFile=0x23c, lpBuffer=0x261e240*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x261e240*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.522] CloseHandle (hObject=0x23c) returned 1
	[0073.522] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0073.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt", lpFilePart=0x0) returned 0x89
	[0073.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a
	[0073.523] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.524] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.524] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.525] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.526] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt", lpFilePart=0x0) returned 0x89
	[0073.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a
	[0073.527] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.528] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.528] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.529] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.529] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.531] GetFileType (hFile=0x23c) returned 0x1
	[0073.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.531] GetFileType (hFile=0x23c) returned 0x1
	[0073.532] WriteFile (in: hFile=0x23c, lpBuffer=0x2623904*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2623904*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.534] CloseHandle (hObject=0x23c) returned 1
	[0073.535] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0073.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv", lpFilePart=0x0) returned 0x89
	[0073.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a
	[0073.536] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.537] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.537] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.538] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.538] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv", lpFilePart=0x0) returned 0x89
	[0073.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a
	[0073.539] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.540] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.540] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.541] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.541] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.542] GetFileType (hFile=0x23c) returned 0x1
	[0073.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.543] GetFileType (hFile=0x23c) returned 0x1
	[0073.543] WriteFile (in: hFile=0x23c, lpBuffer=0x2628fc8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2628fc8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.549] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0073.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x89
	[0073.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a
	[0073.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.550] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.551] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.551] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.552] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x89
	[0073.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a
	[0073.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.553] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.554] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.554] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.554] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.565] GetFileType (hFile=0x23c) returned 0x1
	[0073.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.565] GetFileType (hFile=0x23c) returned 0x1
	[0073.566] WriteFile (in: hFile=0x23c, lpBuffer=0x262e68c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x262e68c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.569] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0073.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no", lpFilePart=0x0) returned 0x89
	[0073.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a
	[0073.570] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.570] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.571] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.571] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.572] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no", lpFilePart=0x0) returned 0x89
	[0073.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a
	[0073.573] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.573] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.574] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.575] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.575] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.577] GetFileType (hFile=0x23c) returned 0x1
	[0073.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.577] GetFileType (hFile=0x23c) returned 0x1
	[0073.577] WriteFile (in: hFile=0x23c, lpBuffer=0x2633d50*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2633d50*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.580] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0073.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x89
	[0073.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a
	[0073.580] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.581] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.582] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.582] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.583] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x89
	[0073.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a
	[0073.584] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.584] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.585] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.585] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.585] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.587] GetFileType (hFile=0x23c) returned 0x1
	[0073.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.587] GetFileType (hFile=0x23c) returned 0x1
	[0073.587] WriteFile (in: hFile=0x23c, lpBuffer=0x2639414*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2639414*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.591] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0073.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c
	[0073.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d
	[0073.592] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.594] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.595] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.595] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.596] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c
	[0073.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d
	[0073.597] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.597] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.598] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.598] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.598] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0073.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.600] GetFileType (hFile=0x23c) returned 0x1
	[0073.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.600] GetFileType (hFile=0x23c) returned 0x1
	[0073.601] WriteFile (in: hFile=0x23c, lpBuffer=0x263ebdc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x263ebdc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.604] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0073.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c
	[0073.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d
	[0073.605] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.605] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.606] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.606] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.607] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c
	[0073.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d
	[0073.608] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.608] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.608] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.609] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.609] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0073.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.610] GetFileType (hFile=0x23c) returned 0x1
	[0073.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.611] GetFileType (hFile=0x23c) returned 0x1
	[0073.611] WriteFile (in: hFile=0x23c, lpBuffer=0x26443a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26443a4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.615] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0073.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x89
	[0073.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a
	[0073.615] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.616] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.617] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.617] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.618] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x89
	[0073.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a
	[0073.619] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.619] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.620] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.620] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.620] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.622] GetFileType (hFile=0x23c) returned 0x1
	[0073.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.622] GetFileType (hFile=0x23c) returned 0x1
	[0073.622] WriteFile (in: hFile=0x23c, lpBuffer=0x2649a68*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2649a68*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.625] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0073.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru", lpFilePart=0x0) returned 0x89
	[0073.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8a
	[0073.626] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.627] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.627] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.628] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.628] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.629] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru", lpFilePart=0x0) returned 0x89
	[0073.629] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8a
	[0073.629] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.629] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.630] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.630] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.630] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.631] GetFileType (hFile=0x23c) returned 0x1
	[0073.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.632] GetFileType (hFile=0x23c) returned 0x1
	[0073.632] WriteFile (in: hFile=0x23c, lpBuffer=0x264f12c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x264f12c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.636] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="se", cAlternateFileName="")) returned 1
	[0073.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se", lpFilePart=0x0) returned 0x89
	[0073.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\", lpFilePart=0x0) returned 0x8a
	[0073.637] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.638] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.638] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.639] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.639] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se", lpFilePart=0x0) returned 0x89
	[0073.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\", lpFilePart=0x0) returned 0x8a
	[0073.640] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.640] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.641] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.641] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.641] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.643] GetFileType (hFile=0x23c) returned 0x1
	[0073.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.643] GetFileType (hFile=0x23c) returned 0x1
	[0073.643] WriteFile (in: hFile=0x23c, lpBuffer=0x26547f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26547f0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.646] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0073.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk", lpFilePart=0x0) returned 0x89
	[0073.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8a
	[0073.647] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.648] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.648] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.649] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.649] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk", lpFilePart=0x0) returned 0x89
	[0073.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8a
	[0073.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.651] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.652] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.652] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.652] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.654] GetFileType (hFile=0x23c) returned 0x1
	[0073.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.654] GetFileType (hFile=0x23c) returned 0x1
	[0073.654] WriteFile (in: hFile=0x23c, lpBuffer=0x2659eb4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2659eb4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.659] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0073.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl", lpFilePart=0x0) returned 0x89
	[0073.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8a
	[0073.659] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.660] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.661] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.661] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.661] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl", lpFilePart=0x0) returned 0x89
	[0073.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8a
	[0073.662] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.663] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.663] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.664] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.664] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.665] GetFileType (hFile=0x23c) returned 0x1
	[0073.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.666] GetFileType (hFile=0x23c) returned 0x1
	[0073.666] WriteFile (in: hFile=0x23c, lpBuffer=0x265f578*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x265f578*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.669] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0073.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr", lpFilePart=0x0) returned 0x89
	[0073.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a
	[0073.670] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.670] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.671] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.671] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.671] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr", lpFilePart=0x0) returned 0x89
	[0073.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a
	[0073.672] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.673] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.673] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.674] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.674] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.674] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.675] GetFileType (hFile=0x23c) returned 0x1
	[0073.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.675] GetFileType (hFile=0x23c) returned 0x1
	[0073.676] WriteFile (in: hFile=0x23c, lpBuffer=0x2664c3c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2664c3c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.679] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0073.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th", lpFilePart=0x0) returned 0x89
	[0073.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a
	[0073.679] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.680] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.681] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.681] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.681] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th", lpFilePart=0x0) returned 0x89
	[0073.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a
	[0073.683] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.683] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.684] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.684] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.684] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.686] GetFileType (hFile=0x23c) returned 0x1
	[0073.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.686] GetFileType (hFile=0x23c) returned 0x1
	[0073.687] WriteFile (in: hFile=0x23c, lpBuffer=0x266a300*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x266a300*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.690] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0073.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr", lpFilePart=0x0) returned 0x89
	[0073.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a
	[0073.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.691] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.691] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.692] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.692] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr", lpFilePart=0x0) returned 0x89
	[0073.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a
	[0073.693] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.694] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.694] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.694] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.695] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.696] GetFileType (hFile=0x23c) returned 0x1
	[0073.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.696] GetFileType (hFile=0x23c) returned 0x1
	[0073.697] WriteFile (in: hFile=0x23c, lpBuffer=0x266f9c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x266f9c4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.701] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0073.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk", lpFilePart=0x0) returned 0x89
	[0073.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a
	[0073.702] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.702] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.703] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.703] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.703] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk", lpFilePart=0x0) returned 0x89
	[0073.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a
	[0073.704] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.704] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.705] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.705] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.705] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.706] GetFileType (hFile=0x23c) returned 0x1
	[0073.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.707] GetFileType (hFile=0x23c) returned 0x1
	[0073.707] WriteFile (in: hFile=0x23c, lpBuffer=0x2675088*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2675088*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.710] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0073.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi", lpFilePart=0x0) returned 0x89
	[0073.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a
	[0073.711] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.712] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.712] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.712] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.712] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi", lpFilePart=0x0) returned 0x89
	[0073.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a
	[0073.724] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.725] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.725] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.726] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.726] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Decrypt.txt", lpFilePart=0x0) returned 0x95
	[0073.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.727] GetFileType (hFile=0x23c) returned 0x1
	[0073.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.728] GetFileType (hFile=0x23c) returned 0x1
	[0073.728] WriteFile (in: hFile=0x23c, lpBuffer=0x267a74c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x267a74c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.732] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1
	[0073.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c
	[0073.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d
	[0073.732] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.733] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.733] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.734] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.734] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c
	[0073.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d
	[0073.735] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.735] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.735] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.736] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.736] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0073.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.737] GetFileType (hFile=0x23c) returned 0x1
	[0073.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.737] GetFileType (hFile=0x23c) returned 0x1
	[0073.738] WriteFile (in: hFile=0x23c, lpBuffer=0x267ff14*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x267ff14*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.741] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0073.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c
	[0073.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d
	[0073.742] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.742] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.743] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.743] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0073.743] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c
	[0073.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d
	[0073.744] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0073.745] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.745] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0073.745] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.745] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0073.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0073.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0073.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0073.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0073.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0073.747] GetFileType (hFile=0x23c) returned 0x1
	[0073.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0073.747] GetFileType (hFile=0x23c) returned 0x1
	[0073.747] WriteFile (in: hFile=0x23c, lpBuffer=0x26856dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26856dc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0073.753] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.753] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0073.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0073.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0073.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0073.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales", lpFilePart=0x0) returned 0x86
	[0073.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\", lpFilePart=0x0) returned 0x87
	[0073.754] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0073.754] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.755] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc9d8310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc9d8310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0073.755] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc9fe470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc9fe470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0073.755] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfca245d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfca245d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0073.755] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfca4a730, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfca4a730, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0073.756] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfca70890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfca70890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0073.756] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfca70890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfca70890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0073.756] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfca969f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfca969f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0073.757] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcabcb50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcabcb50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1
	[0073.757] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcae2cb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcae2cb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0073.758] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcb08e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcb08e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0073.758] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcb2ef70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcb2ef70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0073.758] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcb550d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcb550d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0073.758] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcb7b230, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcb7b230, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0073.759] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcba1390, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcba1390, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0073.759] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcc39910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcc39910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0073.761] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcc39910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcc39910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0073.761] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcc5fa70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcc5fa70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0073.761] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcc85bd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcc85bd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0073.762] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfccabd30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfccabd30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0073.762] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfccd1e90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfccd1e90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0073.762] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfccd1e90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfccd1e90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0073.763] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfccf7ff0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfccf7ff0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0073.763] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcd442b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcd442b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0073.763] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcd442b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcd442b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0073.764] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcd6a410, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcd6a410, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0073.764] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcd90570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcd90570, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0073.765] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcdb66d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcdb66d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0073.765] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcdb66d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcdb66d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0073.765] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcddc830, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcddc830, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="se", cAlternateFileName="")) returned 1
	[0073.766] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfce02990, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfce02990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0073.766] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfce02990, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfce02990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0073.766] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfce28af0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfce28af0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0073.767] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfce4ec50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfce4ec50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0073.767] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfce4ec50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfce4ec50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0073.767] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfce74db0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfce74db0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0073.768] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfce9af10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfce9af10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0073.768] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcec1070, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcec1070, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1
	[0073.768] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcee71d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcee71d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0073.769] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcee71d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcee71d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0
	[0073.769] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0073.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0073.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0073.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Decrypt.txt", lpFilePart=0x0) returned 0x92
	[0073.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0073.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0073.771] GetFileType (hFile=0x238) returned 0x1
	[0073.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0073.771] GetFileType (hFile=0x238) returned 0x1
	[0073.772] WriteFile (in: hFile=0x238, lpBuffer=0x268eb5c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x268eb5c*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0073.775] CloseHandle (hObject=0x238) returned 1
	[0073.777] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0073.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0073.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata", lpFilePart=0x0) returned 0x87
	[0073.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\", lpFilePart=0x0) returned 0x88
	[0073.777] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0073.780] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.780] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1
	[0073.781] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0
	[0073.781] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0073.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0073.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0073.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0073.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata", lpFilePart=0x0) returned 0x87
	[0073.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\", lpFilePart=0x0) returned 0x88
	[0073.782] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0073.783] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.784] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1
	[0073.785] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.785] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0073.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0073.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0073.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Decrypt.txt", lpFilePart=0x0) returned 0x93
	[0073.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0073.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0073.787] GetFileType (hFile=0x238) returned 0x1
	[0073.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0073.787] GetFileType (hFile=0x238) returned 0x1
	[0073.788] WriteFile (in: hFile=0x238, lpBuffer=0x2694278*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x2694278*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0073.791] CloseHandle (hObject=0x238) returned 1
	[0073.791] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.792] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0073.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0073.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0073.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0073.792] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0", lpFilePart=0x0) returned 0x7d
	[0073.792] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\", lpFilePart=0x0) returned 0x7e
	[0073.793] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0073.794] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0073.794] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x0, dwReserved1=0x0, cFileName="128.png", cAlternateFileName="")) returned 1
	[0073.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", lpFilePart=0x0) returned 0x85
	[0073.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0073.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0073.795] GetFileType (hFile=0x238) returned 0x1
	[0073.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0073.796] GetFileType (hFile=0x238) returned 0x1
	[0073.796] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x180f
	[0073.796] ReadFile (in: hFile=0x238, lpBuffer=0x2696a30, nNumberOfBytesToRead=0x180f, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x2696a30*, lpNumberOfBytesRead=0x26eac4*=0x180f, lpOverlapped=0x0) returned 1
	[0073.801] CloseHandle (hObject=0x238) returned 1
	[0073.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.KEKW", lpFilePart=0x0) returned 0x8a
	[0073.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0073.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0073.802] GetFileType (hFile=0x238) returned 0x1
	[0073.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0073.802] GetFileType (hFile=0x238) returned 0x1
	[0073.803] WriteFile (in: hFile=0x238, lpBuffer=0x2699abc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2699abc*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0073.809] CloseHandle (hObject=0x238) returned 1
	[0073.810] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", lpFilePart=0x0) returned 0x85
	[0073.810] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 1
	[0073.813] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x869b0fb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0073.813] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcf0d330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcf0d330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0073.814] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcf33490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcf33490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0073.815] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcf33490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcf33490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0
	[0073.815] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0073.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0073.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0073.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Decrypt.txt", lpFilePart=0x0) returned 0x89
	[0073.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0073.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0073.817] GetFileType (hFile=0x234) returned 0x1
	[0073.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0073.817] GetFileType (hFile=0x234) returned 0x1
	[0073.817] WriteFile (in: hFile=0x234, lpBuffer=0x269cf3c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x269cf3c*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0073.820] CloseHandle (hObject=0x234) returned 1
	[0073.821] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0073.821] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0073.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0073.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0073.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0073.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", lpFilePart=0x0) returned 0x77
	[0073.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", lpFilePart=0x0) returned 0x78
	[0074.042] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0074.045] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.046] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcf7f750, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcf7f750, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.1_0", cAlternateFileName="")) returned 1
	[0074.046] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfcf7f750, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfcf7f750, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.1_0", cAlternateFileName="")) returned 0
	[0074.047] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0074.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0074.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0074.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Decrypt.txt", lpFilePart=0x0) returned 0x83
	[0074.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0074.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0074.056] GetFileType (hFile=0x230) returned 0x1
	[0074.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0074.057] GetFileType (hFile=0x230) returned 0x1
	[0074.057] WriteFile (in: hFile=0x230, lpBuffer=0x26a0860*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x26a0860*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0074.060] CloseHandle (hObject=0x230) returned 1
	[0074.061] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1
	[0074.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0074.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm", lpFilePart=0x0) returned 0x77
	[0074.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\", lpFilePart=0x0) returned 0x78
	[0074.062] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0074.069] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.069] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 1
	[0074.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0074.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0", lpFilePart=0x0) returned 0x86
	[0074.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\", lpFilePart=0x0) returned 0x87
	[0074.070] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0074.122] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.126] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="angular.js", cAlternateFileName="")) returned 1
	[0074.127] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83641800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83643f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xa89c, dwReserved0=0x0, dwReserved1=0x0, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 1
	[0074.127] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83646620, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83648d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x181aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 1
	[0074.128] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8364db50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8364db50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 1
	[0074.128] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83652970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83657790, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3a258, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 1
	[0074.129] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8365ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836613d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xce17, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 1
	[0074.129] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_setup", cAlternateFileName="CAST_S~1")) returned 1
	[0074.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0074.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup", lpFilePart=0x0) returned 0x91
	[0074.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\", lpFilePart=0x0) returned 0x92
	[0074.130] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0074.151] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.152] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app.css", cAlternateFileName="")) returned 1
	[0074.152] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366b010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366d720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x221da, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app.js", cAlternateFileName="")) returned 1
	[0074.153] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366fe30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366fe30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app_redirect.js", cAlternateFileName="CAST_A~1.JS")) returned 1
	[0074.153] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x0, dwReserved1=0x0, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 1
	[0074.154] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83679a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83679a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="devices.html", cAlternateFileName="DEVICE~1.HTM")) returned 1
	[0074.154] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8367c180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8367c180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0074.155] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83685dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83685dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="offers.html", cAlternateFileName="OFFERS~1.HTM")) returned 1
	[0074.155] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 1
	[0074.156] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 0
	[0074.156] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0074.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0074.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0074.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0074.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup", lpFilePart=0x0) returned 0x91
	[0074.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\", lpFilePart=0x0) returned 0x92
	[0074.160] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0074.163] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.163] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app.css", cAlternateFileName="")) returned 1
	[0074.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", lpFilePart=0x0) returned 0x9e
	[0074.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0074.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.164] GetFileType (hFile=0x23c) returned 0x1
	[0074.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0074.164] GetFileType (hFile=0x23c) returned 0x1
	[0074.164] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x1a1d
	[0074.165] ReadFile (in: hFile=0x23c, lpBuffer=0x26a9718, nNumberOfBytesToRead=0x1a1d, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26a9718*, lpNumberOfBytesRead=0x26ea24*=0x1a1d, lpOverlapped=0x0) returned 1
	[0074.171] CloseHandle (hObject=0x23c) returned 1
	[0074.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.KEKW", lpFilePart=0x0) returned 0xa3
	[0074.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0074.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.173] GetFileType (hFile=0x23c) returned 0x1
	[0074.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0074.173] GetFileType (hFile=0x23c) returned 0x1
	[0074.173] WriteFile (in: hFile=0x23c, lpBuffer=0x26ac9a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26ac9a0*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0074.176] CloseHandle (hObject=0x23c) returned 1
	[0074.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", lpFilePart=0x0) returned 0x9e
	[0074.177] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 1
	[0074.181] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366b010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366d720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x221da, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app.js", cAlternateFileName="")) returned 1
	[0074.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", lpFilePart=0x0) returned 0x9d
	[0074.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0074.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.204] GetFileType (hFile=0x23c) returned 0x1
	[0074.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0074.204] GetFileType (hFile=0x23c) returned 0x1
	[0074.204] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x221da
	[0074.206] ReadFile (in: hFile=0x23c, lpBuffer=0x36f4c80, nNumberOfBytesToRead=0x221da, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x36f4c80*, lpNumberOfBytesRead=0x26ea24*=0x221da, lpOverlapped=0x0) returned 1
	[0074.222] CloseHandle (hObject=0x23c) returned 1
	[0074.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.KEKW", lpFilePart=0x0) returned 0xa2
	[0074.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0074.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.224] GetFileType (hFile=0x23c) returned 0x1
	[0074.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0074.224] GetFileType (hFile=0x23c) returned 0x1
	[0074.224] WriteFile (in: hFile=0x23c, lpBuffer=0x26afc60*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26afc60*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0074.227] CloseHandle (hObject=0x23c) returned 1
	[0074.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", lpFilePart=0x0) returned 0x9d
	[0074.229] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js")) returned 1
	[0074.235] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366fe30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366fe30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_app_redirect.js", cAlternateFileName="CAST_A~1.JS")) returned 1
	[0074.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", lpFilePart=0x0) returned 0xa6
	[0074.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0074.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.238] GetFileType (hFile=0x23c) returned 0x1
	[0074.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0074.238] GetFileType (hFile=0x23c) returned 0x1
	[0074.238] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0xf2
	[0074.239] ReadFile (in: hFile=0x23c, lpBuffer=0x26b1880, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26b1880*, lpNumberOfBytesRead=0x26ea24*=0xf2, lpOverlapped=0x0) returned 1
	[0074.242] CloseHandle (hObject=0x23c) returned 1
	[0074.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.KEKW", lpFilePart=0x0) returned 0xab
	[0074.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0074.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.254] GetFileType (hFile=0x23c) returned 0x1
	[0074.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0074.254] GetFileType (hFile=0x23c) returned 0x1
	[0074.255] WriteFile (in: hFile=0x23c, lpBuffer=0x26b4118*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26b4118*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0074.258] CloseHandle (hObject=0x23c) returned 1
	[0074.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", lpFilePart=0x0) returned 0xa6
	[0074.259] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js")) returned 1
	[0074.263] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x0, dwReserved1=0x0, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 1
	[0074.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", lpFilePart=0x0) returned 0xaa
	[0074.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0074.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.264] GetFileType (hFile=0x23c) returned 0x1
	[0074.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0074.265] GetFileType (hFile=0x23c) returned 0x1
	[0074.265] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x1bef
	[0074.265] ReadFile (in: hFile=0x23c, lpBuffer=0x26b5c8c, nNumberOfBytesToRead=0x1bef, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26b5c8c*, lpNumberOfBytesRead=0x26ea24*=0x1bef, lpOverlapped=0x0) returned 1
	[0074.269] CloseHandle (hObject=0x23c) returned 1
	[0074.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.KEKW", lpFilePart=0x0) returned 0xaf
	[0074.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0074.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.271] GetFileType (hFile=0x23c) returned 0x1
	[0074.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0074.271] GetFileType (hFile=0x23c) returned 0x1
	[0074.272] WriteFile (in: hFile=0x23c, lpBuffer=0x26b912c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26b912c*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0074.275] CloseHandle (hObject=0x23c) returned 1
	[0074.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", lpFilePart=0x0) returned 0xaa
	[0074.276] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 1
	[0074.279] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83679a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83679a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="devices.html", cAlternateFileName="DEVICE~1.HTM")) returned 1
	[0074.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", lpFilePart=0x0) returned 0x9e
	[0074.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0074.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.280] GetFileType (hFile=0x23c) returned 0x1
	[0074.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0074.281] GetFileType (hFile=0x23c) returned 0x1
	[0074.281] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x3b
	[0074.281] ReadFile (in: hFile=0x23c, lpBuffer=0x26bac38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26bac38*, lpNumberOfBytesRead=0x26ea24*=0x3b, lpOverlapped=0x0) returned 1
	[0074.285] CloseHandle (hObject=0x23c) returned 1
	[0074.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.KEKW", lpFilePart=0x0) returned 0xa3
	[0074.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0074.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.286] GetFileType (hFile=0x23c) returned 0x1
	[0074.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0074.287] GetFileType (hFile=0x23c) returned 0x1
	[0074.287] WriteFile (in: hFile=0x23c, lpBuffer=0x26bd4a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26bd4a0*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0074.300] CloseHandle (hObject=0x23c) returned 1
	[0074.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", lpFilePart=0x0) returned 0x9e
	[0074.301] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html")) returned 1
	[0074.304] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8367c180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8367c180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1
	[0074.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", lpFilePart=0x0) returned 0x9c
	[0074.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0074.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.306] GetFileType (hFile=0x23c) returned 0x1
	[0074.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0074.307] GetFileType (hFile=0x23c) returned 0x1
	[0074.307] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x828
	[0074.307] ReadFile (in: hFile=0x23c, lpBuffer=0x26bf75c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26bf75c*, lpNumberOfBytesRead=0x26ea24*=0x828, lpOverlapped=0x0) returned 1
	[0074.312] CloseHandle (hObject=0x23c) returned 1
	[0074.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.KEKW", lpFilePart=0x0) returned 0xa1
	[0074.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0074.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.314] GetFileType (hFile=0x23c) returned 0x1
	[0074.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0074.314] GetFileType (hFile=0x23c) returned 0x1
	[0074.314] WriteFile (in: hFile=0x23c, lpBuffer=0x26c1fb8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26c1fb8*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0074.317] CloseHandle (hObject=0x23c) returned 1
	[0074.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", lpFilePart=0x0) returned 0x9c
	[0074.318] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html")) returned 1
	[0074.321] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83685dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83685dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="offers.html", cAlternateFileName="OFFERS~1.HTM")) returned 1
	[0074.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", lpFilePart=0x0) returned 0x9d
	[0074.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0074.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.325] GetFileType (hFile=0x23c) returned 0x1
	[0074.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0074.326] GetFileType (hFile=0x23c) returned 0x1
	[0074.326] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x3b
	[0074.326] ReadFile (in: hFile=0x23c, lpBuffer=0x26c3a8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26c3a8c*, lpNumberOfBytesRead=0x26ea24*=0x3b, lpOverlapped=0x0) returned 1
	[0074.329] CloseHandle (hObject=0x23c) returned 1
	[0074.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.KEKW", lpFilePart=0x0) returned 0xa2
	[0074.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0074.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.331] GetFileType (hFile=0x23c) returned 0x1
	[0074.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0074.331] GetFileType (hFile=0x23c) returned 0x1
	[0074.332] WriteFile (in: hFile=0x23c, lpBuffer=0x26c62f4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26c62f4*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0074.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", lpFilePart=0x0) returned 0x9d
	[0074.340] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html")) returned 1
	[0074.344] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 1
	[0074.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", lpFilePart=0x0) returned 0x9c
	[0074.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0074.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.345] GetFileType (hFile=0x23c) returned 0x1
	[0074.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0074.345] GetFileType (hFile=0x23c) returned 0x1
	[0074.345] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x3b
	[0074.346] ReadFile (in: hFile=0x23c, lpBuffer=0x26c7dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26c7dc0*, lpNumberOfBytesRead=0x26ea24*=0x3b, lpOverlapped=0x0) returned 1
	[0074.349] CloseHandle (hObject=0x23c) returned 1
	[0074.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.KEKW", lpFilePart=0x0) returned 0xa1
	[0074.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0074.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.350] GetFileType (hFile=0x23c) returned 0x1
	[0074.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0074.351] GetFileType (hFile=0x23c) returned 0x1
	[0074.351] WriteFile (in: hFile=0x23c, lpBuffer=0x26ca61c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26ca61c*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0074.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", lpFilePart=0x0) returned 0x9c
	[0074.355] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html")) returned 1
	[0074.359] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.359] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0074.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0074.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0074.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Decrypt.txt", lpFilePart=0x0) returned 0x9d
	[0074.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0074.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0074.361] GetFileType (hFile=0x238) returned 0x1
	[0074.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0074.361] GetFileType (hFile=0x238) returned 0x1
	[0074.361] WriteFile (in: hFile=0x238, lpBuffer=0x26ccf44*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x26ccf44*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0074.364] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_route_details", cAlternateFileName="CLOUD_~1")) returned 1
	[0074.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0074.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details", lpFilePart=0x0) returned 0x9a
	[0074.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\", lpFilePart=0x0) returned 0x9b
	[0074.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0074.366] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.367] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x0, dwReserved1=0x0, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 1
	[0074.368] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x0, dwReserved1=0x0, cFileName="view.js", cAlternateFileName="")) returned 1
	[0074.371] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x0, dwReserved1=0x0, cFileName="view.js", cAlternateFileName="")) returned 0
	[0074.371] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0074.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0074.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0074.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0074.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details", lpFilePart=0x0) returned 0x9a
	[0074.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\", lpFilePart=0x0) returned 0x9b
	[0074.372] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0074.373] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.373] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x0, dwReserved1=0x0, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 1
	[0074.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", lpFilePart=0x0) returned 0xa4
	[0074.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0074.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.374] GetFileType (hFile=0x23c) returned 0x1
	[0074.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0074.375] GetFileType (hFile=0x23c) returned 0x1
	[0074.375] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x174c
	[0074.375] ReadFile (in: hFile=0x23c, lpBuffer=0x26d17a4, nNumberOfBytesToRead=0x174c, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26d17a4*, lpNumberOfBytesRead=0x26ea24*=0x174c, lpOverlapped=0x0) returned 1
	[0074.379] CloseHandle (hObject=0x23c) returned 1
	[0074.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.KEKW", lpFilePart=0x0) returned 0xa9
	[0074.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0074.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.381] GetFileType (hFile=0x23c) returned 0x1
	[0074.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0074.381] GetFileType (hFile=0x23c) returned 0x1
	[0074.382] WriteFile (in: hFile=0x23c, lpBuffer=0x26d476c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26d476c*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0074.385] CloseHandle (hObject=0x23c) returned 1
	[0074.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", lpFilePart=0x0) returned 0xa4
	[0074.387] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 1
	[0074.390] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x0, dwReserved1=0x0, cFileName="view.js", cAlternateFileName="")) returned 1
	[0074.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", nBufferLength=0x105, lpBuffer=0x26e47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", lpFilePart=0x0) returned 0xa2
	[0074.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e970) returned 1
	[0074.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.393] GetFileType (hFile=0x23c) returned 0x1
	[0074.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e96c) returned 1
	[0074.393] GetFileType (hFile=0x23c) returned 0x1
	[0074.393] GetFileSize (in: hFile=0x23c, lpFileSizeHigh=0x26ea78 | out: lpFileSizeHigh=0x26ea78*=0x0) returned 0x945
	[0074.393] ReadFile (in: hFile=0x23c, lpBuffer=0x26d6b64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ea24, lpOverlapped=0x0 | out: lpBuffer=0x26d6b64*, lpNumberOfBytesRead=0x26ea24*=0x945, lpOverlapped=0x0) returned 1
	[0074.398] CloseHandle (hObject=0x23c) returned 1
	[0074.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.KEKW", lpFilePart=0x0) returned 0xa7
	[0074.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a4) returned 1
	[0074.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c
	[0074.399] GetFileType (hFile=0x23c) returned 0x1
	[0074.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e9a0) returned 1
	[0074.400] GetFileType (hFile=0x23c) returned 0x1
	[0074.400] WriteFile (in: hFile=0x23c, lpBuffer=0x26d93d4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26e9c8, lpOverlapped=0x0 | out: lpBuffer=0x26d93d4*, lpNumberOfBytesWritten=0x26e9c8*=0x10, lpOverlapped=0x0) returned 1
	[0074.403] CloseHandle (hObject=0x23c) returned 1
	[0074.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", nBufferLength=0x105, lpBuffer=0x26e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", lpFilePart=0x0) returned 0xa2
	[0074.404] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js")) returned 1
	[0074.407] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.407] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0074.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0074.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0074.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Decrypt.txt", lpFilePart=0x0) returned 0xa6
	[0074.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0074.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0074.413] GetFileType (hFile=0x238) returned 0x1
	[0074.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0074.413] GetFileType (hFile=0x238) returned 0x1
	[0074.413] WriteFile (in: hFile=0x238, lpBuffer=0x26dbd30*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x26dbd30*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0074.450] CloseHandle (hObject=0x238) returned 1
	[0074.450] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83696f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83699640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x0, dwReserved1=0x0, cFileName="common.js", cAlternateFileName="")) returned 1
	[0074.451] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8369bd50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8369bd50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback.css", cAlternateFileName="")) returned 1
	[0074.452] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a0b70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a0b70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 1
	[0074.452] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a5990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a5990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 1
	[0074.453] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836af5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8395fd70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0074.453] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b1ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b43f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x46039, dwReserved0=0x0, dwReserved1=0x0, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 1
	[0074.454] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x7c33, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 1
	[0074.454] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2adeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 1
	[0074.455] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x794cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 1
	[0074.455] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x941, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 1
	[0074.456] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0074.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0074.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales", lpFilePart=0x0) returned 0x8f
	[0074.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\", lpFilePart=0x0) returned 0x90
	[0074.457] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0074.462] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.464] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1
	[0074.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am", lpFilePart=0x0) returned 0x92
	[0074.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\", lpFilePart=0x0) returned 0x93
	[0074.465] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.467] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.467] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.468] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.469] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am", lpFilePart=0x0) returned 0x92
	[0074.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\", lpFilePart=0x0) returned 0x93
	[0074.470] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.470] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.471] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.472] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.472] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.474] GetFileType (hFile=0x23c) returned 0x1
	[0074.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.474] GetFileType (hFile=0x23c) returned 0x1
	[0074.474] WriteFile (in: hFile=0x23c, lpBuffer=0x26e47fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26e47fc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.477] CloseHandle (hObject=0x23c) returned 1
	[0074.479] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0074.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar", lpFilePart=0x0) returned 0x92
	[0074.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x93
	[0074.480] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.482] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.483] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.483] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.484] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar", lpFilePart=0x0) returned 0x92
	[0074.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x93
	[0074.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.485] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.486] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.486] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.487] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.488] GetFileType (hFile=0x23c) returned 0x1
	[0074.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.488] GetFileType (hFile=0x23c) returned 0x1
	[0074.489] WriteFile (in: hFile=0x23c, lpBuffer=0x26ea1a0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26ea1a0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.491] CloseHandle (hObject=0x23c) returned 1
	[0074.492] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0074.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg", lpFilePart=0x0) returned 0x92
	[0074.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x93
	[0074.493] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.494] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.494] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.495] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.495] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg", lpFilePart=0x0) returned 0x92
	[0074.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x93
	[0074.500] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.500] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.501] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.501] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.501] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.502] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.503] GetFileType (hFile=0x23c) returned 0x1
	[0074.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.503] GetFileType (hFile=0x23c) returned 0x1
	[0074.503] WriteFile (in: hFile=0x23c, lpBuffer=0x26efb44*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26efb44*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.506] CloseHandle (hObject=0x23c) returned 1
	[0074.506] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1
	[0074.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn", lpFilePart=0x0) returned 0x92
	[0074.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\", lpFilePart=0x0) returned 0x93
	[0074.507] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.510] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.510] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.511] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.512] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn", lpFilePart=0x0) returned 0x92
	[0074.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\", lpFilePart=0x0) returned 0x93
	[0074.513] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.513] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.514] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.514] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.515] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.516] GetFileType (hFile=0x23c) returned 0x1
	[0074.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.517] GetFileType (hFile=0x23c) returned 0x1
	[0074.517] WriteFile (in: hFile=0x23c, lpBuffer=0x26f54e8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26f54e8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.520] CloseHandle (hObject=0x23c) returned 1
	[0074.521] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0074.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca", lpFilePart=0x0) returned 0x92
	[0074.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x93
	[0074.522] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.522] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.523] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.524] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.524] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca", lpFilePart=0x0) returned 0x92
	[0074.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x93
	[0074.525] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.526] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.526] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.527] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.527] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.528] GetFileType (hFile=0x23c) returned 0x1
	[0074.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.529] GetFileType (hFile=0x23c) returned 0x1
	[0074.529] WriteFile (in: hFile=0x23c, lpBuffer=0x26fae8c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x26fae8c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.533] CloseHandle (hObject=0x23c) returned 1
	[0074.533] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0074.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs", lpFilePart=0x0) returned 0x92
	[0074.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x93
	[0074.534] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.541] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.542] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.543] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.543] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs", lpFilePart=0x0) returned 0x92
	[0074.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x93
	[0074.544] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.545] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.545] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.546] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.546] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.548] GetFileType (hFile=0x23c) returned 0x1
	[0074.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.548] GetFileType (hFile=0x23c) returned 0x1
	[0074.548] WriteFile (in: hFile=0x23c, lpBuffer=0x2700830*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2700830*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.552] CloseHandle (hObject=0x23c) returned 1
	[0074.553] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0074.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da", lpFilePart=0x0) returned 0x92
	[0074.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\", lpFilePart=0x0) returned 0x93
	[0074.554] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.555] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.555] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.556] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.556] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da", lpFilePart=0x0) returned 0x92
	[0074.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\", lpFilePart=0x0) returned 0x93
	[0074.557] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.558] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.558] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.559] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.559] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.561] GetFileType (hFile=0x23c) returned 0x1
	[0074.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.561] GetFileType (hFile=0x23c) returned 0x1
	[0074.561] WriteFile (in: hFile=0x23c, lpBuffer=0x27061d4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27061d4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.565] CloseHandle (hObject=0x23c) returned 1
	[0074.566] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0074.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de", lpFilePart=0x0) returned 0x92
	[0074.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\", lpFilePart=0x0) returned 0x93
	[0074.566] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.569] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.569] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.570] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.570] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de", lpFilePart=0x0) returned 0x92
	[0074.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\", lpFilePart=0x0) returned 0x93
	[0074.572] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.572] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.572] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.573] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.573] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.575] GetFileType (hFile=0x23c) returned 0x1
	[0074.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.575] GetFileType (hFile=0x23c) returned 0x1
	[0074.575] WriteFile (in: hFile=0x23c, lpBuffer=0x270bb78*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x270bb78*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.581] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0074.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el", lpFilePart=0x0) returned 0x92
	[0074.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\", lpFilePart=0x0) returned 0x93
	[0074.581] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.582] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.583] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.583] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.583] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el", lpFilePart=0x0) returned 0x92
	[0074.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\", lpFilePart=0x0) returned 0x93
	[0074.584] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.585] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.585] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.586] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.586] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.588] GetFileType (hFile=0x23c) returned 0x1
	[0074.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.588] GetFileType (hFile=0x23c) returned 0x1
	[0074.588] WriteFile (in: hFile=0x23c, lpBuffer=0x271151c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x271151c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.592] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1
	[0074.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en", lpFilePart=0x0) returned 0x92
	[0074.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\", lpFilePart=0x0) returned 0x93
	[0074.592] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.594] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.595] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.595] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.595] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en", lpFilePart=0x0) returned 0x92
	[0074.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\", lpFilePart=0x0) returned 0x93
	[0074.596] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.597] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.597] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.598] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.598] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.599] GetFileType (hFile=0x23c) returned 0x1
	[0074.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.599] GetFileType (hFile=0x23c) returned 0x1
	[0074.600] WriteFile (in: hFile=0x23c, lpBuffer=0x2716ec0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2716ec0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.603] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0074.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es", lpFilePart=0x0) returned 0x92
	[0074.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\", lpFilePart=0x0) returned 0x93
	[0074.604] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.604] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.605] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.605] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.606] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es", lpFilePart=0x0) returned 0x92
	[0074.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\", lpFilePart=0x0) returned 0x93
	[0074.607] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.607] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.607] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.608] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.608] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.610] GetFileType (hFile=0x23c) returned 0x1
	[0074.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.610] GetFileType (hFile=0x23c) returned 0x1
	[0074.610] WriteFile (in: hFile=0x23c, lpBuffer=0x271c864*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x271c864*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.613] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0074.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et", lpFilePart=0x0) returned 0x92
	[0074.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\", lpFilePart=0x0) returned 0x93
	[0074.614] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.616] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.617] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.617] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.618] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et", lpFilePart=0x0) returned 0x92
	[0074.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\", lpFilePart=0x0) returned 0x93
	[0074.618] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.619] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.619] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.620] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.620] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.621] GetFileType (hFile=0x23c) returned 0x1
	[0074.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.621] GetFileType (hFile=0x23c) returned 0x1
	[0074.621] WriteFile (in: hFile=0x23c, lpBuffer=0x2722208*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2722208*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.625] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1
	[0074.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa", lpFilePart=0x0) returned 0x92
	[0074.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\", lpFilePart=0x0) returned 0x93
	[0074.625] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.626] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.627] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.627] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.627] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa", lpFilePart=0x0) returned 0x92
	[0074.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\", lpFilePart=0x0) returned 0x93
	[0074.628] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.629] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.629] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.630] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.630] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.631] GetFileType (hFile=0x23c) returned 0x1
	[0074.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.631] GetFileType (hFile=0x23c) returned 0x1
	[0074.632] WriteFile (in: hFile=0x23c, lpBuffer=0x2727bac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2727bac*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.635] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0074.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi", lpFilePart=0x0) returned 0x92
	[0074.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x93
	[0074.636] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.638] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.638] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.639] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.639] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi", lpFilePart=0x0) returned 0x92
	[0074.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x93
	[0074.640] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.640] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.641] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.641] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.641] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.643] GetFileType (hFile=0x23c) returned 0x1
	[0074.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.643] GetFileType (hFile=0x23c) returned 0x1
	[0074.643] WriteFile (in: hFile=0x23c, lpBuffer=0x272d550*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x272d550*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.646] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0074.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil", lpFilePart=0x0) returned 0x93
	[0074.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x94
	[0074.647] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.647] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.648] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.648] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.648] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil", lpFilePart=0x0) returned 0x93
	[0074.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x94
	[0074.650] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.650] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.651] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.651] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.652] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Decrypt.txt", lpFilePart=0x0) returned 0x9f
	[0074.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.654] GetFileType (hFile=0x23c) returned 0x1
	[0074.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.654] GetFileType (hFile=0x23c) returned 0x1
	[0074.654] WriteFile (in: hFile=0x23c, lpBuffer=0x2732f18*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2732f18*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.657] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0074.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr", lpFilePart=0x0) returned 0x92
	[0074.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x93
	[0074.658] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.661] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.662] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.662] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.663] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr", lpFilePart=0x0) returned 0x92
	[0074.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x93
	[0074.664] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.665] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.665] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.666] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.666] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.668] GetFileType (hFile=0x23c) returned 0x1
	[0074.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.668] GetFileType (hFile=0x23c) returned 0x1
	[0074.669] WriteFile (in: hFile=0x23c, lpBuffer=0x27388bc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27388bc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.672] CloseHandle (hObject=0x23c) returned 1
	[0074.672] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1
	[0074.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu", lpFilePart=0x0) returned 0x92
	[0074.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\", lpFilePart=0x0) returned 0x93
	[0074.673] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.674] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.675] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.676] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.676] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu", lpFilePart=0x0) returned 0x92
	[0074.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\", lpFilePart=0x0) returned 0x93
	[0074.677] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.678] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.679] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.679] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.679] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.683] GetFileType (hFile=0x23c) returned 0x1
	[0074.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.684] GetFileType (hFile=0x23c) returned 0x1
	[0074.684] WriteFile (in: hFile=0x23c, lpBuffer=0x273e260*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x273e260*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.687] CloseHandle (hObject=0x23c) returned 1
	[0074.687] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0074.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi", lpFilePart=0x0) returned 0x92
	[0074.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x93
	[0074.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.693] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.693] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.694] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.694] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi", lpFilePart=0x0) returned 0x92
	[0074.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x93
	[0074.697] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.697] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.698] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.698] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.699] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.701] GetFileType (hFile=0x23c) returned 0x1
	[0074.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.701] GetFileType (hFile=0x23c) returned 0x1
	[0074.701] WriteFile (in: hFile=0x23c, lpBuffer=0x2743c04*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2743c04*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.705] CloseHandle (hObject=0x23c) returned 1
	[0074.705] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0074.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr", lpFilePart=0x0) returned 0x92
	[0074.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x93
	[0074.706] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.707] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.708] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.708] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.709] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr", lpFilePart=0x0) returned 0x92
	[0074.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x93
	[0074.710] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.711] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.712] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.712] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.713] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.714] GetFileType (hFile=0x23c) returned 0x1
	[0074.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.715] GetFileType (hFile=0x23c) returned 0x1
	[0074.715] WriteFile (in: hFile=0x23c, lpBuffer=0x27495a8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27495a8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.718] CloseHandle (hObject=0x23c) returned 1
	[0074.719] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0074.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu", lpFilePart=0x0) returned 0x92
	[0074.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x93
	[0074.720] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.742] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.743] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.743] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.744] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu", lpFilePart=0x0) returned 0x92
	[0074.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x93
	[0074.745] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.746] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.747] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.747] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.749] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.751] GetFileType (hFile=0x23c) returned 0x1
	[0074.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.751] GetFileType (hFile=0x23c) returned 0x1
	[0074.751] WriteFile (in: hFile=0x23c, lpBuffer=0x274ef4c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x274ef4c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.754] CloseHandle (hObject=0x23c) returned 1
	[0074.755] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0074.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id", lpFilePart=0x0) returned 0x92
	[0074.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\", lpFilePart=0x0) returned 0x93
	[0074.755] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.756] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.757] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.758] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.759] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id", lpFilePart=0x0) returned 0x92
	[0074.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\", lpFilePart=0x0) returned 0x93
	[0074.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.760] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.761] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.761] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.762] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.763] GetFileType (hFile=0x23c) returned 0x1
	[0074.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.764] GetFileType (hFile=0x23c) returned 0x1
	[0074.764] WriteFile (in: hFile=0x23c, lpBuffer=0x27548f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27548f0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.767] CloseHandle (hObject=0x23c) returned 1
	[0074.768] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0074.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it", lpFilePart=0x0) returned 0x92
	[0074.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\", lpFilePart=0x0) returned 0x93
	[0074.768] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.771] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.771] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.772] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.772] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.773] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it", lpFilePart=0x0) returned 0x92
	[0074.773] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\", lpFilePart=0x0) returned 0x93
	[0074.774] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.774] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.775] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.775] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.776] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.777] GetFileType (hFile=0x23c) returned 0x1
	[0074.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.777] GetFileType (hFile=0x23c) returned 0x1
	[0074.778] WriteFile (in: hFile=0x23c, lpBuffer=0x275a294*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x275a294*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.781] CloseHandle (hObject=0x23c) returned 1
	[0074.781] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1
	[0074.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw", lpFilePart=0x0) returned 0x92
	[0074.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\", lpFilePart=0x0) returned 0x93
	[0074.782] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.783] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.784] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.784] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.785] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw", lpFilePart=0x0) returned 0x92
	[0074.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\", lpFilePart=0x0) returned 0x93
	[0074.786] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.786] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.787] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.787] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.788] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.789] GetFileType (hFile=0x23c) returned 0x1
	[0074.790] GetFileType (hFile=0x23c) returned 0x1
	[0074.790] WriteFile (in: hFile=0x23c, lpBuffer=0x275fc38*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x275fc38*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.793] CloseHandle (hObject=0x23c) returned 1
	[0074.794] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0074.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja", lpFilePart=0x0) returned 0x92
	[0074.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x93
	[0074.795] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.798] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.799] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.799] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.800] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja", lpFilePart=0x0) returned 0x92
	[0074.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x93
	[0074.801] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.801] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.802] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.802] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.803] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.804] GetFileType (hFile=0x23c) returned 0x1
	[0074.804] GetFileType (hFile=0x23c) returned 0x1
	[0074.805] WriteFile (in: hFile=0x23c, lpBuffer=0x27655dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27655dc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.808] CloseHandle (hObject=0x23c) returned 1
	[0074.848] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1
	[0074.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn", lpFilePart=0x0) returned 0x92
	[0074.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\", lpFilePart=0x0) returned 0x93
	[0074.849] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.850] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.851] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.851] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.852] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn", lpFilePart=0x0) returned 0x92
	[0074.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\", lpFilePart=0x0) returned 0x93
	[0074.853] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.854] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.854] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.855] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.855] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.856] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.857] GetFileType (hFile=0x23c) returned 0x1
	[0074.858] GetFileType (hFile=0x23c) returned 0x1
	[0074.858] WriteFile (in: hFile=0x23c, lpBuffer=0x276af80*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x276af80*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.861] CloseHandle (hObject=0x23c) returned 1
	[0074.862] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0074.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko", lpFilePart=0x0) returned 0x92
	[0074.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x93
	[0074.863] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.866] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.867] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.867] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.868] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko", lpFilePart=0x0) returned 0x92
	[0074.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x93
	[0074.869] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.870] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.870] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.871] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.871] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.873] GetFileType (hFile=0x23c) returned 0x1
	[0074.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.873] GetFileType (hFile=0x23c) returned 0x1
	[0074.873] WriteFile (in: hFile=0x23c, lpBuffer=0x2770924*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2770924*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.879] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0074.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.879] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt", lpFilePart=0x0) returned 0x92
	[0074.879] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x93
	[0074.880] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.880] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.881] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.882] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.882] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt", lpFilePart=0x0) returned 0x92
	[0074.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x93
	[0074.889] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.890] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.890] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.891] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.891] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.892] GetFileType (hFile=0x23c) returned 0x1
	[0074.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.893] GetFileType (hFile=0x23c) returned 0x1
	[0074.893] WriteFile (in: hFile=0x23c, lpBuffer=0x27762c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27762c8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.896] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0074.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv", lpFilePart=0x0) returned 0x92
	[0074.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x93
	[0074.897] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.900] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.901] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.901] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.902] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv", lpFilePart=0x0) returned 0x92
	[0074.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x93
	[0074.903] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.903] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.904] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.904] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.904] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.906] GetFileType (hFile=0x23c) returned 0x1
	[0074.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.906] GetFileType (hFile=0x23c) returned 0x1
	[0074.907] WriteFile (in: hFile=0x23c, lpBuffer=0x277bc6c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x277bc6c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.909] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1
	[0074.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml", lpFilePart=0x0) returned 0x92
	[0074.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\", lpFilePart=0x0) returned 0x93
	[0074.910] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.911] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.911] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.912] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.912] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml", lpFilePart=0x0) returned 0x92
	[0074.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\", lpFilePart=0x0) returned 0x93
	[0074.913] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.913] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.915] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.915] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.915] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.944] GetFileType (hFile=0x23c) returned 0x1
	[0074.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.944] GetFileType (hFile=0x23c) returned 0x1
	[0074.945] WriteFile (in: hFile=0x23c, lpBuffer=0x2781610*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2781610*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.949] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1
	[0074.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr", lpFilePart=0x0) returned 0x92
	[0074.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\", lpFilePart=0x0) returned 0x93
	[0074.949] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.951] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.952] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.952] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.953] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr", lpFilePart=0x0) returned 0x92
	[0074.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\", lpFilePart=0x0) returned 0x93
	[0074.954] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.954] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.955] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.955] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.955] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.957] GetFileType (hFile=0x23c) returned 0x1
	[0074.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.957] GetFileType (hFile=0x23c) returned 0x1
	[0074.957] WriteFile (in: hFile=0x23c, lpBuffer=0x2786fb4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2786fb4*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.960] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1
	[0074.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms", lpFilePart=0x0) returned 0x92
	[0074.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x93
	[0074.961] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.962] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.962] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.963] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.963] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms", lpFilePart=0x0) returned 0x92
	[0074.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x93
	[0074.964] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.964] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.965] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.965] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.966] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.967] GetFileType (hFile=0x23c) returned 0x1
	[0074.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.967] GetFileType (hFile=0x23c) returned 0x1
	[0074.968] WriteFile (in: hFile=0x23c, lpBuffer=0x278c958*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x278c958*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.971] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb", cAlternateFileName="")) returned 1
	[0074.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb", lpFilePart=0x0) returned 0x92
	[0074.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\", lpFilePart=0x0) returned 0x93
	[0074.971] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.976] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.977] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.977] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.978] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb", lpFilePart=0x0) returned 0x92
	[0074.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\", lpFilePart=0x0) returned 0x93
	[0074.979] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.979] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.979] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.980] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.980] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.981] GetFileType (hFile=0x23c) returned 0x1
	[0074.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.982] GetFileType (hFile=0x23c) returned 0x1
	[0074.982] WriteFile (in: hFile=0x23c, lpBuffer=0x27922fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27922fc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.985] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0074.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl", lpFilePart=0x0) returned 0x92
	[0074.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x93
	[0074.986] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.987] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.987] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.988] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.988] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl", lpFilePart=0x0) returned 0x92
	[0074.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x93
	[0074.989] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.989] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.990] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.990] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0074.990] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0074.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0074.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0074.992] GetFileType (hFile=0x23c) returned 0x1
	[0074.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0074.992] GetFileType (hFile=0x23c) returned 0x1
	[0074.992] WriteFile (in: hFile=0x23c, lpBuffer=0x2797ca0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2797ca0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0074.995] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0074.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl", lpFilePart=0x0) returned 0x92
	[0074.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x93
	[0074.996] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0074.997] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0074.998] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0074.998] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0074.999] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0074.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0074.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0074.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0074.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl", lpFilePart=0x0) returned 0x92
	[0074.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x93
	[0075.000] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.000] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.001] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.001] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.001] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.003] GetFileType (hFile=0x23c) returned 0x1
	[0075.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.003] GetFileType (hFile=0x23c) returned 0x1
	[0075.003] WriteFile (in: hFile=0x23c, lpBuffer=0x279d644*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x279d644*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.006] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1
	[0075.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt", lpFilePart=0x0) returned 0x92
	[0075.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\", lpFilePart=0x0) returned 0x93
	[0075.007] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.009] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.010] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.010] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.011] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt", lpFilePart=0x0) returned 0x92
	[0075.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\", lpFilePart=0x0) returned 0x93
	[0075.012] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.012] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.013] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.013] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.013] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.015] GetFileType (hFile=0x23c) returned 0x1
	[0075.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.015] GetFileType (hFile=0x23c) returned 0x1
	[0075.015] WriteFile (in: hFile=0x23c, lpBuffer=0x27a2fe8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27a2fe8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.018] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0075.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x95
	[0075.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x96
	[0075.019] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.021] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.022] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.022] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.022] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x95
	[0075.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x96
	[0075.024] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.024] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.025] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.025] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.025] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\Decrypt.txt", lpFilePart=0x0) returned 0xa1
	[0075.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.027] GetFileType (hFile=0x23c) returned 0x1
	[0075.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.027] GetFileType (hFile=0x23c) returned 0x1
	[0075.027] WriteFile (in: hFile=0x23c, lpBuffer=0x27a8a48*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27a8a48*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.030] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0075.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x95
	[0075.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x96
	[0075.031] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.032] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.032] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.033] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.033] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x95
	[0075.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x96
	[0075.034] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.035] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.035] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.036] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.036] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\Decrypt.txt", lpFilePart=0x0) returned 0xa1
	[0075.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.038] GetFileType (hFile=0x23c) returned 0x1
	[0075.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.038] GetFileType (hFile=0x23c) returned 0x1
	[0075.038] WriteFile (in: hFile=0x23c, lpBuffer=0x27ae4a8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27ae4a8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.042] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0075.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro", lpFilePart=0x0) returned 0x92
	[0075.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x93
	[0075.043] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.045] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.045] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.046] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.046] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro", lpFilePart=0x0) returned 0x92
	[0075.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x93
	[0075.050] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.050] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.051] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.052] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.052] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.054] GetFileType (hFile=0x23c) returned 0x1
	[0075.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.055] GetFileType (hFile=0x23c) returned 0x1
	[0075.055] WriteFile (in: hFile=0x23c, lpBuffer=0x27b3e4c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27b3e4c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.058] CloseHandle (hObject=0x23c) returned 1
	[0075.059] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0075.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru", lpFilePart=0x0) returned 0x92
	[0075.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x93
	[0075.060] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.060] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.061] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.061] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.062] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru", lpFilePart=0x0) returned 0x92
	[0075.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x93
	[0075.063] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.064] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.064] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.065] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.066] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.067] GetFileType (hFile=0x23c) returned 0x1
	[0075.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.068] GetFileType (hFile=0x23c) returned 0x1
	[0075.068] WriteFile (in: hFile=0x23c, lpBuffer=0x27b97f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27b97f0*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.072] CloseHandle (hObject=0x23c) returned 1
	[0075.072] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0075.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk", lpFilePart=0x0) returned 0x92
	[0075.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x93
	[0075.074] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.077] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.077] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.078] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.078] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.079] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk", lpFilePart=0x0) returned 0x92
	[0075.079] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x93
	[0075.080] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.080] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.081] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.081] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.081] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.083] GetFileType (hFile=0x23c) returned 0x1
	[0075.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.084] GetFileType (hFile=0x23c) returned 0x1
	[0075.084] WriteFile (in: hFile=0x23c, lpBuffer=0x27bf194*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27bf194*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.089] CloseHandle (hObject=0x23c) returned 1
	[0075.089] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0075.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl", lpFilePart=0x0) returned 0x92
	[0075.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x93
	[0075.090] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.091] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.092] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.092] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.092] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl", lpFilePart=0x0) returned 0x92
	[0075.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x93
	[0075.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.094] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.095] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.095] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.098] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.100] GetFileType (hFile=0x23c) returned 0x1
	[0075.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.100] GetFileType (hFile=0x23c) returned 0x1
	[0075.101] WriteFile (in: hFile=0x23c, lpBuffer=0x27c4b38*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27c4b38*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.104] CloseHandle (hObject=0x23c) returned 1
	[0075.105] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0075.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr", lpFilePart=0x0) returned 0x92
	[0075.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x93
	[0075.106] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.108] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.109] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.109] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.109] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr", lpFilePart=0x0) returned 0x92
	[0075.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x93
	[0075.110] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.111] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.111] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.112] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.112] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.114] GetFileType (hFile=0x23c) returned 0x1
	[0075.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.114] GetFileType (hFile=0x23c) returned 0x1
	[0075.114] WriteFile (in: hFile=0x23c, lpBuffer=0x27ca4dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27ca4dc*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.118] CloseHandle (hObject=0x23c) returned 1
	[0075.118] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0075.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv", lpFilePart=0x0) returned 0x92
	[0075.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x93
	[0075.119] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.120] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.121] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.121] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.121] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv", lpFilePart=0x0) returned 0x92
	[0075.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x93
	[0075.122] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.123] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.123] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.124] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.124] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.125] GetFileType (hFile=0x23c) returned 0x1
	[0075.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.125] GetFileType (hFile=0x23c) returned 0x1
	[0075.126] WriteFile (in: hFile=0x23c, lpBuffer=0x27cfe80*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27cfe80*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.129] CloseHandle (hObject=0x23c) returned 1
	[0075.130] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1
	[0075.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw", lpFilePart=0x0) returned 0x92
	[0075.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\", lpFilePart=0x0) returned 0x93
	[0075.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.134] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.135] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.135] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.135] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw", lpFilePart=0x0) returned 0x92
	[0075.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\", lpFilePart=0x0) returned 0x93
	[0075.136] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.137] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.137] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.138] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.138] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.140] GetFileType (hFile=0x23c) returned 0x1
	[0075.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.140] GetFileType (hFile=0x23c) returned 0x1
	[0075.140] WriteFile (in: hFile=0x23c, lpBuffer=0x27d5824*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27d5824*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.143] CloseHandle (hObject=0x23c) returned 1
	[0075.144] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1
	[0075.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta", lpFilePart=0x0) returned 0x92
	[0075.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\", lpFilePart=0x0) returned 0x93
	[0075.145] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.146] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.146] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.146] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.147] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta", lpFilePart=0x0) returned 0x92
	[0075.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\", lpFilePart=0x0) returned 0x93
	[0075.148] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.148] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.149] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.149] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.150] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.151] GetFileType (hFile=0x23c) returned 0x1
	[0075.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.151] GetFileType (hFile=0x23c) returned 0x1
	[0075.151] WriteFile (in: hFile=0x23c, lpBuffer=0x27db1c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27db1c8*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.154] CloseHandle (hObject=0x23c) returned 1
	[0075.155] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1
	[0075.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te", lpFilePart=0x0) returned 0x92
	[0075.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\", lpFilePart=0x0) returned 0x93
	[0075.156] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.158] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.159] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.159] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.159] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te", lpFilePart=0x0) returned 0x92
	[0075.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\", lpFilePart=0x0) returned 0x93
	[0075.161] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.161] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.162] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.162] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.162] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.164] GetFileType (hFile=0x23c) returned 0x1
	[0075.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.165] GetFileType (hFile=0x23c) returned 0x1
	[0075.165] WriteFile (in: hFile=0x23c, lpBuffer=0x27e0b6c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27e0b6c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.168] CloseHandle (hObject=0x23c) returned 1
	[0075.169] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0075.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th", lpFilePart=0x0) returned 0x92
	[0075.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\", lpFilePart=0x0) returned 0x93
	[0075.169] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.170] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.171] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.171] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.171] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th", lpFilePart=0x0) returned 0x92
	[0075.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\", lpFilePart=0x0) returned 0x93
	[0075.173] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.174] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.174] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.174] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.175] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.177] GetFileType (hFile=0x23c) returned 0x1
	[0075.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.177] GetFileType (hFile=0x23c) returned 0x1
	[0075.177] WriteFile (in: hFile=0x23c, lpBuffer=0x27e6510*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x27e6510*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.181] CloseHandle (hObject=0x23c) returned 1
	[0075.182] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0075.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr", lpFilePart=0x0) returned 0x92
	[0075.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x93
	[0075.183] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.186] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.186] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.187] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.187] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr", lpFilePart=0x0) returned 0x92
	[0075.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x93
	[0075.188] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.188] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.189] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.189] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.189] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.191] GetFileType (hFile=0x23c) returned 0x1
	[0075.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.191] GetFileType (hFile=0x23c) returned 0x1
	[0075.200] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0075.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.205] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.205] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.206] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.207] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.207] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.207] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.208] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.209] GetFileType (hFile=0x23c) returned 0x1
	[0075.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.209] GetFileType (hFile=0x23c) returned 0x1
	[0075.214] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0075.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x93
	[0075.218] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.220] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.221] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.221] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.222] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi", lpFilePart=0x0) returned 0x92
	[0075.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x93
	[0075.223] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.224] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.224] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.225] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.225] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.227] GetFileType (hFile=0x23c) returned 0x1
	[0075.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.227] GetFileType (hFile=0x23c) returned 0x1
	[0075.227] WriteFile (in: hFile=0x23c, lpBuffer=0x25f5580*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25f5580*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.230] CloseHandle (hObject=0x23c) returned 1
	[0075.231] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh", cAlternateFileName="")) returned 1
	[0075.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh", lpFilePart=0x0) returned 0x92
	[0075.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\", lpFilePart=0x0) returned 0x93
	[0075.232] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.232] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.233] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.234] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.234] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh", lpFilePart=0x0) returned 0x92
	[0075.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\", lpFilePart=0x0) returned 0x93
	[0075.235] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.235] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.236] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.237] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.237] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\Decrypt.txt", lpFilePart=0x0) returned 0x9e
	[0075.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.239] GetFileType (hFile=0x23c) returned 0x1
	[0075.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.239] GetFileType (hFile=0x23c) returned 0x1
	[0075.239] WriteFile (in: hFile=0x23c, lpBuffer=0x25faf24*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x25faf24*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.242] CloseHandle (hObject=0x23c) returned 1
	[0075.243] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0075.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x95
	[0075.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x96
	[0075.244] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.246] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.247] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.247] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0
	[0075.248] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0075.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x95
	[0075.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x96
	[0075.249] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0075.249] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.250] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1
	[0075.251] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.251] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0075.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0075.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0075.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\Decrypt.txt", lpFilePart=0x0) returned 0xa1
	[0075.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0075.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x23c
	[0075.253] GetFileType (hFile=0x23c) returned 0x1
	[0075.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0075.253] GetFileType (hFile=0x23c) returned 0x1
	[0075.253] WriteFile (in: hFile=0x23c, lpBuffer=0x2600984*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2600984*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0075.257] CloseHandle (hObject=0x23c) returned 1
	[0075.258] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.259] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0075.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0075.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0075.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0075.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales", lpFilePart=0x0) returned 0x8f
	[0075.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\", lpFilePart=0x0) returned 0x90
	[0075.260] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0075.260] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.261] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd5bf110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd5bf110, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1
	[0075.262] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd5e5270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd5e5270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1
	[0075.262] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd60b3d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd60b3d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0075.263] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd631530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd631530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1
	[0075.263] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd657690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd657690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0075.264] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd67d7f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd67d7f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0075.264] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd6a3950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd6a3950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0075.264] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd6c9ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd6c9ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0075.265] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd6efc10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd6efc10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0075.265] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd6efc10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd6efc10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1
	[0075.266] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd715d70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd715d70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0075.266] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd73bed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd73bed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0075.267] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd73bed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd73bed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1
	[0075.267] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd762030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd762030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0075.268] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd788190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd788190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1
	[0075.269] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd7ae2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd7ae2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0075.269] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd7d4450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd7d4450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1
	[0075.270] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd7fa5b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd7fa5b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0075.270] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd820710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd820710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0075.271] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd86c9d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd86c9d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0075.271] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd892b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd892b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0075.272] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd8b8c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd8b8c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0075.272] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd8b8c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd8b8c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1
	[0075.273] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd8dedf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd8dedf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0075.273] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd977370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd977370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1
	[0075.274] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd99d4d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd99d4d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0075.274] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd9c3630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd9c3630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0075.275] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd9e9790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd9e9790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0075.276] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfda0f8f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfda0f8f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1
	[0075.276] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfda5bbb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfda5bbb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1
	[0075.277] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfda81d10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfda81d10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1
	[0075.277] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdaa7e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdaa7e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb", cAlternateFileName="")) returned 1
	[0075.278] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdaa7e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdaa7e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0075.278] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdacdfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdacdfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0075.279] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdaf4130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdaf4130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1
	[0075.279] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdb1a290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdb1a290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1
	[0075.280] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdb1a290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdb1a290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1
	[0075.280] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdb403f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdb403f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0075.281] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdb66550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdb66550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0075.282] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdb8c6b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdb8c6b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0075.282] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdbb2810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdbb2810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0075.283] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdbd8970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdbd8970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1
	[0075.283] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdbfead0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdbfead0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0075.284] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdc24c30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdc24c30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1
	[0075.284] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdc4ad90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdc4ad90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1
	[0075.285] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdc70ef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdc70ef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1
	[0075.285] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdc70ef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdc70ef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0075.286] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdc97050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdc97050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0075.286] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdcbd1b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdcbd1b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0075.287] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdd09470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdd09470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0075.287] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdd09470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdd09470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh", cAlternateFileName="")) returned 1
	[0075.288] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdd2f5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdd2f5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1
	[0075.289] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdd2f5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdd2f5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0
	[0075.289] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0075.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0075.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0075.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\Decrypt.txt", lpFilePart=0x0) returned 0x9b
	[0075.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0075.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0075.291] GetFileType (hFile=0x238) returned 0x1
	[0075.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0075.291] GetFileType (hFile=0x238) returned 0x1
	[0075.292] WriteFile (in: hFile=0x238, lpBuffer=0x260c8a0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x260c8a0*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0075.295] CloseHandle (hObject=0x238) returned 1
	[0075.295] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0075.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0075.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata", lpFilePart=0x0) returned 0x90
	[0075.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\", lpFilePart=0x0) returned 0x91
	[0075.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0075.299] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.299] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x839fe880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7299, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1
	[0075.300] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1
	[0075.300] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0
	[0075.301] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0075.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0075.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0075.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0075.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata", lpFilePart=0x0) returned 0x90
	[0075.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\", lpFilePart=0x0) returned 0x91
	[0075.302] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0075.302] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.303] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x839fe880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7299, dwReserved0=0x0, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1
	[0075.303] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1
	[0075.304] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.305] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0075.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0075.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0075.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\Decrypt.txt", lpFilePart=0x0) returned 0x9c
	[0075.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0075.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x238
	[0075.311] GetFileType (hFile=0x238) returned 0x1
	[0075.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0075.312] GetFileType (hFile=0x238) returned 0x1
	[0075.312] WriteFile (in: hFile=0x238, lpBuffer=0x2612d84*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x2612d84*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0075.315] CloseHandle (hObject=0x238) returned 1
	[0075.317] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0075.317] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0075.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0075.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0075.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0075.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0", lpFilePart=0x0) returned 0x86
	[0075.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\", lpFilePart=0x0) returned 0x87
	[0075.318] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0075.319] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0075.319] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="angular.js", cAlternateFileName="")) returned 1
	[0075.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", lpFilePart=0x0) returned 0x91
	[0075.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0075.321] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.321] GetFileType (hFile=0x238) returned 0x1
	[0075.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0075.322] GetFileType (hFile=0x238) returned 0x1
	[0075.322] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x8c0bf
	[0075.327] ReadFile (in: hFile=0x238, lpBuffer=0x3716e78, nNumberOfBytesToRead=0x8c0bf, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x3716e78*, lpNumberOfBytesRead=0x26eac4*=0x8c0bf, lpOverlapped=0x0) returned 1
	[0075.390] CloseHandle (hObject=0x238) returned 1
	[0075.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.KEKW", lpFilePart=0x0) returned 0x96
	[0075.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0075.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.392] GetFileType (hFile=0x238) returned 0x1
	[0075.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0075.392] GetFileType (hFile=0x238) returned 0x1
	[0075.393] WriteFile (in: hFile=0x238, lpBuffer=0x2616f98*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2616f98*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0075.397] CloseHandle (hObject=0x238) returned 1
	[0075.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", lpFilePart=0x0) returned 0x91
	[0075.398] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 1
	[0075.465] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83641800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83643f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xa89c, dwReserved0=0x0, dwReserved1=0x0, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 1
	[0075.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", lpFilePart=0x0) returned 0x9b
	[0075.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0075.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.468] GetFileType (hFile=0x238) returned 0x1
	[0075.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0075.468] GetFileType (hFile=0x238) returned 0x1
	[0075.468] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0xa89c
	[0075.469] ReadFile (in: hFile=0x238, lpBuffer=0x2618a14, nNumberOfBytesToRead=0xa89c, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x2618a14*, lpNumberOfBytesRead=0x26eac4*=0xa89c, lpOverlapped=0x0) returned 1
	[0075.500] CloseHandle (hObject=0x238) returned 1
	[0075.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.KEKW", lpFilePart=0x0) returned 0xa0
	[0075.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0075.502] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.502] GetFileType (hFile=0x238) returned 0x1
	[0075.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0075.503] GetFileType (hFile=0x238) returned 0x1
	[0075.504] WriteFile (in: hFile=0x238, lpBuffer=0x2624b20*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2624b20*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0075.512] CloseHandle (hObject=0x238) returned 1
	[0075.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", lpFilePart=0x0) returned 0x9b
	[0075.512] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 1
	[0075.517] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83646620, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83648d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x181aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 1
	[0075.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", lpFilePart=0x0) returned 0x9a
	[0075.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0075.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.518] GetFileType (hFile=0x238) returned 0x1
	[0075.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0075.519] GetFileType (hFile=0x238) returned 0x1
	[0075.519] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x181aa
	[0075.520] ReadFile (in: hFile=0x238, lpBuffer=0x37a2f58, nNumberOfBytesToRead=0x181aa, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x37a2f58*, lpNumberOfBytesRead=0x26eac4*=0x181aa, lpOverlapped=0x0) returned 1
	[0075.530] CloseHandle (hObject=0x238) returned 1
	[0075.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.KEKW", lpFilePart=0x0) returned 0x9f
	[0075.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0075.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.534] GetFileType (hFile=0x238) returned 0x1
	[0075.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0075.534] GetFileType (hFile=0x238) returned 0x1
	[0075.535] WriteFile (in: hFile=0x238, lpBuffer=0x2627e00*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2627e00*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0075.539] CloseHandle (hObject=0x238) returned 1
	[0075.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", lpFilePart=0x0) returned 0x9a
	[0075.540] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js")) returned 1
	[0075.546] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8364db50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8364db50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 1
	[0075.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", lpFilePart=0x0) returned 0x9e
	[0075.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0075.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.547] GetFileType (hFile=0x238) returned 0x1
	[0075.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0075.548] GetFileType (hFile=0x238) returned 0x1
	[0075.548] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x111e1
	[0075.548] ReadFile (in: hFile=0x238, lpBuffer=0x26298cc, nNumberOfBytesToRead=0x111e1, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x26298cc*, lpNumberOfBytesRead=0x26eac4*=0x111e1, lpOverlapped=0x0) returned 1
	[0075.573] CloseHandle (hObject=0x238) returned 1
	[0075.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.KEKW", lpFilePart=0x0) returned 0xa3
	[0075.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0075.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.585] GetFileType (hFile=0x238) returned 0x1
	[0075.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0075.586] GetFileType (hFile=0x238) returned 0x1
	[0075.586] WriteFile (in: hFile=0x238, lpBuffer=0x263c330*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x263c330*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0075.589] CloseHandle (hObject=0x238) returned 1
	[0075.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", lpFilePart=0x0) returned 0x9e
	[0075.590] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html")) returned 1
	[0075.594] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83652970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83657790, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3a258, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 1
	[0075.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", lpFilePart=0x0) returned 0x9c
	[0075.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0075.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.595] GetFileType (hFile=0x238) returned 0x1
	[0075.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0075.596] GetFileType (hFile=0x238) returned 0x1
	[0075.596] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x3a258
	[0075.598] ReadFile (in: hFile=0x238, lpBuffer=0x37bb120, nNumberOfBytesToRead=0x3a258, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x37bb120*, lpNumberOfBytesRead=0x26eac4*=0x3a258, lpOverlapped=0x0) returned 1
	[0075.665] CloseHandle (hObject=0x238) returned 1
	[0075.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.KEKW", lpFilePart=0x0) returned 0xa1
	[0075.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0075.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.667] GetFileType (hFile=0x238) returned 0x1
	[0075.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0075.667] GetFileType (hFile=0x238) returned 0x1
	[0075.668] WriteFile (in: hFile=0x238, lpBuffer=0x263f644*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x263f644*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0075.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", lpFilePart=0x0) returned 0x9c
	[0075.675] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js")) returned 1
	[0075.683] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8365ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836613d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xce17, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 1
	[0075.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", lpFilePart=0x0) returned 0x95
	[0075.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0075.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.684] GetFileType (hFile=0x238) returned 0x1
	[0075.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0075.684] GetFileType (hFile=0x238) returned 0x1
	[0075.684] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0xce17
	[0075.685] ReadFile (in: hFile=0x238, lpBuffer=0x2641078, nNumberOfBytesToRead=0xce17, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x2641078*, lpNumberOfBytesRead=0x26eac4*=0xce17, lpOverlapped=0x0) returned 1
	[0075.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.KEKW", lpFilePart=0x0) returned 0x9a
	[0075.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0075.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.728] GetFileType (hFile=0x238) returned 0x1
	[0075.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0075.728] GetFileType (hFile=0x238) returned 0x1
	[0075.729] WriteFile (in: hFile=0x238, lpBuffer=0x264f6dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x264f6dc*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0075.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", lpFilePart=0x0) returned 0x95
	[0075.732] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js")) returned 1
	[0075.736] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd4b4770, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd4b4770, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_setup", cAlternateFileName="CAST_S~1")) returned 1
	[0075.737] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd526b90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd526b90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_route_details", cAlternateFileName="CLOUD_~1")) returned 1
	[0075.737] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83696f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83699640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x0, dwReserved1=0x0, cFileName="common.js", cAlternateFileName="")) returned 1
	[0075.738] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", lpFilePart=0x0) returned 0x90
	[0075.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0075.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.738] GetFileType (hFile=0x238) returned 0x1
	[0075.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0075.739] GetFileType (hFile=0x238) returned 0x1
	[0075.739] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0xc878
	[0075.739] ReadFile (in: hFile=0x238, lpBuffer=0x2651638, nNumberOfBytesToRead=0xc878, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x2651638*, lpNumberOfBytesRead=0x26eac4*=0xc878, lpOverlapped=0x0) returned 1
	[0075.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.KEKW", lpFilePart=0x0) returned 0x95
	[0075.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0075.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.759] GetFileType (hFile=0x238) returned 0x1
	[0075.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0075.760] GetFileType (hFile=0x238) returned 0x1
	[0075.760] WriteFile (in: hFile=0x238, lpBuffer=0x265f6dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x265f6dc*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0075.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", lpFilePart=0x0) returned 0x90
	[0075.763] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js")) returned 1
	[0075.768] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8369bd50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8369bd50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback.css", cAlternateFileName="")) returned 1
	[0075.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", lpFilePart=0x0) returned 0x93
	[0075.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0075.768] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0075.769] GetFileType (hFile=0x238) returned 0x1
	[0075.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0075.769] GetFileType (hFile=0x238) returned 0x1
	[0075.769] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0xc26
	[0075.769] ReadFile (in: hFile=0x238, lpBuffer=0x2661ce8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x2661ce8*, lpNumberOfBytesRead=0x26eac4*=0xc26, lpOverlapped=0x0) returned 1
	[0076.141] CloseHandle (hObject=0x238) returned 1
	[0076.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.KEKW", lpFilePart=0x0) returned 0x98
	[0076.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0076.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0076.142] GetFileType (hFile=0x238) returned 0x1
	[0076.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0076.143] GetFileType (hFile=0x238) returned 0x1
	[0076.143] WriteFile (in: hFile=0x238, lpBuffer=0x2664528*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2664528*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0076.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", lpFilePart=0x0) returned 0x93
	[0076.147] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css")) returned 1
	[0076.150] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a0b70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a0b70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 1
	[0076.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", lpFilePart=0x0) returned 0x94
	[0076.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0076.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0076.151] GetFileType (hFile=0x238) returned 0x1
	[0076.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0076.151] GetFileType (hFile=0x238) returned 0x1
	[0076.151] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x38a8
	[0076.151] ReadFile (in: hFile=0x238, lpBuffer=0x2665f44, nNumberOfBytesToRead=0x38a8, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x2665f44*, lpNumberOfBytesRead=0x26eac4*=0x38a8, lpOverlapped=0x0) returned 1
	[0076.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.KEKW", lpFilePart=0x0) returned 0x99
	[0076.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0076.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0076.172] GetFileType (hFile=0x238) returned 0x1
	[0076.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0076.173] GetFileType (hFile=0x238) returned 0x1
	[0076.173] WriteFile (in: hFile=0x238, lpBuffer=0x266b030*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x266b030*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0076.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", lpFilePart=0x0) returned 0x94
	[0076.176] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html")) returned 1
	[0076.180] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a5990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a5990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 1
	[0076.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", lpFilePart=0x0) returned 0x99
	[0076.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0076.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0076.182] GetFileType (hFile=0x238) returned 0x1
	[0076.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0076.182] GetFileType (hFile=0x238) returned 0x1
	[0076.183] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x2b20
	[0076.183] ReadFile (in: hFile=0x238, lpBuffer=0x266ca94, nNumberOfBytesToRead=0x2b20, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x266ca94*, lpNumberOfBytesRead=0x26eac4*=0x2b20, lpOverlapped=0x0) returned 1
	[0076.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.KEKW", lpFilePart=0x0) returned 0x9e
	[0076.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0076.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0076.348] GetFileType (hFile=0x238) returned 0x1
	[0076.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0076.348] GetFileType (hFile=0x238) returned 0x1
	[0076.348] WriteFile (in: hFile=0x238, lpBuffer=0x2670e18*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2670e18*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0076.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", lpFilePart=0x0) returned 0x99
	[0076.352] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js")) returned 1
	[0076.355] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836af5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8395fd70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1
	[0076.356] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b1ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b43f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x46039, dwReserved0=0x0, dwReserved1=0x0, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 1
	[0076.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", lpFilePart=0x0) returned 0x9b
	[0076.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0076.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0076.357] GetFileType (hFile=0x238) returned 0x1
	[0076.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0076.357] GetFileType (hFile=0x238) returned 0x1
	[0076.357] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x46039
	[0076.362] ReadFile (in: hFile=0x238, lpBuffer=0x37f5398, nNumberOfBytesToRead=0x46039, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x37f5398*, lpNumberOfBytesRead=0x26eac4*=0x46039, lpOverlapped=0x0) returned 1
	[0076.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.KEKW", lpFilePart=0x0) returned 0xa0
	[0076.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0076.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0076.541] GetFileType (hFile=0x238) returned 0x1
	[0076.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0076.541] GetFileType (hFile=0x238) returned 0x1
	[0076.541] WriteFile (in: hFile=0x238, lpBuffer=0x267482c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x267482c*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0076.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", lpFilePart=0x0) returned 0x9b
	[0076.545] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css")) returned 1
	[0076.556] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x7c33, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 1
	[0076.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", lpFilePart=0x0) returned 0xa2
	[0076.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0076.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0076.557] GetFileType (hFile=0x238) returned 0x1
	[0076.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0076.557] GetFileType (hFile=0x238) returned 0x1
	[0076.557] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x7c33
	[0076.557] ReadFile (in: hFile=0x238, lpBuffer=0x2676330, nNumberOfBytesToRead=0x7c33, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x2676330*, lpNumberOfBytesRead=0x26eac4*=0x7c33, lpOverlapped=0x0) returned 1
	[0076.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.KEKW", lpFilePart=0x0) returned 0xa7
	[0076.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0076.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0076.583] GetFileType (hFile=0x238) returned 0x1
	[0076.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0076.583] GetFileType (hFile=0x238) returned 0x1
	[0076.584] WriteFile (in: hFile=0x238, lpBuffer=0x267f7fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x267f7fc*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0076.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", lpFilePart=0x0) returned 0xa2
	[0076.587] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js")) returned 1
	[0076.591] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2adeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 1
	[0076.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", lpFilePart=0x0) returned 0x9a
	[0076.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0076.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0076.592] GetFileType (hFile=0x238) returned 0x1
	[0076.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0076.592] GetFileType (hFile=0x238) returned 0x1
	[0076.592] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x2adeb
	[0076.593] ReadFile (in: hFile=0x238, lpBuffer=0x383b3f0, nNumberOfBytesToRead=0x2adeb, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x383b3f0*, lpNumberOfBytesRead=0x26eac4*=0x2adeb, lpOverlapped=0x0) returned 1
	[0076.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.KEKW", lpFilePart=0x0) returned 0x9f
	[0076.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0076.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0076.648] GetFileType (hFile=0x238) returned 0x1
	[0076.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0076.648] GetFileType (hFile=0x238) returned 0x1
	[0076.649] WriteFile (in: hFile=0x238, lpBuffer=0x2682aec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2682aec*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0076.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", lpFilePart=0x0) returned 0x9a
	[0076.653] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js")) returned 1
	[0076.660] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x794cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 1
	[0076.660] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", lpFilePart=0x0) returned 0x9c
	[0076.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0076.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0076.661] GetFileType (hFile=0x238) returned 0x1
	[0076.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0076.661] GetFileType (hFile=0x238) returned 0x1
	[0076.661] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x794cf
	[0076.666] ReadFile (in: hFile=0x238, lpBuffer=0x38661f8, nNumberOfBytesToRead=0x794cf, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x38661f8*, lpNumberOfBytesRead=0x26eac4*=0x794cf, lpOverlapped=0x0) returned 1
	[0077.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.KEKW", lpFilePart=0x0) returned 0xa1
	[0077.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0077.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0077.103] GetFileType (hFile=0x238) returned 0x1
	[0077.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0077.103] GetFileType (hFile=0x238) returned 0x1
	[0077.104] WriteFile (in: hFile=0x238, lpBuffer=0x2685df8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2685df8*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0077.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", lpFilePart=0x0) returned 0x9c
	[0077.107] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js")) returned 1
	[0077.121] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x941, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 1
	[0077.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", lpFilePart=0x0) returned 0x9a
	[0077.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0077.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0077.125] GetFileType (hFile=0x238) returned 0x1
	[0077.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0077.126] GetFileType (hFile=0x238) returned 0x1
	[0077.126] GetFileSize (in: hFile=0x238, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0x941
	[0077.126] ReadFile (in: hFile=0x238, lpBuffer=0x26881d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x26881d0*, lpNumberOfBytesRead=0x26eac4*=0x941, lpOverlapped=0x0) returned 1
	[0077.147] CloseHandle (hObject=0x238) returned 1
	[0077.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.KEKW", lpFilePart=0x0) returned 0x9f
	[0077.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0077.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x238
	[0077.148] GetFileType (hFile=0x238) returned 0x1
	[0077.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0077.149] GetFileType (hFile=0x238) returned 0x1
	[0077.149] WriteFile (in: hFile=0x238, lpBuffer=0x268aa38*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x268aa38*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0077.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", lpFilePart=0x0) returned 0x9a
	[0077.152] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js")) returned 1
	[0077.155] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfdda19f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfdda19f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1
	[0077.156] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfddc7b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfddc7b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1
	[0077.156] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfddc7b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfddc7b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0
	[0077.157] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0077.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0077.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0077.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\Decrypt.txt", lpFilePart=0x0) returned 0x92
	[0077.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0077.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0077.158] GetFileType (hFile=0x234) returned 0x1
	[0077.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0077.159] GetFileType (hFile=0x234) returned 0x1
	[0077.159] WriteFile (in: hFile=0x234, lpBuffer=0x268d8b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x268d8b4*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0077.163] CloseHandle (hObject=0x234) returned 1
	[0077.164] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.164] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0077.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0077.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0077.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0077.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm", lpFilePart=0x0) returned 0x77
	[0077.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\", lpFilePart=0x0) returned 0x78
	[0077.165] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0077.166] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.166] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfef55d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfef55d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 1
	[0077.167] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfef55d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfef55d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 0
	[0077.167] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0077.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0077.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0077.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Decrypt.txt", lpFilePart=0x0) returned 0x83
	[0077.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0077.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0077.169] GetFileType (hFile=0x230) returned 0x1
	[0077.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0077.169] GetFileType (hFile=0x230) returned 0x1
	[0077.169] WriteFile (in: hFile=0x230, lpBuffer=0x2691278*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x2691278*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0077.172] CloseHandle (hObject=0x230) returned 1
	[0077.172] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.173] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpFilePart=0x0) returned 0x56
	[0077.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", lpFilePart=0x0) returned 0x57
	[0077.174] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.174] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.175] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8b0fed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8b0fed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aapocclcgogkmnckokdopfmhonfmgoek", cAlternateFileName="AAPOCC~1")) returned 1
	[0077.176] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf90b7310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf90b7310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aohghmighlieiainnegkcijnfilokake", cAlternateFileName="AOHGHM~1")) returned 1
	[0077.176] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf9e1aed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf9e1aed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="apdfllckaahabafndbhieahigkjlhalf", cAlternateFileName="APDFLL~1")) returned 1
	[0077.177] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfa66fbd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfa66fbd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="blpcfgokakmgnkcojhhkbfbldkacnbeo", cAlternateFileName="BLPCFG~1")) returned 1
	[0077.177] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfb1be450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfb1be450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="felcaaldnbdncclmgdcncolpebgiejap", cAlternateFileName="FELCAA~1")) returned 1
	[0077.178] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc183610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc183610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1
	[0077.179] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfc965ef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfc965ef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nmmhkkegccagdldgiimedpiccmgmieda", cAlternateFileName="NMMHKK~1")) returned 1
	[0077.179] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfd1babf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfd1babf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pjkljhegncpnkpknbcohdijeoejaedia", cAlternateFileName="PJKLJH~1")) returned 1
	[0077.180] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfef7bef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfef7bef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1
	[0077.180] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfef7bef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfef7bef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0
	[0077.181] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0077.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0077.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0077.183] GetFileType (hFile=0x22c) returned 0x1
	[0077.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0077.184] GetFileType (hFile=0x22c) returned 0x1
	[0077.184] WriteFile (in: hFile=0x22c, lpBuffer=0x2695c44*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2695c44*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0077.187] CloseHandle (hObject=0x22c) returned 1
	[0077.187] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80db2b00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favicons", cAlternateFileName="")) returned 1
	[0077.188] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80e97340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favicons-journal", cAlternateFileName="FAVICO~1")) returned 1
	[0077.188] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81c58330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1
	[0077.189] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f47590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0077.190] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824d3190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824d3190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b6860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x0, dwReserved1=0x0, cFileName="History Provider Cache", cAlternateFileName="HISTOR~2")) returned 1
	[0077.190] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f6d6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History-journal", cAlternateFileName="HISTOR~1")) returned 1
	[0077.191] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JumpListIcons", cAlternateFileName="JUMPLI~2")) returned 1
	[0077.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons", lpFilePart=0x0) returned 0x59
	[0077.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\", lpFilePart=0x0) returned 0x5a
	[0077.218] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.222] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.222] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A058.tmp", cAlternateFileName="")) returned 1
	[0077.223] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A059.tmp", cAlternateFileName="")) returned 1
	[0077.224] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A059.tmp", cAlternateFileName="")) returned 0
	[0077.224] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons", lpFilePart=0x0) returned 0x59
	[0077.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\", lpFilePart=0x0) returned 0x5a
	[0077.226] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.226] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.227] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A058.tmp", cAlternateFileName="")) returned 1
	[0077.227] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A059.tmp", cAlternateFileName="")) returned 1
	[0077.228] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.228] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\Decrypt.txt", lpFilePart=0x0) returned 0x65
	[0077.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0077.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0077.230] GetFileType (hFile=0x22c) returned 0x1
	[0077.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0077.230] GetFileType (hFile=0x22c) returned 0x1
	[0077.231] WriteFile (in: hFile=0x22c, lpBuffer=0x269b650*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x269b650*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0077.234] CloseHandle (hObject=0x22c) returned 1
	[0077.234] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JumpListIconsOld", cAlternateFileName="JUMPLI~1")) returned 1
	[0077.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld", lpFilePart=0x0) returned 0x5c
	[0077.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\", lpFilePart=0x0) returned 0x5d
	[0077.235] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.236] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.237] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B03.tmp", cAlternateFileName="")) returned 1
	[0077.237] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B04.tmp", cAlternateFileName="")) returned 1
	[0077.238] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B04.tmp", cAlternateFileName="")) returned 0
	[0077.239] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld", lpFilePart=0x0) returned 0x5c
	[0077.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\", lpFilePart=0x0) returned 0x5d
	[0077.240] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.241] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.241] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B03.tmp", cAlternateFileName="")) returned 1
	[0077.242] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2B04.tmp", cAlternateFileName="")) returned 1
	[0077.242] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.243] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0077.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0077.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0077.244] GetFileType (hFile=0x22c) returned 0x1
	[0077.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0077.244] GetFileType (hFile=0x22c) returned 0x1
	[0077.245] WriteFile (in: hFile=0x22c, lpBuffer=0x26a063c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26a063c*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0077.248] CloseHandle (hObject=0x22c) returned 1
	[0077.249] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local Extension Settings", cAlternateFileName="LOCALE~1")) returned 1
	[0077.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings", lpFilePart=0x0) returned 0x64
	[0077.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\", lpFilePart=0x0) returned 0x65
	[0077.250] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.251] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.252] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1
	[0077.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0077.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpFilePart=0x0) returned 0x85
	[0077.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", lpFilePart=0x0) returned 0x86
	[0077.253] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0077.269] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.270] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86513570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1
	[0077.270] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1
	[0077.271] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1
	[0077.272] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97256fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1
	[0077.273] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1
	[0077.274] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0
	[0077.275] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0077.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0077.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0077.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0077.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpFilePart=0x0) returned 0x85
	[0077.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", lpFilePart=0x0) returned 0x86
	[0077.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0077.282] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.282] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86513570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1
	[0077.283] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1
	[0077.283] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1
	[0077.284] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97256fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1
	[0077.284] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1
	[0077.285] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.285] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0077.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0077.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0077.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Decrypt.txt", lpFilePart=0x0) returned 0x91
	[0077.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0077.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0077.292] GetFileType (hFile=0x230) returned 0x1
	[0077.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0077.293] GetFileType (hFile=0x230) returned 0x1
	[0077.293] WriteFile (in: hFile=0x230, lpBuffer=0x26a8ea8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x26a8ea8*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0077.297] CloseHandle (hObject=0x230) returned 1
	[0077.298] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.298] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings", lpFilePart=0x0) returned 0x64
	[0077.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\", lpFilePart=0x0) returned 0x65
	[0077.305] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.305] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.306] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff0ac9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff0ac9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1
	[0077.307] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff0ac9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff0ac9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 0
	[0077.307] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x70
	[0077.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0077.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0077.309] GetFileType (hFile=0x22c) returned 0x1
	[0077.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0077.309] GetFileType (hFile=0x22c) returned 0x1
	[0077.310] WriteFile (in: hFile=0x22c, lpBuffer=0x26ac670*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26ac670*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0077.313] CloseHandle (hObject=0x22c) returned 1
	[0077.313] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local Storage", cAlternateFileName="LOCALS~1")) returned 1
	[0077.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage", lpFilePart=0x0) returned 0x59
	[0077.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\", lpFilePart=0x0) returned 0x5a
	[0077.314] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.325] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.325] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9048b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", cAlternateFileName="CHROME~1.LOC")) returned 1
	[0077.326] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x904b1a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", cAlternateFileName="CHROME~2.LOC")) returned 1
	[0077.327] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x904b1a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", cAlternateFileName="CHROME~2.LOC")) returned 0
	[0077.327] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage", lpFilePart=0x0) returned 0x59
	[0077.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\", lpFilePart=0x0) returned 0x5a
	[0077.331] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.334] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.335] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9048b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", cAlternateFileName="CHROME~1.LOC")) returned 1
	[0077.335] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x904b1a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", cAlternateFileName="CHROME~2.LOC")) returned 1
	[0077.336] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.336] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\Decrypt.txt", lpFilePart=0x0) returned 0x65
	[0077.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0077.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0077.342] GetFileType (hFile=0x22c) returned 0x1
	[0077.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0077.343] GetFileType (hFile=0x22c) returned 0x1
	[0077.343] WriteFile (in: hFile=0x22c, lpBuffer=0x26b1f34*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26b1f34*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0077.346] CloseHandle (hObject=0x22c) returned 1
	[0077.347] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 1
	[0077.347] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data-journal", cAlternateFileName="LOGIND~2")) returned 1
	[0077.351] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x825f0410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Action Predictor", cAlternateFileName="NETWOR~1")) returned 1
	[0077.351] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8262ad90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Action Predictor-journal", cAlternateFileName="NETWOR~2")) returned 1
	[0077.352] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86263d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86263d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86263d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Persistent State", cAlternateFileName="NETWOR~3")) returned 1
	[0077.353] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x94034050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin Bound Certs", cAlternateFileName="ORIGIN~1")) returned 1
	[0077.353] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9405a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin Bound Certs-journal", cAlternateFileName="ORIGIN~2")) returned 1
	[0077.354] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c43f3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c446910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferences", cAlternateFileName="PREFER~1")) returned 1
	[0077.355] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8dea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8dea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="previews_opt_out.db", cAlternateFileName="PREVIE~1.DB")) returned 1
	[0077.355] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x804795c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x804795c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x812c19c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="previews_opt_out.db-journal", cAlternateFileName="PREVIE~1.DB-")) returned 1
	[0077.356] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x869fc2d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaManager", cAlternateFileName="QUOTAM~1")) returned 1
	[0077.357] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaManager-journal", cAlternateFileName="QUOTAM~2")) returned 1
	[0077.372] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f846500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f846500, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="README", cAlternateFileName="")) returned 1
	[0077.372] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3f38f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c404a60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8b43, dwReserved0=0x0, dwReserved1=0x0, cFileName="Secure Preferences", cAlternateFileName="SECURE~1")) returned 1
	[0077.373] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82271b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shortcuts", cAlternateFileName="SHORTC~1")) returned 1
	[0077.373] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x822e3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shortcuts-journal", cAlternateFileName="SHORTC~2")) returned 1
	[0077.374] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Extension Settings", cAlternateFileName="SYNCEX~1")) returned 1
	[0077.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings", lpFilePart=0x0) returned 0x63
	[0077.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\", lpFilePart=0x0) returned 0x64
	[0077.375] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.409] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.409] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1
	[0077.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0077.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm", lpFilePart=0x0) returned 0x84
	[0077.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\", lpFilePart=0x0) returned 0x85
	[0077.437] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0077.646] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.646] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8448d2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1
	[0077.646] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1
	[0077.647] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1
	[0077.647] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x93935fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1
	[0077.648] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1
	[0077.649] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0
	[0077.649] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0077.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0077.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0077.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0077.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm", lpFilePart=0x0) returned 0x84
	[0077.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\", lpFilePart=0x0) returned 0x85
	[0077.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0077.656] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.656] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8448d2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1
	[0077.656] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1
	[0077.657] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1
	[0077.657] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x93935fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1
	[0077.657] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1
	[0077.658] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.658] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0077.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0077.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0077.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Decrypt.txt", lpFilePart=0x0) returned 0x90
	[0077.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0077.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0077.665] GetFileType (hFile=0x230) returned 0x1
	[0077.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0077.665] GetFileType (hFile=0x230) returned 0x1
	[0077.666] WriteFile (in: hFile=0x230, lpBuffer=0x26bc6f4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x26bc6f4*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0077.672] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.672] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings", lpFilePart=0x0) returned 0x63
	[0077.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\", lpFilePart=0x0) returned 0x64
	[0077.673] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.674] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.674] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff43eaf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff43eaf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1
	[0077.676] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff43eaf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff43eaf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0
	[0077.676] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\Decrypt.txt", lpFilePart=0x0) returned 0x6f
	[0077.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0077.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0077.678] GetFileType (hFile=0x22c) returned 0x1
	[0077.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0077.678] GetFileType (hFile=0x22c) returned 0x1
	[0077.678] WriteFile (in: hFile=0x22c, lpBuffer=0x26bfe90*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26bfe90*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0077.681] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8195e7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Top Sites", cAlternateFileName="TOPSIT~1")) returned 1
	[0077.681] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d8c9a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d8c9a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81984910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Top Sites-journal", cAlternateFileName="TOPSIT~2")) returned 1
	[0077.682] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c2e920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x88c2e920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x88c2e920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="TransportSecurity", cAlternateFileName="TRANSP~1")) returned 1
	[0077.683] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ee3600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80ee3600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6cde50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visited Links", cAlternateFileName="VISITE~1")) returned 1
	[0077.683] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Applications", cAlternateFileName="WEBAPP~1")) returned 1
	[0077.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications", lpFilePart=0x0) returned 0x5c
	[0077.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\", lpFilePart=0x0) returned 0x5d
	[0077.684] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.685] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.686] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 1
	[0077.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0077.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake", lpFilePart=0x0) returned 0x82
	[0077.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\", lpFilePart=0x0) returned 0x83
	[0077.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0077.719] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.719] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Docs.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1
	[0077.720] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 1
	[0077.720] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 0
	[0077.721] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0077.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0077.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0077.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0077.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake", lpFilePart=0x0) returned 0x82
	[0077.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\", lpFilePart=0x0) returned 0x83
	[0077.722] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0077.723] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.723] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Docs.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1
	[0077.724] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 1
	[0077.724] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.724] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0077.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0077.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0077.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Decrypt.txt", lpFilePart=0x0) returned 0x8e
	[0077.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0077.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0077.731] GetFileType (hFile=0x230) returned 0x1
	[0077.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0077.731] GetFileType (hFile=0x230) returned 0x1
	[0077.732] WriteFile (in: hFile=0x230, lpBuffer=0x26c7410*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x26c7410*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0077.735] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.735] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0077.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications", lpFilePart=0x0) returned 0x5c
	[0077.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\", lpFilePart=0x0) returned 0x5d
	[0077.736] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0077.737] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.737] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff4d7070, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff4d7070, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 1
	[0077.739] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff4d7070, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff4d7070, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 0
	[0077.739] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0077.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0077.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0077.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0077.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0077.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0077.741] GetFileType (hFile=0x22c) returned 0x1
	[0077.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0077.741] GetFileType (hFile=0x22c) returned 0x1
	[0077.741] WriteFile (in: hFile=0x22c, lpBuffer=0x26caaf0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26caaf0*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0077.778] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data", cAlternateFileName="WEBDAT~1")) returned 1
	[0077.779] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d608d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 1
	[0077.780] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d608d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 0
	[0077.780] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0077.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0077.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0077.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0077.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpFilePart=0x0) returned 0x4b
	[0077.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpFilePart=0x0) returned 0x4c
	[0077.781] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0077.782] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0077.782] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf807fd30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf807fd30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0077.783] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0077.783] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d44890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 1
	[0077.784] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83b08a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83b08a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0b57b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 1
	[0077.784] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3b6860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3b6860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b8f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 1
	[0077.836] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf80cbff0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf80cbff0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_reduction_proxy_leveldb", cAlternateFileName="DATA_R~1")) returned 1
	[0077.837] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf813e410, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf813e410, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extension Rules", cAlternateFileName="EXTENS~3")) returned 1
	[0077.837] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf818a6d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf818a6d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extension State", cAlternateFileName="EXTENS~2")) returned 1
	[0077.838] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xfefa2050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfefa2050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1
	[0077.838] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80db2b00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favicons", cAlternateFileName="")) returned 1
	[0077.840] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80e97340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favicons-journal", cAlternateFileName="FAVICO~1")) returned 1
	[0077.840] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81c58330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1
	[0077.841] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f47590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0077.841] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824d3190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824d3190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b6860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x0, dwReserved1=0x0, cFileName="History Provider Cache", cAlternateFileName="HISTOR~2")) returned 1
	[0077.842] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f6d6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History-journal", cAlternateFileName="HISTOR~1")) returned 1
	[0077.842] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff014470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff014470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JumpListIcons", cAlternateFileName="JUMPLI~2")) returned 1
	[0077.843] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff03a5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff03a5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JumpListIconsOld", cAlternateFileName="JUMPLI~1")) returned 1
	[0077.843] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff0d2b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff0d2b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local Extension Settings", cAlternateFileName="LOCALE~1")) returned 1
	[0077.844] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff11ee10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff11ee10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local Storage", cAlternateFileName="LOCALS~1")) returned 1
	[0077.845] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 1
	[0077.845] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Login Data-journal", cAlternateFileName="LOGIND~2")) returned 1
	[0077.846] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x825f0410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Action Predictor", cAlternateFileName="NETWOR~1")) returned 1
	[0077.846] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8262ad90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Action Predictor-journal", cAlternateFileName="NETWOR~2")) returned 1
	[0077.847] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86263d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86263d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86263d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Persistent State", cAlternateFileName="NETWOR~3")) returned 1
	[0077.847] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x94034050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin Bound Certs", cAlternateFileName="ORIGIN~1")) returned 1
	[0077.848] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9405a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin Bound Certs-journal", cAlternateFileName="ORIGIN~2")) returned 1
	[0077.848] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c43f3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c446910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferences", cAlternateFileName="PREFER~1")) returned 1
	[0077.849] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8dea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8dea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="previews_opt_out.db", cAlternateFileName="PREVIE~1.DB")) returned 1
	[0077.849] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x804795c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x804795c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x812c19c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="previews_opt_out.db-journal", cAlternateFileName="PREVIE~1.DB-")) returned 1
	[0077.850] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x869fc2d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaManager", cAlternateFileName="QUOTAM~1")) returned 1
	[0077.850] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuotaManager-journal", cAlternateFileName="QUOTAM~2")) returned 1
	[0077.851] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f846500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f846500, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="README", cAlternateFileName="")) returned 1
	[0077.851] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3f38f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c404a60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8b43, dwReserved0=0x0, dwReserved1=0x0, cFileName="Secure Preferences", cAlternateFileName="SECURE~1")) returned 1
	[0077.852] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82271b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shortcuts", cAlternateFileName="SHORTC~1")) returned 1
	[0077.852] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x822e3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shortcuts-journal", cAlternateFileName="SHORTC~2")) returned 1
	[0077.853] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff464c50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff464c50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Extension Settings", cAlternateFileName="SYNCEX~1")) returned 1
	[0077.853] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8195e7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Top Sites", cAlternateFileName="TOPSIT~1")) returned 1
	[0077.854] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d8c9a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d8c9a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81984910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Top Sites-journal", cAlternateFileName="TOPSIT~2")) returned 1
	[0077.854] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c2e920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x88c2e920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x88c2e920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="TransportSecurity", cAlternateFileName="TRANSP~1")) returned 1
	[0077.855] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ee3600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80ee3600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6cde50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visited Links", cAlternateFileName="VISITE~1")) returned 1
	[0077.855] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff4fd1d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff4fd1d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Applications", cAlternateFileName="WEBAPP~1")) returned 1
	[0077.856] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data", cAlternateFileName="WEBDAT~1")) returned 1
	[0077.856] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d608d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 1
	[0077.857] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0077.857] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0077.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0077.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0077.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Decrypt.txt", lpFilePart=0x0) returned 0x57
	[0077.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0077.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0077.859] GetFileType (hFile=0x228) returned 0x1
	[0077.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0077.860] GetFileType (hFile=0x228) returned 0x1
	[0077.860] WriteFile (in: hFile=0x228, lpBuffer=0x26d87c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26d87c4*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0077.864] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1
	[0077.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0077.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist", lpFilePart=0x0) returned 0x4f
	[0077.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\", lpFilePart=0x0) returned 0x50
	[0077.865] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.139] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.140] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.140] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist", lpFilePart=0x0) returned 0x4f
	[0078.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\", lpFilePart=0x0) returned 0x50
	[0078.141] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.142] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.142] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.143] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0078.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0078.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0078.152] GetFileType (hFile=0x228) returned 0x1
	[0078.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0078.153] GetFileType (hFile=0x228) returned 0x1
	[0078.153] WriteFile (in: hFile=0x228, lpBuffer=0x26dc704*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26dc704*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0078.156] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1
	[0078.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies", lpFilePart=0x0) returned 0x54
	[0078.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\", lpFilePart=0x0) returned 0x55
	[0078.157] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.158] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.158] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.159] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies", lpFilePart=0x0) returned 0x54
	[0078.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\", lpFilePart=0x0) returned 0x55
	[0078.160] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.161] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.161] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.162] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0078.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0078.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0078.166] GetFileType (hFile=0x228) returned 0x1
	[0078.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0078.166] GetFileType (hFile=0x228) returned 0x1
	[0078.167] WriteFile (in: hFile=0x228, lpBuffer=0x26e0798*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26e0798*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0078.169] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1
	[0078.170] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1
	[0078.170] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1
	[0078.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials", lpFilePart=0x0) returned 0x50
	[0078.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\", lpFilePart=0x0) returned 0x51
	[0078.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.172] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.172] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.173] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials", lpFilePart=0x0) returned 0x50
	[0078.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\", lpFilePart=0x0) returned 0x51
	[0078.174] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.174] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.175] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.175] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Decrypt.txt", lpFilePart=0x0) returned 0x5c
	[0078.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0078.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\origintrials\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0078.184] GetFileType (hFile=0x228) returned 0x1
	[0078.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0078.184] GetFileType (hFile=0x228) returned 0x1
	[0078.185] WriteFile (in: hFile=0x228, lpBuffer=0x26e4a88*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26e4a88*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0078.188] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1
	[0078.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash", lpFilePart=0x0) returned 0x4f
	[0078.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\", lpFilePart=0x0) returned 0x50
	[0078.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.190] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.202] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.203] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash", lpFilePart=0x0) returned 0x4f
	[0078.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\", lpFilePart=0x0) returned 0x50
	[0078.204] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.204] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.205] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.205] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0078.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0078.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\pepperflash\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0078.219] GetFileType (hFile=0x228) returned 0x1
	[0078.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0078.220] GetFileType (hFile=0x228) returned 0x1
	[0078.220] WriteFile (in: hFile=0x228, lpBuffer=0x26e89c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26e89c8*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0078.225] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1
	[0078.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl", lpFilePart=0x0) returned 0x49
	[0078.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\", lpFilePart=0x0) returned 0x4a
	[0078.226] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.227] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.227] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.227] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl", lpFilePart=0x0) returned 0x49
	[0078.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\", lpFilePart=0x0) returned 0x4a
	[0078.229] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.229] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.230] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.230] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0078.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0078.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\pnacl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0078.231] GetFileType (hFile=0x228) returned 0x1
	[0078.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0078.232] GetFileType (hFile=0x228) returned 0x1
	[0078.232] WriteFile (in: hFile=0x228, lpBuffer=0x26ec774*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26ec774*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0078.235] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1
	[0078.236] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1
	[0078.236] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1
	[0078.236] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1
	[0078.237] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1
	[0078.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant", lpFilePart=0x0) returned 0x55
	[0078.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\", lpFilePart=0x0) returned 0x56
	[0078.238] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.253] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.254] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.254] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant", lpFilePart=0x0) returned 0x55
	[0078.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\", lpFilePart=0x0) returned 0x56
	[0078.255] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.256] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.256] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.257] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0078.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0078.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0078.258] GetFileType (hFile=0x228) returned 0x1
	[0078.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0078.258] GetFileType (hFile=0x228) returned 0x1
	[0078.258] WriteFile (in: hFile=0x228, lpBuffer=0x26f1068*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26f1068*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0078.261] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1
	[0078.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter", lpFilePart=0x0) returned 0x4e
	[0078.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\", lpFilePart=0x0) returned 0x4f
	[0078.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.263] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.264] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.264] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter", lpFilePart=0x0) returned 0x4e
	[0078.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\", lpFilePart=0x0) returned 0x4f
	[0078.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.265] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.266] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.266] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0078.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0078.267] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\swreporter\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0078.267] GetFileType (hFile=0x228) returned 0x1
	[0078.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0078.267] GetFileType (hFile=0x228) returned 0x1
	[0078.268] WriteFile (in: hFile=0x228, lpBuffer=0x26f4f88*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26f4f88*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0078.292] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1
	[0078.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm", lpFilePart=0x0) returned 0x4f
	[0078.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\", lpFilePart=0x0) returned 0x50
	[0078.293] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.294] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.294] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.294] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm", lpFilePart=0x0) returned 0x4f
	[0078.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\", lpFilePart=0x0) returned 0x50
	[0078.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.296] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.296] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.296] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0078.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0078.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0078.298] GetFileType (hFile=0x228) returned 0x1
	[0078.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0078.298] GetFileType (hFile=0x228) returned 0x1
	[0078.298] WriteFile (in: hFile=0x228, lpBuffer=0x26f8ec8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26f8ec8*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0078.301] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.302] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x43
	[0078.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x44
	[0078.303] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.303] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.304] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7fc1650, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7fc1650, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1
	[0078.304] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf8033a70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf8033a70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1
	[0078.305] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff607b70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff607b70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1
	[0078.305] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff8db590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff8db590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1
	[0078.305] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff9016f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff9016f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1
	[0078.306] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1
	[0078.306] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1
	[0078.307] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff927850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff927850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1
	[0078.307] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff973b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff973b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1
	[0078.308] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff999c70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff999c70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1
	[0078.308] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1
	[0078.308] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1
	[0078.309] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1
	[0078.309] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1
	[0078.310] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff9e5f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff9e5f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1
	[0078.310] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xff9e5f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xff9e5f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1
	[0078.310] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xffa321f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffa321f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1
	[0078.311] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xffa321f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffa321f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0
	[0078.311] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0078.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0078.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0078.312] GetFileType (hFile=0x224) returned 0x1
	[0078.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0078.313] GetFileType (hFile=0x224) returned 0x1
	[0078.313] WriteFile (in: hFile=0x224, lpBuffer=0x26fed30*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26fed30*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0078.316] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.317] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", lpFilePart=0x0) returned 0x39
	[0078.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", lpFilePart=0x0) returned 0x3a
	[0078.318] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.318] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.319] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xffa58350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffa58350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1
	[0078.319] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xffa58350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffa58350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0
	[0078.319] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0078.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0078.320] GetFileType (hFile=0x220) returned 0x1
	[0078.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0078.320] GetFileType (hFile=0x220) returned 0x1
	[0078.321] WriteFile (in: hFile=0x220, lpBuffer=0x2701e78*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2701e78*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0078.323] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0078.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", lpFilePart=0x0) returned 0x3f
	[0078.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\", lpFilePart=0x0) returned 0x40
	[0078.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.325] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.325] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.325] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", lpFilePart=0x0) returned 0x3f
	[0078.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\", lpFilePart=0x0) returned 0x40
	[0078.326] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.327] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.327] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.327] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0078.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\crashreports\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0078.328] GetFileType (hFile=0x220) returned 0x1
	[0078.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0078.329] GetFileType (hFile=0x220) returned 0x1
	[0078.329] WriteFile (in: hFile=0x220, lpBuffer=0x27059fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27059fc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0078.335] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.335] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0078.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0078.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0078.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0078.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x32
	[0078.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", lpFilePart=0x0) returned 0x33
	[0078.336] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0078.336] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.337] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xffa7e4b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffa7e4b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1
	[0078.337] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xffa7e4b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffa7e4b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0078.337] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xffa7e4b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffa7e4b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0
	[0078.337] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0078.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0078.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0078.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0078.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0078.339] GetFileType (hFile=0x208) returned 0x1
	[0078.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0078.339] GetFileType (hFile=0x208) returned 0x1
	[0078.339] WriteFile (in: hFile=0x208, lpBuffer=0x2708bb0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2708bb0*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0078.342] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0078.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0078.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History", lpFilePart=0x0) returned 0x33
	[0078.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\", lpFilePart=0x0) returned 0x34
	[0078.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0078.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eee0) returned 1
	[0078.356] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8de8eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x126da7, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0078.357] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0078.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0078.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x35
	[0078.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x36
	[0078.358] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0078.359] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.359] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0078.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x41
	[0078.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x42
	[0078.360] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.361] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.361] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.362] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x41
	[0078.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x42
	[0078.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.364] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.364] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.365] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0078.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\credentials\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0078.370] GetFileType (hFile=0x220) returned 0x1
	[0078.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0078.370] GetFileType (hFile=0x220) returned 0x1
	[0078.370] WriteFile (in: hFile=0x220, lpBuffer=0x270dd78*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x270dd78*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0078.373] CloseHandle (hObject=0x220) returned 1
	[0078.374] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0078.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x42
	[0078.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x43
	[0078.375] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.376] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.376] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.377] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x42
	[0078.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x43
	[0078.378] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.378] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.379] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0078.380] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0078.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\event viewer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0078.381] GetFileType (hFile=0x220) returned 0x1
	[0078.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0078.381] GetFileType (hFile=0x220) returned 0x1
	[0078.381] WriteFile (in: hFile=0x220, lpBuffer=0x27119cc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27119cc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0078.384] CloseHandle (hObject=0x220) returned 1
	[0078.385] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0078.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x3b
	[0078.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x3c
	[0078.386] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.396] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.396] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1
	[0078.397] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1
	[0078.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.407] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c
	[0078.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x4c
	[0078.462] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c
	[0078.463] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e8b0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d
	[0078.465] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d
	[0078.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x4d
	[0078.467] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d
	[0078.473] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.483] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.484] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1
	[0078.484] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1
	[0078.485] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1
	[0078.485] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0
	[0078.486] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.490] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c
	[0078.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x4c
	[0078.492] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c
	[0078.493] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e8b0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d
	[0078.495] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d
	[0078.497] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x4d
	[0078.497] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d
	[0078.502] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.506] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.507] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1
	[0078.508] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1
	[0078.508] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1
	[0078.509] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.509] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.512] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e794, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d
	[0078.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Decrypt.txt", lpFilePart=0x0) returned 0x58
	[0078.514] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Decrypt.txt", lpszLongPath=0x26e794, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0
	[0078.517] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x26e754, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c
	[0078.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0078.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0078.539] GetFileType (hFile=0x224) returned 0x1
	[0078.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0078.539] GetFileType (hFile=0x224) returned 0x1
	[0078.540] WriteFile (in: hFile=0x224, lpBuffer=0x2717da8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2717da8*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0078.543] CloseHandle (hObject=0x224) returned 1
	[0078.543] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1
	[0078.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.544] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63
	[0078.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x63
	[0078.546] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63
	[0078.547] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e8b0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.550] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x64
	[0078.551] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.557] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.557] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1
	[0078.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.558] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e830, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.560] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x26e830, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e
	[0078.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x6e
	[0078.562] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x26e830, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e
	[0078.563] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.569] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f
	[0078.570] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e804, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.572] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e804, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f
	[0078.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x6f
	[0078.573] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e804, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f
	[0078.578] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.579] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.579] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52d69eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites~.feed-ms", cAlternateFileName="SUGGES~1.FEE")) returned 1
	[0078.580] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 1
	[0078.581] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0
	[0078.581] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.582] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e830, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.584] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x26e830, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e
	[0078.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x6e
	[0078.586] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x26e830, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e
	[0078.587] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.589] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f
	[0078.590] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e804, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.592] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e804, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f
	[0078.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x6f
	[0078.594] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e804, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f
	[0078.599] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0078.599] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.600] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52d69eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites~.feed-ms", cAlternateFileName="SUGGES~1.FEE")) returned 1
	[0078.600] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 1
	[0078.601] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.601] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0078.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0078.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0078.602] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e6f4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.603] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e6f4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f
	[0078.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Decrypt.txt", lpFilePart=0x0) returned 0x7a
	[0078.605] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Decrypt.txt", lpszLongPath=0x26e6f4, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0
	[0078.606] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x26e6b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e
	[0078.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0078.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0078.644] GetFileType (hFile=0x228) returned 0x1
	[0078.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0078.644] GetFileType (hFile=0x228) returned 0x1
	[0078.644] WriteFile (in: hFile=0x228, lpBuffer=0x271ec10*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x271ec10*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0078.647] CloseHandle (hObject=0x228) returned 1
	[0078.648] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.648] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.649] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63
	[0078.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x63
	[0078.651] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63
	[0078.652] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e8b0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.654] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.655] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x64
	[0078.655] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.661] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.661] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.662] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xffd9e190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffd9e190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1
	[0078.663] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xffd9e190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffd9e190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 0
	[0078.663] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.664] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e794, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64
	[0078.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Decrypt.txt", lpFilePart=0x0) returned 0x6f
	[0078.665] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Decrypt.txt", lpszLongPath=0x26e794, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0
	[0078.666] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x26e754, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63
	[0078.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0078.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0078.668] GetFileType (hFile=0x224) returned 0x1
	[0078.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0078.669] GetFileType (hFile=0x224) returned 0x1
	[0078.669] WriteFile (in: hFile=0x224, lpBuffer=0x27224ac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27224ac*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0078.672] CloseHandle (hObject=0x224) returned 1
	[0078.673] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.673] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x3b
	[0078.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x3c
	[0078.678] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.679] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.679] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1
	[0078.680] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xffc937f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffc937f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1
	[0078.680] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xffdc42f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffdc42f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1
	[0078.681] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xffdc42f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffdc42f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0
	[0078.682] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0078.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0078.683] GetFileType (hFile=0x220) returned 0x1
	[0078.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0078.684] GetFileType (hFile=0x220) returned 0x1
	[0078.684] WriteFile (in: hFile=0x220, lpBuffer=0x2725d44*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2725d44*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0078.687] CloseHandle (hObject=0x220) returned 1
	[0078.688] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0078.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x41
	[0078.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x42
	[0078.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.743] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.744] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1
	[0078.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x4a
	[0078.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", lpFilePart=0x0) returned 0x4b
	[0078.745] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.746] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.746] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.747] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0078.749] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0078.749] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x4a
	[0078.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", lpFilePart=0x0) returned 0x4b
	[0078.751] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.752] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.752] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.752] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0078.753] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.753] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0078.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0078.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0078.755] GetFileType (hFile=0x224) returned 0x1
	[0078.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0078.755] GetFileType (hFile=0x224) returned 0x1
	[0078.756] WriteFile (in: hFile=0x224, lpBuffer=0x272b2b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x272b2b4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0078.759] CloseHandle (hObject=0x224) returned 1
	[0078.760] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1
	[0078.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x4a
	[0078.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", lpFilePart=0x0) returned 0x4b
	[0078.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.761] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.762] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.762] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0078.763] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0078.763] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x4a
	[0078.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", lpFilePart=0x0) returned 0x4b
	[0078.764] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.765] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.765] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.766] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0078.766] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.767] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0078.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0078.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0078.781] GetFileType (hFile=0x224) returned 0x1
	[0078.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0078.781] GetFileType (hFile=0x224) returned 0x1
	[0078.781] WriteFile (in: hFile=0x224, lpBuffer=0x272fcd0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x272fcd0*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0078.788] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1
	[0078.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x4a
	[0078.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", lpFilePart=0x0) returned 0x4b
	[0078.788] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.789] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.790] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.790] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0078.791] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0078.791] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.792] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x4a
	[0078.792] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", lpFilePart=0x0) returned 0x4b
	[0078.792] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.793] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.794] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.794] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0078.794] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.795] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0078.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0078.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0078.796] GetFileType (hFile=0x224) returned 0x1
	[0078.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0078.796] GetFileType (hFile=0x224) returned 0x1
	[0078.796] WriteFile (in: hFile=0x224, lpBuffer=0x27346ec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27346ec*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0078.800] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.801] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0078.801] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1
	[0078.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x4a
	[0078.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", lpFilePart=0x0) returned 0x4b
	[0078.802] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.803] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.803] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.804] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0078.804] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1
	[0078.805] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0
	[0078.805] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0078.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x4a
	[0078.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", lpFilePart=0x0) returned 0x4b
	[0078.806] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0078.807] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.807] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.808] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0078.808] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1
	[0078.809] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.809] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0078.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0078.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0078.809] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0078.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0078.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0078.810] GetFileType (hFile=0x224) returned 0x1
	[0078.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0078.811] GetFileType (hFile=0x224) returned 0x1
	[0078.811] WriteFile (in: hFile=0x224, lpBuffer=0x2739b44*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2739b44*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0078.820] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0078.821] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x41
	[0078.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x42
	[0078.822] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.822] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.823] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xffe829d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffe829d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1
	[0078.824] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xffecec90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffecec90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1
	[0078.824] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xffef4df0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffef4df0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1
	[0078.825] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0078.825] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0078.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", lpFilePart=0x0) returned 0x4b
	[0078.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0078.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0078.879] GetFileType (hFile=0x224) returned 0x1
	[0078.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0078.880] GetFileType (hFile=0x224) returned 0x1
	[0078.880] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x8000
	[0078.880] ReadFile (in: hFile=0x224, lpBuffer=0x273c288, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x273c288*, lpNumberOfBytesRead=0x26ede4*=0x8000, lpOverlapped=0x0) returned 1
	[0078.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.KEKW", lpFilePart=0x0) returned 0x50
	[0078.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0078.886] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0078.887] GetFileType (hFile=0x224) returned 0x1
	[0078.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0078.887] GetFileType (hFile=0x224) returned 0x1
	[0078.888] WriteFile (in: hFile=0x224, lpBuffer=0x27459a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27459a4*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0078.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", lpFilePart=0x0) returned 0x4b
	[0078.891] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")) returned 1
	[0078.895] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xfff1af50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfff1af50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1
	[0078.895] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xfff1af50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfff1af50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0
	[0078.896] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0078.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0078.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0078.897] GetFileType (hFile=0x220) returned 0x1
	[0078.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0078.897] GetFileType (hFile=0x220) returned 0x1
	[0078.898] WriteFile (in: hFile=0x220, lpBuffer=0x2748284*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2748284*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0078.901] CloseHandle (hObject=0x220) returned 1
	[0078.901] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1
	[0078.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x3b
	[0078.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", lpFilePart=0x0) returned 0x3c
	[0078.902] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.904] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.904] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1
	[0078.905] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0
	[0078.905] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0078.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0078.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0078.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0078.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x3b
	[0078.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", lpFilePart=0x0) returned 0x3c
	[0078.906] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0078.907] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.933] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1
	[0078.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT", lpFilePart=0x0) returned 0x48
	[0078.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0078.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0078.985] GetFileType (hFile=0x224) returned 0x1
	[0078.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0078.985] GetFileType (hFile=0x224) returned 0x1
	[0078.985] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x3c0dc
	[0079.061] ReadFile (in: hFile=0x224, lpBuffer=0x35d54d0, nNumberOfBytesToRead=0x3c0dc, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x35d54d0*, lpNumberOfBytesRead=0x26ede4*=0x3c0dc, lpOverlapped=0x0) returned 1
	[0079.100] CloseHandle (hObject=0x224) returned 1
	[0079.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.KEKW", lpFilePart=0x0) returned 0x4d
	[0079.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0079.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0079.102] GetFileType (hFile=0x224) returned 0x1
	[0079.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0079.102] GetFileType (hFile=0x224) returned 0x1
	[0079.104] WriteFile (in: hFile=0x224, lpBuffer=0x25de890*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x25de890*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0079.106] CloseHandle (hObject=0x224) returned 1
	[0079.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT", lpFilePart=0x0) returned 0x48
	[0079.107] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat")) returned 1
	[0079.115] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.115] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0079.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0079.117] GetFileType (hFile=0x220) returned 0x1
	[0079.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0079.117] GetFileType (hFile=0x220) returned 0x1
	[0079.117] WriteFile (in: hFile=0x220, lpBuffer=0x25e0fb8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25e0fb8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0079.121] CloseHandle (hObject=0x220) returned 1
	[0079.121] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1
	[0079.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3b
	[0079.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3c
	[0079.122] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.123] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.124] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.124] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3b
	[0079.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3c
	[0079.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.130] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.131] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.131] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0079.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\ime12\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0079.133] GetFileType (hFile=0x220) returned 0x1
	[0079.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0079.133] GetFileType (hFile=0x220) returned 0x1
	[0079.133] WriteFile (in: hFile=0x220, lpBuffer=0x25e4a1c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25e4a1c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0079.136] CloseHandle (hObject=0x220) returned 1
	[0079.137] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1
	[0079.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3c
	[0079.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3d
	[0079.138] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.148] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.148] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.149] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3c
	[0079.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3d
	[0079.150] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.150] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.151] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.151] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0079.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp12\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0079.153] GetFileType (hFile=0x220) returned 0x1
	[0079.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0079.153] GetFileType (hFile=0x220) returned 0x1
	[0079.154] WriteFile (in: hFile=0x220, lpBuffer=0x25e84dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25e84dc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0079.157] CloseHandle (hObject=0x220) returned 1
	[0079.158] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1
	[0079.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3d
	[0079.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x3e
	[0079.159] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.172] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.172] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.173] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3d
	[0079.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x3e
	[0079.175] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.175] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.176] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.176] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0079.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp8_1\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0079.178] GetFileType (hFile=0x220) returned 0x1
	[0079.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0079.178] GetFileType (hFile=0x220) returned 0x1
	[0079.178] WriteFile (in: hFile=0x220, lpBuffer=0x25ebfbc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25ebfbc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0079.181] CloseHandle (hObject=0x220) returned 1
	[0079.182] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1
	[0079.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3d
	[0079.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x3e
	[0079.183] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.184] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.185] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.185] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3d
	[0079.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x3e
	[0079.186] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.187] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.187] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.188] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0079.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp9_0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0079.194] GetFileType (hFile=0x220) returned 0x1
	[0079.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0079.195] GetFileType (hFile=0x220) returned 0x1
	[0079.195] WriteFile (in: hFile=0x220, lpBuffer=0x25efa9c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25efa9c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0079.198] CloseHandle (hObject=0x220) returned 1
	[0079.198] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0079.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x47
	[0079.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x48
	[0079.199] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.234] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.235] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.bak", cAlternateFileName="")) returned 1
	[0079.236] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1
	[0079.236] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1
	[0079.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x50
	[0079.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x51
	[0079.237] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.245] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.246] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1
	[0079.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", lpFilePart=0x0) returned 0x59
	[0079.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", lpFilePart=0x0) returned 0x5a
	[0079.247] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.247] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.248] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.248] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", lpFilePart=0x0) returned 0x59
	[0079.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", lpFilePart=0x0) returned 0x5a
	[0079.250] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.250] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.251] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.252] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Decrypt.txt", lpFilePart=0x0) returned 0x65
	[0079.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0079.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\3lkbqzj3\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0079.253] GetFileType (hFile=0x228) returned 0x1
	[0079.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0079.253] GetFileType (hFile=0x228) returned 0x1
	[0079.254] WriteFile (in: hFile=0x228, lpBuffer=0x25f5864*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x25f5864*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0079.257] CloseHandle (hObject=0x228) returned 1
	[0079.257] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8NES5H33", cAlternateFileName="")) returned 1
	[0079.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", lpFilePart=0x0) returned 0x59
	[0079.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", lpFilePart=0x0) returned 0x5a
	[0079.258] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.259] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.259] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 1
	[0079.260] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 0
	[0079.260] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", lpFilePart=0x0) returned 0x59
	[0079.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", lpFilePart=0x0) returned 0x5a
	[0079.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.262] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.263] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 1
	[0079.263] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.264] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Decrypt.txt", lpFilePart=0x0) returned 0x65
	[0079.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0079.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0079.265] GetFileType (hFile=0x228) returned 0x1
	[0079.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0079.265] GetFileType (hFile=0x228) returned 0x1
	[0079.266] WriteFile (in: hFile=0x228, lpBuffer=0x25fa198*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x25fa198*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0079.277] CloseHandle (hObject=0x228) returned 1
	[0079.279] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1
	[0079.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", lpFilePart=0x0) returned 0x59
	[0079.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", lpFilePart=0x0) returned 0x5a
	[0079.280] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.281] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.281] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.282] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", lpFilePart=0x0) returned 0x59
	[0079.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", lpFilePart=0x0) returned 0x5a
	[0079.283] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.284] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.284] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.285] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Decrypt.txt", lpFilePart=0x0) returned 0x65
	[0079.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0079.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\fkluidu0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0079.287] GetFileType (hFile=0x228) returned 0x1
	[0079.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0079.287] GetFileType (hFile=0x228) returned 0x1
	[0079.288] WriteFile (in: hFile=0x228, lpBuffer=0x25fe30c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x25fe30c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0079.292] CloseHandle (hObject=0x228) returned 1
	[0079.293] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0079.294] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1
	[0079.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", lpFilePart=0x0) returned 0x59
	[0079.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", lpFilePart=0x0) returned 0x5a
	[0079.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.295] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.296] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.296] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", lpFilePart=0x0) returned 0x59
	[0079.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", lpFilePart=0x0) returned 0x5a
	[0079.297] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.298] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.299] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.299] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Decrypt.txt", lpFilePart=0x0) returned 0x65
	[0079.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0079.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\owlvmzrc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0079.301] GetFileType (hFile=0x228) returned 0x1
	[0079.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0079.302] GetFileType (hFile=0x228) returned 0x1
	[0079.302] WriteFile (in: hFile=0x228, lpBuffer=0x260263c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x260263c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0079.306] CloseHandle (hObject=0x228) returned 1
	[0079.307] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.307] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x50
	[0079.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x51
	[0079.308] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.309] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.309] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x36b730, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x36b730, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1
	[0079.310] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x36b730, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x36b730, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8NES5H33", cAlternateFileName="")) returned 1
	[0079.311] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x3b79f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x3b79f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1
	[0079.311] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0079.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", lpFilePart=0x0) returned 0x5a
	[0079.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0079.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0079.312] GetFileType (hFile=0x228) returned 0x1
	[0079.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0079.312] GetFileType (hFile=0x228) returned 0x1
	[0079.312] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x8000
	[0079.313] ReadFile (in: hFile=0x228, lpBuffer=0x2604c84, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2604c84*, lpNumberOfBytesRead=0x26ed44*=0x8000, lpOverlapped=0x0) returned 1
	[0079.326] CloseHandle (hObject=0x228) returned 1
	[0079.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.KEKW", lpFilePart=0x0) returned 0x5f
	[0079.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0079.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0079.331] GetFileType (hFile=0x228) returned 0x1
	[0079.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0079.331] GetFileType (hFile=0x228) returned 0x1
	[0079.332] WriteFile (in: hFile=0x228, lpBuffer=0x260e3d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x260e3d8*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0079.335] CloseHandle (hObject=0x228) returned 1
	[0079.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", lpFilePart=0x0) returned 0x5a
	[0079.336] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat")) returned 1
	[0079.340] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x3ddb50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x3ddb50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1
	[0079.340] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x3ddb50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x3ddb50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 0
	[0079.341] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Decrypt.txt", lpFilePart=0x0) returned 0x5c
	[0079.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0079.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0079.342] GetFileType (hFile=0x224) returned 0x1
	[0079.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0079.342] GetFileType (hFile=0x224) returned 0x1
	[0079.343] WriteFile (in: hFile=0x224, lpBuffer=0x2610d50*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2610d50*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0079.349] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1
	[0079.350] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x95014270, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1
	[0079.350] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0079.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x50
	[0079.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", lpFilePart=0x0) returned 0x51
	[0079.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.352] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.353] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1
	[0079.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x57
	[0079.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", lpFilePart=0x0) returned 0x58
	[0079.353] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.354] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.355] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.355] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x57
	[0079.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", lpFilePart=0x0) returned 0x58
	[0079.356] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.357] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.357] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.357] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0079.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0079.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0079.359] GetFileType (hFile=0x228) returned 0x1
	[0079.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0079.359] GetFileType (hFile=0x228) returned 0x1
	[0079.359] WriteFile (in: hFile=0x228, lpBuffer=0x2615eec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2615eec*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0079.365] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1
	[0079.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x5c
	[0079.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", lpFilePart=0x0) returned 0x5d
	[0079.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.394] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.395] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 1
	[0079.395] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1
	[0079.396] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 1
	[0079.396] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 1
	[0079.397] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 0
	[0079.397] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x5c
	[0079.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", lpFilePart=0x0) returned 0x5d
	[0079.401] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.404] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.404] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 1
	[0079.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpFilePart=0x0) returned 0x95
	[0079.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0079.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0079.406] GetFileType (hFile=0x22c) returned 0x1
	[0079.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0079.406] GetFileType (hFile=0x22c) returned 0x1
	[0079.406] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xe00
	[0079.406] ReadFile (in: hFile=0x22c, lpBuffer=0x261ae34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x261ae34*, lpNumberOfBytesRead=0x26eca4*=0xe00, lpOverlapped=0x0) returned 1
	[0079.411] CloseHandle (hObject=0x22c) returned 1
	[0079.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.KEKW", lpFilePart=0x0) returned 0x9a
	[0079.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0079.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0079.413] GetFileType (hFile=0x22c) returned 0x1
	[0079.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0079.413] GetFileType (hFile=0x22c) returned 0x1
	[0079.414] WriteFile (in: hFile=0x22c, lpBuffer=0x261d6d4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x261d6d4*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0079.417] CloseHandle (hObject=0x22c) returned 1
	[0079.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpFilePart=0x0) returned 0x95
	[0079.418] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 1
	[0079.422] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1
	[0079.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", lpFilePart=0x0) returned 0x95
	[0079.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0079.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0079.446] GetFileType (hFile=0x22c) returned 0x1
	[0079.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0079.447] GetFileType (hFile=0x22c) returned 0x1
	[0079.447] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x1200
	[0079.447] ReadFile (in: hFile=0x22c, lpBuffer=0x261f184, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x261f184*, lpNumberOfBytesRead=0x26eca4*=0x1200, lpOverlapped=0x0) returned 1
	[0079.451] CloseHandle (hObject=0x22c) returned 1
	[0079.452] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.KEKW", lpFilePart=0x0) returned 0x9a
	[0079.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0079.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0079.453] GetFileType (hFile=0x22c) returned 0x1
	[0079.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0079.453] GetFileType (hFile=0x22c) returned 0x1
	[0079.454] WriteFile (in: hFile=0x22c, lpBuffer=0x2621c24*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x2621c24*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0079.457] CloseHandle (hObject=0x22c) returned 1
	[0079.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", lpFilePart=0x0) returned 0x95
	[0079.458] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat")) returned 1
	[0079.461] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 1
	[0079.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpFilePart=0x0) returned 0x87
	[0079.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0079.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0079.465] GetFileType (hFile=0x22c) returned 0x1
	[0079.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0079.466] GetFileType (hFile=0x22c) returned 0x1
	[0079.466] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x1200
	[0079.466] ReadFile (in: hFile=0x22c, lpBuffer=0x26235e0, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x26235e0*, lpNumberOfBytesRead=0x26eca4*=0x1200, lpOverlapped=0x0) returned 1
	[0079.473] CloseHandle (hObject=0x22c) returned 1
	[0079.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.KEKW", lpFilePart=0x0) returned 0x8c
	[0079.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0079.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0079.474] GetFileType (hFile=0x22c) returned 0x1
	[0079.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0079.475] GetFileType (hFile=0x22c) returned 0x1
	[0079.475] WriteFile (in: hFile=0x22c, lpBuffer=0x262602c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x262602c*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0079.480] CloseHandle (hObject=0x22c) returned 1
	[0079.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpFilePart=0x0) returned 0x87
	[0079.481] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 1
	[0079.485] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 1
	[0079.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpFilePart=0x0) returned 0x87
	[0079.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0079.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0079.488] GetFileType (hFile=0x22c) returned 0x1
	[0079.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0079.488] GetFileType (hFile=0x22c) returned 0x1
	[0079.488] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x1200
	[0079.488] ReadFile (in: hFile=0x22c, lpBuffer=0x26279cc, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x26279cc*, lpNumberOfBytesRead=0x26eca4*=0x1200, lpOverlapped=0x0) returned 1
	[0079.493] CloseHandle (hObject=0x22c) returned 1
	[0079.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.KEKW", lpFilePart=0x0) returned 0x8c
	[0079.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0079.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0079.494] GetFileType (hFile=0x22c) returned 0x1
	[0079.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0079.495] GetFileType (hFile=0x22c) returned 0x1
	[0079.495] WriteFile (in: hFile=0x22c, lpBuffer=0x262a418*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x262a418*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0079.498] CloseHandle (hObject=0x22c) returned 1
	[0079.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", lpFilePart=0x0) returned 0x87
	[0079.499] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 1
	[0079.503] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.504] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0079.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0079.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0079.505] GetFileType (hFile=0x228) returned 0x1
	[0079.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0079.505] GetFileType (hFile=0x228) returned 0x1
	[0079.506] WriteFile (in: hFile=0x228, lpBuffer=0x262cc44*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x262cc44*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0079.509] CloseHandle (hObject=0x228) returned 1
	[0079.509] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.509] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x50
	[0079.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", lpFilePart=0x0) returned 0x51
	[0079.510] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.511] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.512] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x44ff70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x44ff70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1
	[0079.512] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ccd30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x5ccd30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1
	[0079.513] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ccd30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x5ccd30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 0
	[0079.513] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Decrypt.txt", lpFilePart=0x0) returned 0x5c
	[0079.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0079.514] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0079.515] GetFileType (hFile=0x224) returned 0x1
	[0079.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0079.515] GetFileType (hFile=0x224) returned 0x1
	[0079.515] WriteFile (in: hFile=0x224, lpBuffer=0x2630264*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2630264*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0079.518] CloseHandle (hObject=0x224) returned 1
	[0079.519] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.519] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x47
	[0079.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x48
	[0079.520] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.521] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.522] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.bak", cAlternateFileName="")) returned 1
	[0079.522] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1
	[0079.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x53
	[0079.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0079.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0079.524] GetFileType (hFile=0x224) returned 0x1
	[0079.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0079.525] GetFileType (hFile=0x224) returned 0x1
	[0079.525] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x2fb0
	[0079.525] ReadFile (in: hFile=0x224, lpBuffer=0x2632674, nNumberOfBytesToRead=0x2fb0, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2632674*, lpNumberOfBytesRead=0x26ede4*=0x2fb0, lpOverlapped=0x0) returned 1
	[0079.530] CloseHandle (hObject=0x224) returned 1
	[0079.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.KEKW", lpFilePart=0x0) returned 0x58
	[0079.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0079.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0079.532] GetFileType (hFile=0x224) returned 0x1
	[0079.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0079.532] GetFileType (hFile=0x224) returned 0x1
	[0079.532] WriteFile (in: hFile=0x224, lpBuffer=0x2636d64*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2636d64*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0079.536] CloseHandle (hObject=0x224) returned 1
	[0079.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x53
	[0079.537] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 1
	[0079.540] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x429e10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x429e10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1
	[0079.541] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1
	[0079.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat", lpFilePart=0x0) returned 0x5a
	[0079.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0079.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0079.544] GetFileType (hFile=0x224) returned 0x1
	[0079.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0079.544] GetFileType (hFile=0x224) returned 0x1
	[0079.544] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x23f4
	[0079.544] ReadFile (in: hFile=0x224, lpBuffer=0x26385bc, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26385bc*, lpNumberOfBytesRead=0x26ede4*=0x23f4, lpOverlapped=0x0) returned 1
	[0079.550] CloseHandle (hObject=0x224) returned 1
	[0079.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.KEKW", lpFilePart=0x0) returned 0x5f
	[0079.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0079.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0079.551] GetFileType (hFile=0x224) returned 0x1
	[0079.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0079.551] GetFileType (hFile=0x224) returned 0x1
	[0079.551] WriteFile (in: hFile=0x224, lpBuffer=0x263c114*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x263c114*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0079.555] CloseHandle (hObject=0x224) returned 1
	[0079.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat", lpFilePart=0x0) returned 0x5a
	[0079.556] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat")) returned 1
	[0079.559] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x95014270, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1
	[0079.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT", lpFilePart=0x0) returned 0x54
	[0079.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0079.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0079.567] GetFileType (hFile=0x224) returned 0x1
	[0079.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0079.567] GetFileType (hFile=0x224) returned 0x1
	[0079.567] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x4000
	[0079.568] ReadFile (in: hFile=0x224, lpBuffer=0x263d760, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x263d760*, lpNumberOfBytesRead=0x26ede4*=0x4000, lpOverlapped=0x0) returned 1
	[0079.573] CloseHandle (hObject=0x224) returned 1
	[0079.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.KEKW", lpFilePart=0x0) returned 0x59
	[0079.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0079.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0079.574] GetFileType (hFile=0x224) returned 0x1
	[0079.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0079.574] GetFileType (hFile=0x224) returned 0x1
	[0079.574] WriteFile (in: hFile=0x224, lpBuffer=0x2642ea0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2642ea0*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0079.578] CloseHandle (hObject=0x224) returned 1
	[0079.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT", lpFilePart=0x0) returned 0x54
	[0079.578] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat")) returned 1
	[0079.582] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ccd30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x5ccd30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0079.582] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ccd30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x5ccd30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 0
	[0079.583] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0079.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0079.584] GetFileType (hFile=0x220) returned 0x1
	[0079.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0079.584] GetFileType (hFile=0x220) returned 0x1
	[0079.585] WriteFile (in: hFile=0x220, lpBuffer=0x26457c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26457c4*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0079.588] CloseHandle (hObject=0x220) returned 1
	[0079.588] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0079.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x42
	[0079.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x43
	[0079.589] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.594] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.594] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1
	[0079.595] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1
	[0079.596] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1
	[0079.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x51
	[0079.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x52
	[0079.596] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.597] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.598] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0079.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x57
	[0079.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x58
	[0079.598] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.599] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.600] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0000E713", cAlternateFileName="")) returned 1
	[0079.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0079.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713", lpFilePart=0x0) returned 0x60
	[0079.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\", lpFilePart=0x0) returned 0x61
	[0079.601] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0079.608] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.609] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1
	[0079.609] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1
	[0079.610] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1
	[0079.611] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1
	[0079.611] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1
	[0079.612] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1
	[0079.612] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1
	[0079.613] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1
	[0079.613] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1
	[0079.614] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1
	[0079.615] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1
	[0079.615] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1
	[0079.616] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0
	[0079.616] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0079.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0079.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0079.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0079.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713", lpFilePart=0x0) returned 0x60
	[0079.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\", lpFilePart=0x0) returned 0x61
	[0079.620] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0079.623] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.623] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1
	[0079.624] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1
	[0079.624] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1
	[0079.624] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1
	[0079.625] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1
	[0079.626] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1
	[0079.626] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1
	[0079.627] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1
	[0079.627] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1
	[0079.628] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1
	[0079.628] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1
	[0079.629] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1
	[0079.629] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.629] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0079.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0079.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0079.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0079.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0079.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0079.637] GetFileType (hFile=0x22c) returned 0x1
	[0079.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0079.637] GetFileType (hFile=0x22c) returned 0x1
	[0079.637] WriteFile (in: hFile=0x22c, lpBuffer=0x2652fa4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2652fa4*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0079.640] CloseHandle (hObject=0x22c) returned 1
	[0079.641] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 1
	[0079.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0079.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x60
	[0079.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", lpFilePart=0x0) returned 0x61
	[0079.642] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0079.647] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.647] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1
	[0079.648] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1
	[0079.648] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1
	[0079.649] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1
	[0079.650] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1
	[0079.650] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1
	[0079.651] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1
	[0079.651] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1
	[0079.652] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1
	[0079.652] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1
	[0079.653] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1
	[0079.653] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1
	[0079.654] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0
	[0079.654] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0079.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0079.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0079.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0079.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x60
	[0079.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", lpFilePart=0x0) returned 0x61
	[0079.658] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0079.661] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.662] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1
	[0079.662] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1
	[0079.663] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1
	[0079.663] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1
	[0079.663] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1
	[0079.664] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1
	[0079.664] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1
	[0079.664] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1
	[0079.665] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1
	[0079.665] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1
	[0079.665] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1
	[0079.665] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1
	[0079.666] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.666] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0079.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0079.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0079.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0079.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0079.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0079.672] GetFileType (hFile=0x22c) returned 0x1
	[0079.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0079.673] GetFileType (hFile=0x22c) returned 0x1
	[0079.673] WriteFile (in: hFile=0x22c, lpBuffer=0x265dd34*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x265dd34*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0079.679] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.679] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x57
	[0079.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x58
	[0079.680] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.681] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.681] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6fd830, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x6fd830, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0000E713", cAlternateFileName="")) returned 1
	[0079.681] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x749af0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x749af0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 1
	[0079.682] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x749af0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x749af0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 0
	[0079.682] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0079.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0079.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0079.684] GetFileType (hFile=0x228) returned 0x1
	[0079.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0079.684] GetFileType (hFile=0x228) returned 0x1
	[0079.684] WriteFile (in: hFile=0x228, lpBuffer=0x266140c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x266140c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0079.687] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.689] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x51
	[0079.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x52
	[0079.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.691] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.691] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x76fc50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x76fc50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0079.691] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x76fc50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x76fc50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0079.692] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0079.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0079.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0079.693] GetFileType (hFile=0x224) returned 0x1
	[0079.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0079.694] GetFileType (hFile=0x224) returned 0x1
	[0079.694] WriteFile (in: hFile=0x224, lpBuffer=0x2664824*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2664824*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0079.697] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1
	[0079.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", lpFilePart=0x0) returned 0x59
	[0079.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", lpFilePart=0x0) returned 0x5a
	[0079.698] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.700] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.700] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.701] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", lpFilePart=0x0) returned 0x59
	[0079.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", lpFilePart=0x0) returned 0x5a
	[0079.702] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.702] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.702] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.703] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.703] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x65
	[0079.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0079.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\transcoded files cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0079.704] GetFileType (hFile=0x224) returned 0x1
	[0079.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0079.705] GetFileType (hFile=0x224) returned 0x1
	[0079.705] WriteFile (in: hFile=0x224, lpBuffer=0x26689d4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26689d4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0079.708] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.708] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x42
	[0079.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x43
	[0079.709] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.709] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.709] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1
	[0079.710] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1
	[0079.710] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x795db0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x795db0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1
	[0079.711] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0x7bbf10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7bbf10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1
	[0079.711] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0x7bbf10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7bbf10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0
	[0079.712] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0079.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0079.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0079.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0079.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0079.713] GetFileType (hFile=0x220) returned 0x1
	[0079.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0079.713] GetFileType (hFile=0x220) returned 0x1
	[0079.713] WriteFile (in: hFile=0x220, lpBuffer=0x266c7ac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x266c7ac*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0079.716] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0079.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0079.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x3c
	[0079.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x3d
	[0079.717] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0079.721] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.721] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.0", cAlternateFileName="")) returned 1
	[0079.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", lpFilePart=0x0) returned 0x41
	[0079.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", lpFilePart=0x0) returned 0x42
	[0079.721] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.724] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.724] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1
	[0079.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", lpFilePart=0x0) returned 0x51
	[0079.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", lpFilePart=0x0) returned 0x52
	[0079.725] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.727] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.727] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 1
	[0079.728] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", cAlternateFileName="FSD-{4~1.FSD")) returned 1
	[0079.728] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 1
	[0079.729] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 0
	[0079.729] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", lpFilePart=0x0) returned 0x51
	[0079.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", lpFilePart=0x0) returned 0x52
	[0079.730] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.730] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.731] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 1
	[0079.731] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", cAlternateFileName="FSD-{4~1.FSD")) returned 1
	[0079.731] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 1
	[0079.731] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.731] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0079.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0079.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0079.737] GetFileType (hFile=0x228) returned 0x1
	[0079.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0079.737] GetFileType (hFile=0x228) returned 0x1
	[0079.737] WriteFile (in: hFile=0x228, lpBuffer=0x2673384*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2673384*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0079.740] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.741] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", lpFilePart=0x0) returned 0x41
	[0079.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", lpFilePart=0x0) returned 0x42
	[0079.742] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.742] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.742] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0x8081d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8081d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1
	[0079.743] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0x8081d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8081d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 0
	[0079.743] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0079.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0079.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0079.744] GetFileType (hFile=0x224) returned 0x1
	[0079.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0079.744] GetFileType (hFile=0x224) returned 0x1
	[0079.745] WriteFile (in: hFile=0x224, lpBuffer=0x267660c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x267660c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0079.749] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1
	[0079.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", lpFilePart=0x0) returned 0x43
	[0079.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", lpFilePart=0x0) returned 0x44
	[0079.749] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.751] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.751] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0079.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", lpFilePart=0x0) returned 0x4a
	[0079.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", lpFilePart=0x0) returned 0x4b
	[0079.752] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.753] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.753] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.753] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", lpFilePart=0x0) returned 0x4a
	[0079.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", lpFilePart=0x0) returned 0x4b
	[0079.754] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.754] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.755] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.755] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0079.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0079.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\system\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0079.757] GetFileType (hFile=0x228) returned 0x1
	[0079.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0079.757] GetFileType (hFile=0x228) returned 0x1
	[0079.757] WriteFile (in: hFile=0x228, lpBuffer=0x267af7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x267af7c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0079.760] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1
	[0079.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", lpFilePart=0x0) returned 0x48
	[0079.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", lpFilePart=0x0) returned 0x49
	[0079.761] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.761] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.762] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.762] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0079.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", lpFilePart=0x0) returned 0x48
	[0079.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", lpFilePart=0x0) returned 0x49
	[0079.763] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0079.763] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.764] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0079.764] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0079.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0079.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0079.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0079.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0079.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\user\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0079.765] GetFileType (hFile=0x228) returned 0x1
	[0079.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0079.765] GetFileType (hFile=0x228) returned 0x1
	[0079.766] WriteFile (in: hFile=0x228, lpBuffer=0x267ed08*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x267ed08*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0079.770] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.770] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", lpFilePart=0x0) returned 0x43
	[0079.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", lpFilePart=0x0) returned 0x44
	[0079.771] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.771] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.771] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x82e330, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x82e330, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0079.772] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x82e330, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x82e330, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1
	[0079.772] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x82e330, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x82e330, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0
	[0079.773] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.773] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0079.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0079.773] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0079.785] GetFileType (hFile=0x224) returned 0x1
	[0079.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0079.786] GetFileType (hFile=0x224) returned 0x1
	[0079.786] WriteFile (in: hFile=0x224, lpBuffer=0x26820bc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26820bc*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0079.790] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1
	[0079.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x47
	[0079.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", lpFilePart=0x0) returned 0x48
	[0079.790] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.791] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.791] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 1
	[0079.792] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 1
	[0079.792] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 0
	[0079.792] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0079.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x47
	[0079.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", lpFilePart=0x0) returned 0x48
	[0079.793] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0079.794] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0079.794] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 1
	[0079.794] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 1
	[0079.795] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0079.795] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0079.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0079.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0079.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0079.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0079.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0079.804] GetFileType (hFile=0x224) returned 0x1
	[0079.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0079.804] GetFileType (hFile=0x224) returned 0x1
	[0079.805] WriteFile (in: hFile=0x224, lpBuffer=0x2686e4c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2686e4c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0080.139] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.140] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0080.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0080.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0080.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0080.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x3c
	[0080.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x3d
	[0080.141] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0080.141] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.142] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8081d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8081d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14.0", cAlternateFileName="")) returned 1
	[0080.142] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x87a5f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x87a5f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1
	[0080.142] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8a0750, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8a0750, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1
	[0080.143] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8a0750, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8a0750, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 0
	[0080.143] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0080.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0080.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0080.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0080.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0080.151] GetFileType (hFile=0x220) returned 0x1
	[0080.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0080.151] GetFileType (hFile=0x220) returned 0x1
	[0080.151] WriteFile (in: hFile=0x220, lpBuffer=0x268a2b8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x268a2b8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0080.154] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1
	[0080.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0080.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3d
	[0080.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x3e
	[0080.155] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0080.160] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.161] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1
	[0080.161] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 1
	[0080.161] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1
	[0080.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", lpFilePart=0x0) returned 0x47
	[0080.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", lpFilePart=0x0) returned 0x48
	[0080.162] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.163] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.163] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0080.163] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0080.163] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", lpFilePart=0x0) returned 0x47
	[0080.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", lpFilePart=0x0) returned 0x48
	[0080.164] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.165] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.165] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0080.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", lpFilePart=0x0) returned 0x82
	[0080.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0080.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0080.166] GetFileType (hFile=0x228) returned 0x1
	[0080.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0080.166] GetFileType (hFile=0x228) returned 0x1
	[0080.166] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x104
	[0080.166] ReadFile (in: hFile=0x228, lpBuffer=0x268e47c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x268e47c*, lpNumberOfBytesRead=0x26ed44*=0x104, lpOverlapped=0x0) returned 1
	[0080.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.KEKW", lpFilePart=0x0) returned 0x87
	[0080.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0080.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0080.176] GetFileType (hFile=0x228) returned 0x1
	[0080.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0080.176] GetFileType (hFile=0x228) returned 0x1
	[0080.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", lpFilePart=0x0) returned 0x82
	[0080.181] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat")) returned 1
	[0080.184] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.184] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0080.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0080.188] GetFileType (hFile=0x224) returned 0x1
	[0080.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0080.189] GetFileType (hFile=0x224) returned 0x1
	[0080.189] WriteFile (in: hFile=0x224, lpBuffer=0x269349c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x269349c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0080.192] CloseHandle (hObject=0x224) returned 1
	[0080.193] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ae80e80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="~last~.sharing.xml.obi", cAlternateFileName="~LAST~~1.OBI")) returned 1
	[0080.194] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ae80e80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="~last~.sharing.xml.obi", cAlternateFileName="~LAST~~1.OBI")) returned 0
	[0080.194] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0080.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0080.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0080.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0080.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3d
	[0080.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x3e
	[0080.195] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0080.196] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.196] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1
	[0080.197] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8ae80e80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 1
	[0080.197] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xc32850, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xc32850, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1
	[0080.198] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ae80e80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x8ae80e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="~last~.sharing.xml.obi", cAlternateFileName="~LAST~~1.OBI")) returned 1
	[0080.198] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.199] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0080.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0080.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0080.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0080.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0080.200] GetFileType (hFile=0x220) returned 0x1
	[0080.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0080.200] GetFileType (hFile=0x220) returned 0x1
	[0080.201] WriteFile (in: hFile=0x220, lpBuffer=0x269757c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x269757c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0080.204] CloseHandle (hObject=0x220) returned 1
	[0080.204] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0080.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0080.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x3f
	[0080.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x40
	[0080.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0080.246] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.247] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.247] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0080.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0080.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0080.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0080.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x3f
	[0080.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x40
	[0080.249] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0080.250] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.251] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.251] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0080.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0080.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0080.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0080.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\publisher\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0080.252] GetFileType (hFile=0x220) returned 0x1
	[0080.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0080.253] GetFileType (hFile=0x220) returned 0x1
	[0080.253] WriteFile (in: hFile=0x220, lpBuffer=0x269b0f8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x269b0f8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0080.256] CloseHandle (hObject=0x220) returned 1
	[0080.256] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1
	[0080.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0080.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x49
	[0080.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", lpFilePart=0x0) returned 0x4a
	[0080.257] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0080.272] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.273] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.274] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0080.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0080.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0080.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0080.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x49
	[0080.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", lpFilePart=0x0) returned 0x4a
	[0080.275] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0080.275] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.276] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.276] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0080.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0080.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0080.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0080.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\taskschedulerconfig\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0080.278] GetFileType (hFile=0x220) returned 0x1
	[0080.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0080.278] GetFileType (hFile=0x220) returned 0x1
	[0080.279] WriteFile (in: hFile=0x220, lpBuffer=0x269eee0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x269eee0*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0080.283] CloseHandle (hObject=0x220) returned 1
	[0080.284] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1
	[0080.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0080.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x3b
	[0080.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", lpFilePart=0x0) returned 0x3c
	[0080.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0080.286] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.287] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1
	[0080.288] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 1
	[0080.288] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 0
	[0080.289] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0080.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0080.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0080.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0080.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x3b
	[0080.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", lpFilePart=0x0) returned 0x3c
	[0080.290] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0080.290] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.291] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1
	[0080.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat", lpFilePart=0x0) returned 0x49
	[0080.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0080.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0080.292] GetFileType (hFile=0x224) returned 0x1
	[0080.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0080.293] GetFileType (hFile=0x224) returned 0x1
	[0080.293] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x18ce0
	[0080.294] ReadFile (in: hFile=0x224, lpBuffer=0x36115c8, nNumberOfBytesToRead=0x18ce0, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x36115c8*, lpNumberOfBytesRead=0x26ede4*=0x18ce0, lpOverlapped=0x0) returned 1
	[0080.304] CloseHandle (hObject=0x224) returned 1
	[0080.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat.KEKW", lpFilePart=0x0) returned 0x4e
	[0080.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0080.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0080.305] GetFileType (hFile=0x224) returned 0x1
	[0080.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0080.306] GetFileType (hFile=0x224) returned 0x1
	[0080.306] WriteFile (in: hFile=0x224, lpBuffer=0x26a3200*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26a3200*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0080.309] CloseHandle (hObject=0x224) returned 1
	[0080.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat", lpFilePart=0x0) returned 0x49
	[0080.310] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat")) returned 1
	[0080.316] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 1
	[0080.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat", lpFilePart=0x0) returned 0x46
	[0080.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0080.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0080.317] GetFileType (hFile=0x224) returned 0x1
	[0080.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0080.317] GetFileType (hFile=0x224) returned 0x1
	[0080.317] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x1f400
	[0080.319] ReadFile (in: hFile=0x224, lpBuffer=0x362a2c8, nNumberOfBytesToRead=0x1f400, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x362a2c8*, lpNumberOfBytesRead=0x26ede4*=0x1f400, lpOverlapped=0x0) returned 1
	[0080.330] CloseHandle (hObject=0x224) returned 1
	[0080.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat.KEKW", lpFilePart=0x0) returned 0x4b
	[0080.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0080.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0080.331] GetFileType (hFile=0x224) returned 0x1
	[0080.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0080.332] GetFileType (hFile=0x224) returned 0x1
	[0080.332] WriteFile (in: hFile=0x224, lpBuffer=0x26a5e70*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26a5e70*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0080.335] CloseHandle (hObject=0x224) returned 1
	[0080.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat", lpFilePart=0x0) returned 0x46
	[0080.336] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat")) returned 1
	[0080.342] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.342] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0080.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0080.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0080.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0080.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0080.344] GetFileType (hFile=0x220) returned 0x1
	[0080.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0080.344] GetFileType (hFile=0x220) returned 0x1
	[0080.344] WriteFile (in: hFile=0x220, lpBuffer=0x26a8594*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26a8594*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0080.348] CloseHandle (hObject=0x220) returned 1
	[0080.348] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0080.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0080.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x3d
	[0080.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x3e
	[0080.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0080.350] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.350] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1024", cAlternateFileName="")) returned 1
	[0080.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024", lpFilePart=0x0) returned 0x42
	[0080.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\", lpFilePart=0x0) returned 0x43
	[0080.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.354] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.355] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.355] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024", lpFilePart=0x0) returned 0x42
	[0080.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\", lpFilePart=0x0) returned 0x43
	[0080.357] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.357] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.358] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.358] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0080.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1024\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0080.360] GetFileType (hFile=0x224) returned 0x1
	[0080.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0080.360] GetFileType (hFile=0x224) returned 0x1
	[0080.361] WriteFile (in: hFile=0x224, lpBuffer=0x26acc6c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26acc6c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0080.363] CloseHandle (hObject=0x224) returned 1
	[0080.364] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0080.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033", lpFilePart=0x0) returned 0x42
	[0080.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\", lpFilePart=0x0) returned 0x43
	[0080.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.366] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.367] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x0, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1
	[0080.368] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x0, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0
	[0080.368] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033", lpFilePart=0x0) returned 0x42
	[0080.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\", lpFilePart=0x0) returned 0x43
	[0080.369] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.370] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.371] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x0, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1
	[0080.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin", lpFilePart=0x0) returned 0x5c
	[0080.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0080.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0080.374] GetFileType (hFile=0x228) returned 0x1
	[0080.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0080.374] GetFileType (hFile=0x228) returned 0x1
	[0080.375] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x49098
	[0080.378] ReadFile (in: hFile=0x228, lpBuffer=0x36496e8, nNumberOfBytesToRead=0x49098, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x36496e8*, lpNumberOfBytesRead=0x26ed44*=0x49098, lpOverlapped=0x0) returned 1
	[0080.400] CloseHandle (hObject=0x228) returned 1
	[0080.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.KEKW", lpFilePart=0x0) returned 0x61
	[0080.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0080.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0080.402] GetFileType (hFile=0x228) returned 0x1
	[0080.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0080.402] GetFileType (hFile=0x228) returned 0x1
	[0080.403] WriteFile (in: hFile=0x228, lpBuffer=0x26b11e4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26b11e4*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0080.406] CloseHandle (hObject=0x228) returned 1
	[0080.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin", lpFilePart=0x0) returned 0x5c
	[0080.408] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin")) returned 1
	[0080.419] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.419] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0080.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0080.453] GetFileType (hFile=0x224) returned 0x1
	[0080.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0080.453] GetFileType (hFile=0x224) returned 0x1
	[0080.454] WriteFile (in: hFile=0x224, lpBuffer=0x26b3954*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26b3954*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0080.457] CloseHandle (hObject=0x224) returned 1
	[0080.458] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0080.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x42
	[0080.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\", lpFilePart=0x0) returned 0x43
	[0080.459] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.460] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.461] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0080.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", lpFilePart=0x0) returned 0x47
	[0080.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", lpFilePart=0x0) returned 0x48
	[0080.461] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.462] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.463] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.463] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0080.463] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.464] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", lpFilePart=0x0) returned 0x47
	[0080.464] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", lpFilePart=0x0) returned 0x48
	[0080.465] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.465] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.466] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.466] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.466] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0080.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0080.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0080.471] GetFileType (hFile=0x228) returned 0x1
	[0080.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0080.471] GetFileType (hFile=0x228) returned 0x1
	[0080.472] WriteFile (in: hFile=0x228, lpBuffer=0x26b87a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26b87a4*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0080.475] CloseHandle (hObject=0x228) returned 1
	[0080.476] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn1", cAlternateFileName="")) returned 1
	[0080.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", lpFilePart=0x0) returned 0x48
	[0080.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\", lpFilePart=0x0) returned 0x49
	[0080.476] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.477] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.478] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.478] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0080.479] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", lpFilePart=0x0) returned 0x48
	[0080.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\", lpFilePart=0x0) returned 0x49
	[0080.480] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.481] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.481] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.482] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.482] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0080.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0080.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0080.486] GetFileType (hFile=0x228) returned 0x1
	[0080.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0080.486] GetFileType (hFile=0x228) returned 0x1
	[0080.486] WriteFile (in: hFile=0x228, lpBuffer=0x26bcb10*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26bcb10*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0080.493] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 1
	[0080.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", lpFilePart=0x0) returned 0x48
	[0080.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\", lpFilePart=0x0) returned 0x49
	[0080.494] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.497] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.498] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.499] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0080.499] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", lpFilePart=0x0) returned 0x48
	[0080.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\", lpFilePart=0x0) returned 0x49
	[0080.500] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.501] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.502] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.502] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.502] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0080.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0080.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0080.505] GetFileType (hFile=0x228) returned 0x1
	[0080.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0080.505] GetFileType (hFile=0x228) returned 0x1
	[0080.506] WriteFile (in: hFile=0x228, lpBuffer=0x26c0e7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26c0e7c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0080.509] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.509] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x42
	[0080.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\", lpFilePart=0x0) returned 0x43
	[0080.510] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.511] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.512] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf06270, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf06270, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0080.512] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2c3d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf2c3d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn1", cAlternateFileName="")) returned 1
	[0080.513] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0xf52530, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf52530, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 1
	[0080.513] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0xf52530, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf52530, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 0
	[0080.514] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0080.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0080.518] GetFileType (hFile=0x224) returned 0x1
	[0080.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0080.518] GetFileType (hFile=0x224) returned 0x1
	[0080.519] WriteFile (in: hFile=0x224, lpBuffer=0x26c4378*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26c4378*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0080.525] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1
	[0080.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x44
	[0080.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x45
	[0080.525] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.526] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.527] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1
	[0080.527] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1
	[0080.528] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8deb4c00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1da50, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db", cAlternateFileName="{AFBF9~2.DB")) returned 1
	[0080.528] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8deb4c00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1da50, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db", cAlternateFileName="{AFBF9~2.DB")) returned 0
	[0080.529] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x44
	[0080.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x45
	[0080.532] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.532] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.533] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1
	[0080.533] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1
	[0080.534] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8deb4c00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x8deb4c00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8deb4c00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1da50, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db", cAlternateFileName="{AFBF9~2.DB")) returned 1
	[0080.534] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.535] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0080.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0080.537] GetFileType (hFile=0x224) returned 0x1
	[0080.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0080.538] GetFileType (hFile=0x224) returned 0x1
	[0080.538] WriteFile (in: hFile=0x224, lpBuffer=0x26c9a9c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26c9a9c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0080.541] CloseHandle (hObject=0x224) returned 1
	[0080.542] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1
	[0080.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x46
	[0080.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", lpFilePart=0x0) returned 0x47
	[0080.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.544] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.544] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1
	[0080.545] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb1e958e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1
	[0080.545] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1
	[0080.546] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 1
	[0080.547] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 1
	[0080.547] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1
	[0080.548] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 1
	[0080.548] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 1
	[0080.549] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0
	[0080.550] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x46
	[0080.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", lpFilePart=0x0) returned 0x47
	[0080.551] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.552] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.553] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1
	[0080.553] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb1e958e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1
	[0080.554] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1
	[0080.554] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 1
	[0080.554] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 1
	[0080.555] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1
	[0080.556] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 1
	[0080.556] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 1
	[0080.557] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.557] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0080.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0080.559] GetFileType (hFile=0x224) returned 0x1
	[0080.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0080.559] GetFileType (hFile=0x224) returned 0x1
	[0080.560] WriteFile (in: hFile=0x224, lpBuffer=0x26d0ce0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26d0ce0*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0080.563] CloseHandle (hObject=0x224) returned 1
	[0080.564] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0080.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x4a
	[0080.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x4b
	[0080.565] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.566] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.567] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.568] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x4a
	[0080.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x4b
	[0080.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.569] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.570] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.570] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0080.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\gameexplorer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0080.572] GetFileType (hFile=0x224) returned 0x1
	[0080.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0080.572] GetFileType (hFile=0x224) returned 0x1
	[0080.572] WriteFile (in: hFile=0x224, lpBuffer=0x26d4b14*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26d4b14*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0080.575] CloseHandle (hObject=0x224) returned 1
	[0080.576] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0080.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x45
	[0080.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", lpFilePart=0x0) returned 0x46
	[0080.577] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.577] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.578] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.579] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0a0d1e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0080.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", lpFilePart=0x0) returned 0x51
	[0080.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", lpFilePart=0x0) returned 0x52
	[0080.584] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0a0d1e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.584] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0a0d1e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.585] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.585] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe3e69e70, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0080.586] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe0a0d1e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0a0d1e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012020022120200222", cAlternateFileName="MSHIST~1")) returned 1
	[0080.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222", lpFilePart=0x0) returned 0x6a
	[0080.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\", lpFilePart=0x0) returned 0x6b
	[0080.587] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe0a0d1e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0a0d1e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.588] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe0a0d1e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0a0d1e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.588] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xe0a0d1e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb1912e90, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0080.589] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xe0a0d1e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb1912e90, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0080.589] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222", lpFilePart=0x0) returned 0x6a
	[0080.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\", lpFilePart=0x0) returned 0x6b
	[0080.590] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe0a0d1e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0a0d1e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.591] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe0a0d1e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0a0d1e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.591] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xe0a0d1e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb1912e90, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0080.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat", nBufferLength=0x105, lpBuffer=0x26e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat", lpFilePart=0x0) returned 0x74
	[0080.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb50) returned 1
	[0080.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020022120200222\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0080.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26d988) returned 1
	[0080.596] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.597] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\Decrypt.txt", lpFilePart=0x0) returned 0x76
	[0080.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0080.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020022120200222\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012020022120200222\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0080.598] GetFileType (hFile=0x22c) returned 0x1
	[0080.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0080.598] GetFileType (hFile=0x22c) returned 0x1
	[0080.599] WriteFile (in: hFile=0x22c, lpBuffer=0x26dbf10*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26dbf10*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0080.602] CloseHandle (hObject=0x22c) returned 1
	[0080.603] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.603] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", lpFilePart=0x0) returned 0x51
	[0080.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", lpFilePart=0x0) returned 0x52
	[0080.605] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0a0d1e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.605] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe0a0d1e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0a0d1e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.606] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.606] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe3e69e70, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0080.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", lpFilePart=0x0) returned 0x5b
	[0080.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0080.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0080.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26da28) returned 1
	[0080.611] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe0a0d1e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x1036d70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1036d70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012020022120200222", cAlternateFileName="MSHIST~1")) returned 1
	[0080.612] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe0a0d1e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x1036d70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1036d70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012020022120200222", cAlternateFileName="MSHIST~1")) returned 0
	[0080.612] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0080.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0080.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0080.613] GetFileType (hFile=0x228) returned 0x1
	[0080.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0080.613] GetFileType (hFile=0x228) returned 0x1
	[0080.614] WriteFile (in: hFile=0x228, lpBuffer=0x26e06bc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26e06bc*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0080.617] CloseHandle (hObject=0x228) returned 1
	[0080.617] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0080.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low", lpFilePart=0x0) returned 0x49
	[0080.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", lpFilePart=0x0) returned 0x4a
	[0080.618] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.619] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.619] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.620] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0080.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5", lpFilePart=0x0) returned 0x55
	[0080.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\", lpFilePart=0x0) returned 0x56
	[0080.621] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.624] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.625] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.625] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0080.626] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1
	[0080.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0080.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713", lpFilePart=0x0) returned 0x6e
	[0080.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\", lpFilePart=0x0) returned 0x6f
	[0080.627] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0080.628] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.629] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0080.629] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0080.630] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0080.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0080.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0080.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0080.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713", lpFilePart=0x0) returned 0x6e
	[0080.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\", lpFilePart=0x0) returned 0x6f
	[0080.631] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0080.632] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.633] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0080.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat", lpFilePart=0x0) returned 0x78
	[0080.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0080.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0080.634] GetFileType (hFile=0x234) returned 0x1
	[0080.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0080.635] GetFileType (hFile=0x234) returned 0x1
	[0080.635] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x8000
	[0080.635] ReadFile (in: hFile=0x234, lpBuffer=0x26e5e70, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26e5e70*, lpNumberOfBytesRead=0x26eb64*=0x8000, lpOverlapped=0x0) returned 1
	[0080.640] CloseHandle (hObject=0x234) returned 1
	[0080.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat.KEKW", lpFilePart=0x0) returned 0x7d
	[0080.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0080.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0080.642] GetFileType (hFile=0x234) returned 0x1
	[0080.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0080.642] GetFileType (hFile=0x234) returned 0x1
	[0080.643] WriteFile (in: hFile=0x234, lpBuffer=0x26ef63c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26ef63c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0080.646] CloseHandle (hObject=0x234) returned 1
	[0080.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat", lpFilePart=0x0) returned 0x78
	[0080.647] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat")) returned 1
	[0080.650] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.651] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0080.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0080.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0080.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\Decrypt.txt", lpFilePart=0x0) returned 0x7a
	[0080.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0080.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0080.652] GetFileType (hFile=0x230) returned 0x1
	[0080.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0080.653] GetFileType (hFile=0x230) returned 0x1
	[0080.653] WriteFile (in: hFile=0x230, lpBuffer=0x26f1e94*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x26f1e94*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0080.656] CloseHandle (hObject=0x230) returned 1
	[0080.657] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.657] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5", lpFilePart=0x0) returned 0x55
	[0080.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\", lpFilePart=0x0) returned 0x56
	[0080.658] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.659] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.660] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.660] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0080.660] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat", lpFilePart=0x0) returned 0x5f
	[0080.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb50) returned 1
	[0080.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0080.661] GetFileType (hFile=0x230) returned 0x1
	[0080.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb4c) returned 1
	[0080.661] GetFileType (hFile=0x230) returned 0x1
	[0080.662] GetFileSize (in: hFile=0x230, lpFileSizeHigh=0x26ec58 | out: lpFileSizeHigh=0x26ec58*=0x0) returned 0x8000
	[0080.662] ReadFile (in: hFile=0x230, lpBuffer=0x26f4544, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x26ec04, lpOverlapped=0x0 | out: lpBuffer=0x26f4544*, lpNumberOfBytesRead=0x26ec04*=0x8000, lpOverlapped=0x0) returned 1
	[0080.667] CloseHandle (hObject=0x230) returned 1
	[0080.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat.KEKW", lpFilePart=0x0) returned 0x64
	[0080.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb84) returned 1
	[0080.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0080.668] GetFileType (hFile=0x230) returned 0x1
	[0080.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb80) returned 1
	[0080.668] GetFileType (hFile=0x230) returned 0x1
	[0080.669] WriteFile (in: hFile=0x230, lpBuffer=0x26fdcb0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eba8, lpOverlapped=0x0 | out: lpBuffer=0x26fdcb0*, lpNumberOfBytesWritten=0x26eba8*=0x10, lpOverlapped=0x0) returned 1
	[0080.672] CloseHandle (hObject=0x230) returned 1
	[0080.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat", lpFilePart=0x0) returned 0x5f
	[0080.673] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat")) returned 1
	[0080.676] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x10a9190, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10a9190, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1
	[0080.676] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x10a9190, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10a9190, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 0
	[0080.677] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0080.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0080.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0080.678] GetFileType (hFile=0x22c) returned 0x1
	[0080.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0080.678] GetFileType (hFile=0x22c) returned 0x1
	[0080.679] WriteFile (in: hFile=0x22c, lpBuffer=0x2700718*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2700718*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0080.682] CloseHandle (hObject=0x22c) returned 1
	[0080.682] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.683] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low", lpFilePart=0x0) returned 0x49
	[0080.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", lpFilePart=0x0) returned 0x4a
	[0080.684] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.684] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.685] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.686] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x10f5450, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10f5450, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0080.686] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x10f5450, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10f5450, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0
	[0080.687] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0080.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0080.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0080.689] GetFileType (hFile=0x228) returned 0x1
	[0080.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0080.689] GetFileType (hFile=0x228) returned 0x1
	[0080.689] WriteFile (in: hFile=0x228, lpBuffer=0x2703e90*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2703e90*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0080.692] CloseHandle (hObject=0x228) returned 1
	[0080.693] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.693] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x45
	[0080.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\", lpFilePart=0x0) returned 0x46
	[0080.695] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.695] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.696] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.696] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x105ced0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x105ced0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0080.697] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x111b5b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x111b5b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0080.697] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x111b5b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x111b5b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0080.698] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0080.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.698] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0080.699] GetFileType (hFile=0x224) returned 0x1
	[0080.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0080.699] GetFileType (hFile=0x224) returned 0x1
	[0080.699] WriteFile (in: hFile=0x224, lpBuffer=0x27076b0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27076b0*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0080.704] CloseHandle (hObject=0x224) returned 1
	[0080.704] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1
	[0080.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x47
	[0080.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x48
	[0080.705] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.706] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.707] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.707] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x47
	[0080.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x48
	[0080.708] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.709] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.710] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.710] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0080.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0080.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0080.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0080.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\ringtones\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0080.712] GetFileType (hFile=0x224) returned 0x1
	[0080.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0080.712] GetFileType (hFile=0x224) returned 0x1
	[0080.712] WriteFile (in: hFile=0x224, lpBuffer=0x270b40c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x270b40c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0080.715] CloseHandle (hObject=0x224) returned 1
	[0080.716] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0080.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0080.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x56
	[0080.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x57
	[0080.717] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0080.717] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.718] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0080.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x62
	[0080.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x63
	[0080.719] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.720] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.720] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.721] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe3e69e70, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0080.722] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1
	[0080.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS", lpFilePart=0x0) returned 0x6b
	[0080.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\", lpFilePart=0x0) returned 0x6c
	[0080.723] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.729] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.730] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.730] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0080.731] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS", lpFilePart=0x0) returned 0x6b
	[0080.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\", lpFilePart=0x0) returned 0x6c
	[0080.735] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.739] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.740] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.740] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.740] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\Decrypt.txt", lpFilePart=0x0) returned 0x77
	[0080.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0080.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0080.747] GetFileType (hFile=0x22c) returned 0x1
	[0080.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0080.749] GetFileType (hFile=0x22c) returned 0x1
	[0080.750] WriteFile (in: hFile=0x22c, lpBuffer=0x27122b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x27122b4*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0080.753] CloseHandle (hObject=0x22c) returned 1
	[0080.753] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1
	[0080.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K", lpFilePart=0x0) returned 0x6b
	[0080.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\", lpFilePart=0x0) returned 0x6c
	[0080.754] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.760] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.761] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.762] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0080.762] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K", lpFilePart=0x0) returned 0x6b
	[0080.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\", lpFilePart=0x0) returned 0x6c
	[0080.767] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.769] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.770] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.771] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.771] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\Decrypt.txt", lpFilePart=0x0) returned 0x77
	[0080.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0080.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0080.778] GetFileType (hFile=0x22c) returned 0x1
	[0080.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0080.778] GetFileType (hFile=0x22c) returned 0x1
	[0080.778] WriteFile (in: hFile=0x22c, lpBuffer=0x2717034*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2717034*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0080.782] CloseHandle (hObject=0x22c) returned 1
	[0080.783] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1
	[0080.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C", lpFilePart=0x0) returned 0x6b
	[0080.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\", lpFilePart=0x0) returned 0x6c
	[0080.784] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.800] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.800] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.801] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0080.801] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C", lpFilePart=0x0) returned 0x6b
	[0080.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\", lpFilePart=0x0) returned 0x6c
	[0080.805] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.808] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.808] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.809] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.809] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\Decrypt.txt", lpFilePart=0x0) returned 0x77
	[0080.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0080.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0080.817] GetFileType (hFile=0x22c) returned 0x1
	[0080.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0080.817] GetFileType (hFile=0x22c) returned 0x1
	[0080.818] WriteFile (in: hFile=0x22c, lpBuffer=0x271bdb4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x271bdb4*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0080.824] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 1
	[0080.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109", lpFilePart=0x0) returned 0x6b
	[0080.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\", lpFilePart=0x0) returned 0x6c
	[0080.824] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.831] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.832] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.832] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0080.833] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109", lpFilePart=0x0) returned 0x6b
	[0080.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\", lpFilePart=0x0) returned 0x6c
	[0080.837] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.840] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.840] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.841] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.841] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\Decrypt.txt", lpFilePart=0x0) returned 0x77
	[0080.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0080.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0080.848] GetFileType (hFile=0x22c) returned 0x1
	[0080.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0080.848] GetFileType (hFile=0x22c) returned 0x1
	[0080.849] WriteFile (in: hFile=0x22c, lpBuffer=0x2720b34*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2720b34*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0080.851] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.852] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x62
	[0080.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x63
	[0080.853] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.853] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.854] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.854] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe3e69e70, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0080.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", lpFilePart=0x0) returned 0x6c
	[0080.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0080.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0080.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26da28) returned 1
	[0080.858] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x118d9d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x118d9d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1
	[0080.859] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x11d9c90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11d9c90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1
	[0080.859] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x124c0b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x124c0b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1
	[0080.860] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1298370, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1298370, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 1
	[0080.860] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1298370, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1298370, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 0
	[0080.861] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0080.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0080.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0080.863] GetFileType (hFile=0x228) returned 0x1
	[0080.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0080.863] GetFileType (hFile=0x228) returned 0x1
	[0080.864] WriteFile (in: hFile=0x228, lpBuffer=0x272594c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x272594c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0080.867] CloseHandle (hObject=0x228) returned 1
	[0080.867] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1
	[0080.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", lpFilePart=0x0) returned 0x62
	[0080.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\", lpFilePart=0x0) returned 0x63
	[0080.868] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.871] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.871] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.872] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO", lpFilePart=0x0) returned 0x62
	[0080.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\", lpFilePart=0x0) returned 0x63
	[0080.873] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.873] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.874] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.875] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.875] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0080.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0080.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.mso\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0080.877] GetFileType (hFile=0x228) returned 0x1
	[0080.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0080.877] GetFileType (hFile=0x228) returned 0x1
	[0080.877] WriteFile (in: hFile=0x228, lpBuffer=0x2729cfc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2729cfc*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0080.880] CloseHandle (hObject=0x228) returned 1
	[0080.881] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27b4c650, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1
	[0080.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", lpFilePart=0x0) returned 0x63
	[0080.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\", lpFilePart=0x0) returned 0x64
	[0080.882] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.883] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.884] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.884] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word", lpFilePart=0x0) returned 0x63
	[0080.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\", lpFilePart=0x0) returned 0x64
	[0080.885] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.886] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.887] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0080.887] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0080.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0080.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0080.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\Decrypt.txt", lpFilePart=0x0) returned 0x6f
	[0080.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0080.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.word\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0080.889] GetFileType (hFile=0x228) returned 0x1
	[0080.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0080.890] GetFileType (hFile=0x228) returned 0x1
	[0080.890] WriteFile (in: hFile=0x228, lpBuffer=0x272e0f8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x272e0f8*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0080.893] CloseHandle (hObject=0x228) returned 1
	[0080.894] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0080.894] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0080.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0080.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", lpFilePart=0x0) returned 0x5a
	[0080.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", lpFilePart=0x0) returned 0x5b
	[0080.895] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0080.897] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.897] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1
	[0080.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing", lpFilePart=0x0) returned 0x67
	[0080.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\", lpFilePart=0x0) returned 0x68
	[0080.898] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.899] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.899] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x0, dwReserved1=0x0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 1
	[0080.900] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x0, dwReserved1=0x0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 0
	[0080.900] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing", lpFilePart=0x0) returned 0x67
	[0080.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\", lpFilePart=0x0) returned 0x68
	[0080.901] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.902] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.903] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x0, dwReserved1=0x0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 1
	[0080.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", nBufferLength=0x105, lpBuffer=0x26e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", lpFilePart=0x0) returned 0x90
	[0080.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb50) returned 1
	[0080.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0080.904] GetFileType (hFile=0x230) returned 0x1
	[0080.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb4c) returned 1
	[0080.904] GetFileType (hFile=0x230) returned 0x1
	[0080.904] GetFileSize (in: hFile=0x230, lpFileSizeHigh=0x26ec58 | out: lpFileSizeHigh=0x26ec58*=0x0) returned 0x47f94
	[0080.907] ReadFile (in: hFile=0x230, lpBuffer=0x36927a0, nNumberOfBytesToRead=0x47f94, lpNumberOfBytesRead=0x26ec04, lpOverlapped=0x0 | out: lpBuffer=0x36927a0*, lpNumberOfBytesRead=0x26ec04*=0x47f94, lpOverlapped=0x0) returned 1
	[0080.928] CloseHandle (hObject=0x230) returned 1
	[0080.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.KEKW", lpFilePart=0x0) returned 0x95
	[0080.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb84) returned 1
	[0080.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0080.934] GetFileType (hFile=0x230) returned 0x1
	[0080.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb80) returned 1
	[0080.934] GetFileType (hFile=0x230) returned 0x1
	[0080.935] WriteFile (in: hFile=0x230, lpBuffer=0x273434c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eba8, lpOverlapped=0x0 | out: lpBuffer=0x273434c*, lpNumberOfBytesWritten=0x26eba8*=0x10, lpOverlapped=0x0) returned 1
	[0080.938] CloseHandle (hObject=0x230) returned 1
	[0080.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", nBufferLength=0x105, lpBuffer=0x26e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", lpFilePart=0x0) returned 0x90
	[0080.939] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat")) returned 1
	[0080.949] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0080.949] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0080.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0080.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0080.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\Decrypt.txt", lpFilePart=0x0) returned 0x73
	[0080.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0080.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0080.951] GetFileType (hFile=0x22c) returned 0x1
	[0080.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0080.952] GetFileType (hFile=0x22c) returned 0x1
	[0080.952] WriteFile (in: hFile=0x22c, lpBuffer=0x2736bb4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2736bb4*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0080.955] CloseHandle (hObject=0x22c) returned 1
	[0080.956] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0080.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0080.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5", lpFilePart=0x0) returned 0x66
	[0080.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\", lpFilePart=0x0) returned 0x67
	[0080.957] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0080.959] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.960] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9QH4S0GZ", cAlternateFileName="")) returned 1
	[0080.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0080.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ", lpFilePart=0x0) returned 0x6f
	[0080.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\", lpFilePart=0x0) returned 0x70
	[0080.961] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0080.969] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0080.973] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdbb73b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdbb73b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdc03670, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x39d41, dwReserved0=0x0, dwReserved1=0x0, cFileName="28-8f3193-f30905ea[1]", cAlternateFileName="28-8F3~1")) returned 1
	[0080.973] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5529b670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x0, dwReserved1=0x0, cFileName="528d82a2[1].js", cAlternateFileName="528D82~1.JS")) returned 1
	[0080.974] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA3e3XC[2].png", cAlternateFileName="AA3E3X~2.PNG")) returned 1
	[0080.975] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA3vOVA[1].png", cAlternateFileName="AA3VOV~1.PNG")) returned 1
	[0080.975] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA42EP9[1].png", cAlternateFileName="AA42EP~1.PNG")) returned 1
	[0080.976] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA54rQj[1].png", cAlternateFileName="AA54RQ~1.PNG")) returned 1
	[0080.976] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA61yi9[1].png", cAlternateFileName="AA61YI~1.PNG")) returned 1
	[0080.977] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA8uCo4[1].png", cAlternateFileName="AA8UCO~1.PNG")) returned 1
	[0080.978] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAdAVrM[1].png", cAlternateFileName="AADAVR~1.PNG")) returned 1
	[0080.978] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4697f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4697f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4b5ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="adServer[1].htm", cAlternateFileName="ADSERV~1.HTM")) returned 1
	[0080.979] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="advertisement.ad[1].js", cAlternateFileName="ADVERT~1.JS")) returned 1
	[0080.979] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x545d0030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545d0030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x545d0030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x0, dwReserved1=0x0, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1
	[0080.980] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x534, dwReserved0=0x0, dwReserved1=0x0, cFileName="async_usersync[2]", cAlternateFileName="ASYNC_~2")) returned 1
	[0080.980] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="async_usersync[3]", cAlternateFileName="ASYNC_~3")) returned 1
	[0080.981] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB1CcOi[1].png", cAlternateFileName="BB1CCO~1.PNG")) returned 1
	[0080.982] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB46JmN[1].png", cAlternateFileName="BB46JM~1.PNG")) returned 1
	[0080.982] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB5kJAC[1].png", cAlternateFileName="BB5KJA~1.PNG")) returned 1
	[0080.983] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB5kTiV[1].png", cAlternateFileName="BB5KTI~1.PNG")) returned 1
	[0080.984] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB6Ma4a[1].png", cAlternateFileName="BB6MA4~1.PNG")) returned 1
	[0080.984] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB74fLs[1].png", cAlternateFileName="BB74FL~1.PNG")) returned 1
	[0080.985] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBIqq8[1].jpg", cAlternateFileName="BBBIQQ~1.JPG")) returned 1
	[0080.985] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBL0ij[1].jpg", cAlternateFileName="BBBL0I~1.JPG")) returned 1
	[0080.986] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53630fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53630fd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBLhZX[1].jpg", cAlternateFileName="BBBLHZ~1.JPG")) returned 1
	[0080.986] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53467f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBNiEo[1].jpg", cAlternateFileName="BBBNIE~1.JPG")) returned 1
	[0080.987] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b65ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b65ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 1
	[0080.988] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d18e120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6d18e120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6d1b4280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO3tl[1].jpg", cAlternateFileName="BBBO3T~1.JPG")) returned 1
	[0080.988] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO8dQ[1].jpg", cAlternateFileName="BBBO8D~1.JPG")) returned 1
	[0080.989] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOe7C[1].jpg", cAlternateFileName="BBBOE7~1.JPG")) returned 1
	[0080.989] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPThN[1].jpg", cAlternateFileName="BBBPTH~1.JPG")) returned 1
	[0080.990] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPUFJ[1].jpg", cAlternateFileName="BBBPUF~1.JPG")) returned 1
	[0080.990] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBQxzx[1].jpg", cAlternateFileName="BBBQXZ~1.JPG")) returned 1
	[0080.991] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBseMP[1].jpg", cAlternateFileName="BBBSEM~1.JPG")) returned 1
	[0080.996] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53af3bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53af3bd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53af3bd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBsqNL[1].jpg", cAlternateFileName="BBBSQN~1.JPG")) returned 1
	[0080.996] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBTpvW[1].jpg", cAlternateFileName="BBBTPV~1.JPG")) returned 1
	[0080.997] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 1
	[0080.998] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVGsM[1].jpg", cAlternateFileName="BBBVGS~1.JPG")) returned 1
	[0080.998] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVIzI[1].jpg", cAlternateFileName="BBBVIZ~1.JPG")) returned 1
	[0080.999] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVJ4r[1].jpg", cAlternateFileName="BBBVJ4~1.JPG")) returned 1
	[0080.999] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5160e6d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5160e6d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5160e6d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVxM8[1].jpg", cAlternateFileName="BBBVXM~1.JPG")) returned 1
	[0081.000] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538de890, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538de890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538de890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBz9wz[1].jpg", cAlternateFileName="BBBZ9W~1.JPG")) returned 1
	[0081.001] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBzxW1[1].jpg", cAlternateFileName="BBBZXW~1.JPG")) returned 1
	[0081.002] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6125cc20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6125cc20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 1
	[0081.002] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC095c[1].jpg", cAlternateFileName="BBC095~1.JPG")) returned 1
	[0081.003] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 1
	[0081.003] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0lYn[1].jpg", cAlternateFileName="BBC0LY~1.JPG")) returned 1
	[0081.004] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0mlu[1].jpg", cAlternateFileName="BBC0ML~1.JPG")) returned 1
	[0081.005] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0rDa[1].jpg", cAlternateFileName="BBC0RD~1.JPG")) returned 1
	[0081.005] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0rDa[2].jpg", cAlternateFileName="BBC0RD~2.JPG")) returned 1
	[0081.006] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 1
	[0081.007] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDK7Yy[1].jpg", cAlternateFileName="BBDK7Y~1.JPG")) returned 1
	[0081.007] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDRbsH[1].jpg", cAlternateFileName="BBDRBS~1.JPG")) returned 1
	[0081.008] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDZoZR[1].jpg", cAlternateFileName="BBDZOZ~1.JPG")) returned 1
	[0081.008] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE97O8[1].jpg", cAlternateFileName="BBE97O~1.JPG")) returned 1
	[0081.009] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE9wSt[1].jpg", cAlternateFileName="BBE9WS~1.JPG")) returned 1
	[0081.009] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEcHle[1].jpg", cAlternateFileName="BBECHL~1.JPG")) returned 1
	[0081.010] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdE0f[1].jpg", cAlternateFileName="BBEDE0~1.JPG")) returned 1
	[0081.011] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdoQv[1].jpg", cAlternateFileName="BBEDOQ~1.JPG")) returned 1
	[0081.011] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdqEy[1].jpg", cAlternateFileName="BBEDQE~1.JPG")) returned 1
	[0081.012] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdtWw[1].jpg", cAlternateFileName="BBEDTW~1.JPG")) returned 1
	[0081.012] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdXJj[1].jpg", cAlternateFileName="BBEDXJ~1.JPG")) returned 1
	[0081.013] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeP0k[1].jpg", cAlternateFileName="BBEEP0~1.JPG")) returned 1
	[0081.014] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3417, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 1
	[0081.015] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xc0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfE6e[1].jpg", cAlternateFileName="BBEFE6~1.JPG")) returned 1
	[0081.015] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 1
	[0081.018] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEg9QV[1].jpg", cAlternateFileName="BBEG9Q~1.JPG")) returned 1
	[0081.019] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgGSl[1].jpg", cAlternateFileName="BBEGGS~1.JPG")) returned 1
	[0081.020] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgiYw[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 1
	[0081.020] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a59, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 1
	[0081.021] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgqtY[1].jpg", cAlternateFileName="BBEGQT~1.JPG")) returned 1
	[0081.022] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x44ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 1
	[0081.022] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x171b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgtcS[1].jpg", cAlternateFileName="BBEGTC~1.JPG")) returned 1
	[0081.023] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgtcS[2].jpg", cAlternateFileName="BBEGTC~2.JPG")) returned 1
	[0081.023] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgx5f[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 1
	[0081.024] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgx5f[2].jpg", cAlternateFileName="BBEGX5~2.JPG")) returned 1
	[0081.025] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgyIm[1].jpg", cAlternateFileName="BBEGYI~1.JPG")) returned 1
	[0081.025] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBg3ODX[2].png", cAlternateFileName="BBG3OD~2.PNG")) returned 1
	[0081.026] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBiyCq[1].png", cAlternateFileName="BBIYCQ~1.PNG")) returned 1
	[0081.026] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBn4lUU[1].png", cAlternateFileName="BBN4LU~1.PNG")) returned 1
	[0081.027] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBnMKeN[1].png", cAlternateFileName="BBNMKE~1.PNG")) returned 1
	[0081.028] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x38b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBwGan9[1].jpg", cAlternateFileName="BBWGAN~1.JPG")) returned 1
	[0081.028] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBz3ebk[1].png", cAlternateFileName="BBZ3EB~1.PNG")) returned 1
	[0081.029] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d4dd60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d4dd60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="benefits-5-mobile[1].png", cAlternateFileName="BENEFI~1.PNG")) returned 1
	[0081.030] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61804060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61804060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61850320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1
	[0081.030] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ea49c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ea49c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60ef0c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome-new[1].jpg", cAlternateFileName="CHROME~1.JPG")) returned 1
	[0081.031] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60b128c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4739, dwReserved0=0x0, dwReserved1=0x0, cFileName="cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot", cAlternateFileName="CJZKEO~1.EOT")) returned 1
	[0081.032] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bb22b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1
	[0081.033] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe6dfad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe6dfad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe6dfad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContainerTag[2].js", cAlternateFileName="CONTAI~2.JS")) returned 1
	[0081.033] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ddbc1a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ddbc1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ddbc1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="css[2].txt", cAlternateFileName="CSS_2_~1.TXT")) returned 1
	[0081.034] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0081.034] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5114bad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5114bad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x511bdef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39a21, dwReserved0=0x0, dwReserved1=0x0, cFileName="f8-028d9f-f30905ea[1]", cAlternateFileName="F8-028~1")) returned 1
	[0081.035] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf893e70, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf893e70, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf893e70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="fallback_728x90[1].jpg", cAlternateFileName="FALLBA~1.JPG")) returned 1
	[0081.036] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1
	[0081.036] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde189b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde189b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde189b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1
	[0081.037] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x551dcf90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie8[1].txt", cAlternateFileName="IE8_1_~1.TXT")) returned 1
	[0081.038] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bff750, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bff750, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bff750, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1
	[0081.038] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x88e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1
	[0081.039] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1180, dwReserved0=0x0, dwReserved1=0x0, cFileName="meversion[1]", cAlternateFileName="MEVERS~1")) returned 1
	[0081.039] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfaa91b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfaa91b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfaa91b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1
	[0081.040] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56ed3860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56ed3860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x56ed3860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="Passport[1].htm", cAlternateFileName="PASSPO~1.HTM")) returned 1
	[0081.040] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9f32, dwReserved0=0x0, dwReserved1=0x0, cFileName="plusone[1].js", cAlternateFileName="PLUSON~1.JS")) returned 1
	[0081.040] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6371bfc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6371bfc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6371bfc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="postmessageRelay[1].htm", cAlternateFileName="POSTME~1.HTM")) returned 1
	[0081.041] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555ac120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555ac120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55a97d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="search[1].htm", cAlternateFileName="SEARCH~1.HTM")) returned 1
	[0081.041] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c85b, dwReserved0=0x0, dwReserved1=0x0, cFileName="uhf-west-european-default.min[1].css", cAlternateFileName="UHF-WE~1.CSS")) returned 1
	[0081.042] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 1
	[0081.043] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 0
	[0081.043] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0081.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0081.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0081.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0081.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ", lpFilePart=0x0) returned 0x6f
	[0081.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\", lpFilePart=0x0) returned 0x70
	[0081.047] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0081.050] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0081.051] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdbb73b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdbb73b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdc03670, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x39d41, dwReserved0=0x0, dwReserved1=0x0, cFileName="28-8f3193-f30905ea[1]", cAlternateFileName="28-8F3~1")) returned 1
	[0081.052] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5529b670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x0, dwReserved1=0x0, cFileName="528d82a2[1].js", cAlternateFileName="528D82~1.JS")) returned 1
	[0081.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js", lpFilePart=0x0) returned 0x7e
	[0081.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.055] GetFileType (hFile=0x234) returned 0x1
	[0081.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.055] GetFileType (hFile=0x234) returned 0x1
	[0081.055] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2ecb
	[0081.055] ReadFile (in: hFile=0x234, lpBuffer=0x274c56c, nNumberOfBytesToRead=0x2ecb, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x274c56c*, lpNumberOfBytesRead=0x26eb64*=0x2ecb, lpOverlapped=0x0) returned 1
	[0081.060] CloseHandle (hObject=0x234) returned 1
	[0081.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js.KEKW", lpFilePart=0x0) returned 0x83
	[0081.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.061] GetFileType (hFile=0x234) returned 0x1
	[0081.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.062] GetFileType (hFile=0x234) returned 0x1
	[0081.062] WriteFile (in: hFile=0x234, lpBuffer=0x2750c24*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2750c24*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.065] CloseHandle (hObject=0x234) returned 1
	[0081.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js", lpFilePart=0x0) returned 0x7e
	[0081.066] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js")) returned 1
	[0081.069] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA3e3XC[2].png", cAlternateFileName="AA3E3X~2.PNG")) returned 1
	[0081.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png", lpFilePart=0x0) returned 0x7e
	[0081.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.072] GetFileType (hFile=0x234) returned 0x1
	[0081.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.072] GetFileType (hFile=0x234) returned 0x1
	[0081.072] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x135
	[0081.072] ReadFile (in: hFile=0x234, lpBuffer=0x2752634, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2752634*, lpNumberOfBytesRead=0x26eb64*=0x135, lpOverlapped=0x0) returned 1
	[0081.077] CloseHandle (hObject=0x234) returned 1
	[0081.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.078] GetFileType (hFile=0x234) returned 0x1
	[0081.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.079] GetFileType (hFile=0x234) returned 0x1
	[0081.079] WriteFile (in: hFile=0x234, lpBuffer=0x2754e20*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2754e20*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png", lpFilePart=0x0) returned 0x7e
	[0081.086] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png")) returned 1
	[0081.089] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA3vOVA[1].png", cAlternateFileName="AA3VOV~1.PNG")) returned 1
	[0081.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png", lpFilePart=0x0) returned 0x7e
	[0081.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.092] GetFileType (hFile=0x234) returned 0x1
	[0081.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.092] GetFileType (hFile=0x234) returned 0x1
	[0081.092] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x28e
	[0081.092] ReadFile (in: hFile=0x234, lpBuffer=0x2756988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2756988*, lpNumberOfBytesRead=0x26eb64*=0x28e, lpOverlapped=0x0) returned 1
	[0081.101] CloseHandle (hObject=0x234) returned 1
	[0081.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.102] GetFileType (hFile=0x234) returned 0x1
	[0081.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.102] GetFileType (hFile=0x234) returned 0x1
	[0081.103] WriteFile (in: hFile=0x234, lpBuffer=0x2759174*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2759174*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png", lpFilePart=0x0) returned 0x7e
	[0081.106] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png")) returned 1
	[0081.110] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA42EP9[1].png", cAlternateFileName="AA42EP~1.PNG")) returned 1
	[0081.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png", lpFilePart=0x0) returned 0x7e
	[0081.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.111] GetFileType (hFile=0x234) returned 0x1
	[0081.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.111] GetFileType (hFile=0x234) returned 0x1
	[0081.111] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1cd
	[0081.111] ReadFile (in: hFile=0x234, lpBuffer=0x275ac1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x275ac1c*, lpNumberOfBytesRead=0x26eb64*=0x1cd, lpOverlapped=0x0) returned 1
	[0081.116] CloseHandle (hObject=0x234) returned 1
	[0081.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.117] GetFileType (hFile=0x234) returned 0x1
	[0081.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.117] GetFileType (hFile=0x234) returned 0x1
	[0081.117] WriteFile (in: hFile=0x234, lpBuffer=0x275d408*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x275d408*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png", lpFilePart=0x0) returned 0x7e
	[0081.121] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png")) returned 1
	[0081.124] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA54rQj[1].png", cAlternateFileName="AA54RQ~1.PNG")) returned 1
	[0081.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png", lpFilePart=0x0) returned 0x7e
	[0081.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.125] GetFileType (hFile=0x234) returned 0x1
	[0081.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.125] GetFileType (hFile=0x234) returned 0x1
	[0081.125] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x191
	[0081.126] ReadFile (in: hFile=0x234, lpBuffer=0x275ee74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x275ee74*, lpNumberOfBytesRead=0x26eb64*=0x191, lpOverlapped=0x0) returned 1
	[0081.130] CloseHandle (hObject=0x234) returned 1
	[0081.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.132] GetFileType (hFile=0x234) returned 0x1
	[0081.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.132] GetFileType (hFile=0x234) returned 0x1
	[0081.132] WriteFile (in: hFile=0x234, lpBuffer=0x2761660*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2761660*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png", lpFilePart=0x0) returned 0x7e
	[0081.136] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png")) returned 1
	[0081.139] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA61yi9[1].png", cAlternateFileName="AA61YI~1.PNG")) returned 1
	[0081.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png", lpFilePart=0x0) returned 0x7e
	[0081.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.142] GetFileType (hFile=0x234) returned 0x1
	[0081.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.142] GetFileType (hFile=0x234) returned 0x1
	[0081.142] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x19d
	[0081.142] ReadFile (in: hFile=0x234, lpBuffer=0x27630d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27630d8*, lpNumberOfBytesRead=0x26eb64*=0x19d, lpOverlapped=0x0) returned 1
	[0081.147] CloseHandle (hObject=0x234) returned 1
	[0081.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.148] GetFileType (hFile=0x234) returned 0x1
	[0081.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.148] GetFileType (hFile=0x234) returned 0x1
	[0081.149] WriteFile (in: hFile=0x234, lpBuffer=0x27658c4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27658c4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png", lpFilePart=0x0) returned 0x7e
	[0081.152] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png")) returned 1
	[0081.155] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA8uCo4[1].png", cAlternateFileName="AA8UCO~1.PNG")) returned 1
	[0081.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png", lpFilePart=0x0) returned 0x7e
	[0081.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.156] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.158] GetFileType (hFile=0x234) returned 0x1
	[0081.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.158] GetFileType (hFile=0x234) returned 0x1
	[0081.159] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2c8
	[0081.159] ReadFile (in: hFile=0x234, lpBuffer=0x2767464, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2767464*, lpNumberOfBytesRead=0x26eb64*=0x2c8, lpOverlapped=0x0) returned 1
	[0081.167] CloseHandle (hObject=0x234) returned 1
	[0081.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.169] GetFileType (hFile=0x234) returned 0x1
	[0081.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.169] GetFileType (hFile=0x234) returned 0x1
	[0081.170] WriteFile (in: hFile=0x234, lpBuffer=0x2769c50*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2769c50*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png", lpFilePart=0x0) returned 0x7e
	[0081.173] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png")) returned 1
	[0081.176] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAdAVrM[1].png", cAlternateFileName="AADAVR~1.PNG")) returned 1
	[0081.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png", lpFilePart=0x0) returned 0x7e
	[0081.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.179] GetFileType (hFile=0x234) returned 0x1
	[0081.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.179] GetFileType (hFile=0x234) returned 0x1
	[0081.179] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x342
	[0081.179] ReadFile (in: hFile=0x234, lpBuffer=0x276b86c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x276b86c*, lpNumberOfBytesRead=0x26eb64*=0x342, lpOverlapped=0x0) returned 1
	[0081.184] CloseHandle (hObject=0x234) returned 1
	[0081.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.186] GetFileType (hFile=0x234) returned 0x1
	[0081.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.186] GetFileType (hFile=0x234) returned 0x1
	[0081.186] WriteFile (in: hFile=0x234, lpBuffer=0x276e058*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x276e058*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png", lpFilePart=0x0) returned 0x7e
	[0081.189] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png")) returned 1
	[0081.192] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4697f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4697f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4b5ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="adServer[1].htm", cAlternateFileName="ADSERV~1.HTM")) returned 1
	[0081.193] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="advertisement.ad[1].js", cAlternateFileName="ADVERT~1.JS")) returned 1
	[0081.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js", lpFilePart=0x0) returned 0x86
	[0081.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.196] GetFileType (hFile=0x234) returned 0x1
	[0081.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.196] GetFileType (hFile=0x234) returned 0x1
	[0081.196] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1c
	[0081.196] ReadFile (in: hFile=0x234, lpBuffer=0x2770004, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2770004*, lpNumberOfBytesRead=0x26eb64*=0x1c, lpOverlapped=0x0) returned 1
	[0081.201] CloseHandle (hObject=0x234) returned 1
	[0081.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js.KEKW", lpFilePart=0x0) returned 0x8b
	[0081.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.203] GetFileType (hFile=0x234) returned 0x1
	[0081.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.203] GetFileType (hFile=0x234) returned 0x1
	[0081.204] WriteFile (in: hFile=0x234, lpBuffer=0x2772820*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2772820*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.207] CloseHandle (hObject=0x234) returned 1
	[0081.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js", lpFilePart=0x0) returned 0x86
	[0081.208] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js")) returned 1
	[0081.211] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x545d0030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545d0030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x545d0030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x0, dwReserved1=0x0, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1
	[0081.211] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x534, dwReserved0=0x0, dwReserved1=0x0, cFileName="async_usersync[2]", cAlternateFileName="ASYNC_~2")) returned 1
	[0081.212] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="async_usersync[3]", cAlternateFileName="ASYNC_~3")) returned 1
	[0081.212] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB1CcOi[1].png", cAlternateFileName="BB1CCO~1.PNG")) returned 1
	[0081.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png", lpFilePart=0x0) returned 0x7e
	[0081.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.214] GetFileType (hFile=0x234) returned 0x1
	[0081.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.214] GetFileType (hFile=0x234) returned 0x1
	[0081.214] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1d0
	[0081.214] ReadFile (in: hFile=0x234, lpBuffer=0x27755f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27755f8*, lpNumberOfBytesRead=0x26eb64*=0x1d0, lpOverlapped=0x0) returned 1
	[0081.219] CloseHandle (hObject=0x234) returned 1
	[0081.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.220] GetFileType (hFile=0x234) returned 0x1
	[0081.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.220] GetFileType (hFile=0x234) returned 0x1
	[0081.221] WriteFile (in: hFile=0x234, lpBuffer=0x2777de4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2777de4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.224] CloseHandle (hObject=0x234) returned 1
	[0081.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png", lpFilePart=0x0) returned 0x7e
	[0081.225] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png")) returned 1
	[0081.239] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB46JmN[1].png", cAlternateFileName="BB46JM~1.PNG")) returned 1
	[0081.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png", lpFilePart=0x0) returned 0x7e
	[0081.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.243] GetFileType (hFile=0x234) returned 0x1
	[0081.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.243] GetFileType (hFile=0x234) returned 0x1
	[0081.243] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x310
	[0081.244] ReadFile (in: hFile=0x234, lpBuffer=0x27799cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27799cc*, lpNumberOfBytesRead=0x26eb64*=0x310, lpOverlapped=0x0) returned 1
	[0081.249] CloseHandle (hObject=0x234) returned 1
	[0081.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.250] GetFileType (hFile=0x234) returned 0x1
	[0081.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.251] GetFileType (hFile=0x234) returned 0x1
	[0081.251] WriteFile (in: hFile=0x234, lpBuffer=0x277c1b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x277c1b8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.254] CloseHandle (hObject=0x234) returned 1
	[0081.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png", lpFilePart=0x0) returned 0x7e
	[0081.255] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png")) returned 1
	[0081.258] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB5kJAC[1].png", cAlternateFileName="BB5KJA~1.PNG")) returned 1
	[0081.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png", lpFilePart=0x0) returned 0x7e
	[0081.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.261] GetFileType (hFile=0x234) returned 0x1
	[0081.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.261] GetFileType (hFile=0x234) returned 0x1
	[0081.261] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x120
	[0081.261] ReadFile (in: hFile=0x234, lpBuffer=0x277dbb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x277dbb0*, lpNumberOfBytesRead=0x26eb64*=0x120, lpOverlapped=0x0) returned 1
	[0081.266] CloseHandle (hObject=0x234) returned 1
	[0081.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.267] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.268] GetFileType (hFile=0x234) returned 0x1
	[0081.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.268] GetFileType (hFile=0x234) returned 0x1
	[0081.268] WriteFile (in: hFile=0x234, lpBuffer=0x278039c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x278039c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.272] CloseHandle (hObject=0x234) returned 1
	[0081.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png", lpFilePart=0x0) returned 0x7e
	[0081.273] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png")) returned 1
	[0081.276] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB5kTiV[1].png", cAlternateFileName="BB5KTI~1.PNG")) returned 1
	[0081.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png", lpFilePart=0x0) returned 0x7e
	[0081.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.279] GetFileType (hFile=0x234) returned 0x1
	[0081.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.280] GetFileType (hFile=0x234) returned 0x1
	[0081.280] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x121
	[0081.280] ReadFile (in: hFile=0x234, lpBuffer=0x2781d98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2781d98*, lpNumberOfBytesRead=0x26eb64*=0x121, lpOverlapped=0x0) returned 1
	[0081.285] CloseHandle (hObject=0x234) returned 1
	[0081.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.287] GetFileType (hFile=0x234) returned 0x1
	[0081.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.287] GetFileType (hFile=0x234) returned 0x1
	[0081.287] WriteFile (in: hFile=0x234, lpBuffer=0x2784584*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2784584*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.290] CloseHandle (hObject=0x234) returned 1
	[0081.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png", lpFilePart=0x0) returned 0x7e
	[0081.291] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png")) returned 1
	[0081.294] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB6Ma4a[1].png", cAlternateFileName="BB6MA4~1.PNG")) returned 1
	[0081.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png", lpFilePart=0x0) returned 0x7e
	[0081.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.295] GetFileType (hFile=0x234) returned 0x1
	[0081.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.295] GetFileType (hFile=0x234) returned 0x1
	[0081.296] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x18c
	[0081.296] ReadFile (in: hFile=0x234, lpBuffer=0x2785fe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2785fe8*, lpNumberOfBytesRead=0x26eb64*=0x18c, lpOverlapped=0x0) returned 1
	[0081.305] CloseHandle (hObject=0x234) returned 1
	[0081.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.306] GetFileType (hFile=0x234) returned 0x1
	[0081.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.306] GetFileType (hFile=0x234) returned 0x1
	[0081.307] WriteFile (in: hFile=0x234, lpBuffer=0x27887d4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27887d4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.311] CloseHandle (hObject=0x234) returned 1
	[0081.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png", lpFilePart=0x0) returned 0x7e
	[0081.311] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png")) returned 1
	[0081.315] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB74fLs[1].png", cAlternateFileName="BB74FL~1.PNG")) returned 1
	[0081.315] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png", lpFilePart=0x0) returned 0x7e
	[0081.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.316] GetFileType (hFile=0x234) returned 0x1
	[0081.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.316] GetFileType (hFile=0x234) returned 0x1
	[0081.316] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x168
	[0081.316] ReadFile (in: hFile=0x234, lpBuffer=0x278a214, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x278a214*, lpNumberOfBytesRead=0x26eb64*=0x168, lpOverlapped=0x0) returned 1
	[0081.320] CloseHandle (hObject=0x234) returned 1
	[0081.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0081.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.321] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.322] GetFileType (hFile=0x234) returned 0x1
	[0081.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.322] GetFileType (hFile=0x234) returned 0x1
	[0081.322] WriteFile (in: hFile=0x234, lpBuffer=0x278ca00*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x278ca00*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.326] CloseHandle (hObject=0x234) returned 1
	[0081.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png", lpFilePart=0x0) returned 0x7e
	[0081.327] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png")) returned 1
	[0081.330] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBIqq8[1].jpg", cAlternateFileName="BBBIQQ~1.JPG")) returned 1
	[0081.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.333] GetFileType (hFile=0x234) returned 0x1
	[0081.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.333] GetFileType (hFile=0x234) returned 0x1
	[0081.333] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x333f
	[0081.334] ReadFile (in: hFile=0x234, lpBuffer=0x278e2cc, nNumberOfBytesToRead=0x333f, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x278e2cc*, lpNumberOfBytesRead=0x26eb64*=0x333f, lpOverlapped=0x0) returned 1
	[0081.338] CloseHandle (hObject=0x234) returned 1
	[0081.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.339] GetFileType (hFile=0x234) returned 0x1
	[0081.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.340] GetFileType (hFile=0x234) returned 0x1
	[0081.340] WriteFile (in: hFile=0x234, lpBuffer=0x2792df8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2792df8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.343] CloseHandle (hObject=0x234) returned 1
	[0081.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.344] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg")) returned 1
	[0081.348] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBL0ij[1].jpg", cAlternateFileName="BBBL0I~1.JPG")) returned 1
	[0081.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.350] GetFileType (hFile=0x234) returned 0x1
	[0081.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.350] GetFileType (hFile=0x234) returned 0x1
	[0081.350] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x90b
	[0081.351] ReadFile (in: hFile=0x234, lpBuffer=0x2794fdc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2794fdc*, lpNumberOfBytesRead=0x26eb64*=0x90b, lpOverlapped=0x0) returned 1
	[0081.355] CloseHandle (hObject=0x234) returned 1
	[0081.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.357] GetFileType (hFile=0x234) returned 0x1
	[0081.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.357] GetFileType (hFile=0x234) returned 0x1
	[0081.358] WriteFile (in: hFile=0x234, lpBuffer=0x27977c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27977c8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.361] CloseHandle (hObject=0x234) returned 1
	[0081.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.362] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg")) returned 1
	[0081.365] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53630fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53630fd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBLhZX[1].jpg", cAlternateFileName="BBBLHZ~1.JPG")) returned 1
	[0081.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.368] GetFileType (hFile=0x234) returned 0x1
	[0081.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.368] GetFileType (hFile=0x234) returned 0x1
	[0081.368] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x994
	[0081.368] ReadFile (in: hFile=0x234, lpBuffer=0x2799a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2799a34*, lpNumberOfBytesRead=0x26eb64*=0x994, lpOverlapped=0x0) returned 1
	[0081.373] CloseHandle (hObject=0x234) returned 1
	[0081.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.374] GetFileType (hFile=0x234) returned 0x1
	[0081.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.374] GetFileType (hFile=0x234) returned 0x1
	[0081.374] WriteFile (in: hFile=0x234, lpBuffer=0x279c220*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x279c220*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.377] CloseHandle (hObject=0x234) returned 1
	[0081.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.378] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg")) returned 1
	[0081.381] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53467f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBNiEo[1].jpg", cAlternateFileName="BBBNIE~1.JPG")) returned 1
	[0081.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.383] GetFileType (hFile=0x234) returned 0x1
	[0081.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.383] GetFileType (hFile=0x234) returned 0x1
	[0081.383] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x28b9
	[0081.383] ReadFile (in: hFile=0x234, lpBuffer=0x279daec, nNumberOfBytesToRead=0x28b9, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x279daec*, lpNumberOfBytesRead=0x26eb64*=0x28b9, lpOverlapped=0x0) returned 1
	[0081.388] CloseHandle (hObject=0x234) returned 1
	[0081.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.390] GetFileType (hFile=0x234) returned 0x1
	[0081.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.390] GetFileType (hFile=0x234) returned 0x1
	[0081.391] WriteFile (in: hFile=0x234, lpBuffer=0x27a1b94*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27a1b94*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.394] CloseHandle (hObject=0x234) returned 1
	[0081.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.394] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg")) returned 1
	[0081.398] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b65ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b65ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 1
	[0081.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.400] GetFileType (hFile=0x234) returned 0x1
	[0081.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.400] GetFileType (hFile=0x234) returned 0x1
	[0081.401] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x176d
	[0081.401] ReadFile (in: hFile=0x234, lpBuffer=0x27a3460, nNumberOfBytesToRead=0x176d, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27a3460*, lpNumberOfBytesRead=0x26eb64*=0x176d, lpOverlapped=0x0) returned 1
	[0081.406] CloseHandle (hObject=0x234) returned 1
	[0081.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.407] GetFileType (hFile=0x234) returned 0x1
	[0081.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.407] GetFileType (hFile=0x234) returned 0x1
	[0081.408] WriteFile (in: hFile=0x234, lpBuffer=0x27a63bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27a63bc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.411] CloseHandle (hObject=0x234) returned 1
	[0081.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.411] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg")) returned 1
	[0081.414] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d18e120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6d18e120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6d1b4280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO3tl[1].jpg", cAlternateFileName="BBBO3T~1.JPG")) returned 1
	[0081.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.415] GetFileType (hFile=0x234) returned 0x1
	[0081.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.416] GetFileType (hFile=0x234) returned 0x1
	[0081.416] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x6218
	[0081.416] ReadFile (in: hFile=0x234, lpBuffer=0x27a7c88, nNumberOfBytesToRead=0x6218, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27a7c88*, lpNumberOfBytesRead=0x26eb64*=0x6218, lpOverlapped=0x0) returned 1
	[0081.442] CloseHandle (hObject=0x234) returned 1
	[0081.442] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.443] GetFileType (hFile=0x234) returned 0x1
	[0081.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.443] GetFileType (hFile=0x234) returned 0x1
	[0081.444] WriteFile (in: hFile=0x234, lpBuffer=0x27af68c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27af68c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.447] CloseHandle (hObject=0x234) returned 1
	[0081.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.448] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg")) returned 1
	[0081.452] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO8dQ[1].jpg", cAlternateFileName="BBBO8D~1.JPG")) returned 1
	[0081.453] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.455] GetFileType (hFile=0x234) returned 0x1
	[0081.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.455] GetFileType (hFile=0x234) returned 0x1
	[0081.455] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x75a
	[0081.455] ReadFile (in: hFile=0x234, lpBuffer=0x27b16c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27b16c0*, lpNumberOfBytesRead=0x26eb64*=0x75a, lpOverlapped=0x0) returned 1
	[0081.460] CloseHandle (hObject=0x234) returned 1
	[0081.460] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.461] GetFileType (hFile=0x234) returned 0x1
	[0081.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.461] GetFileType (hFile=0x234) returned 0x1
	[0081.462] WriteFile (in: hFile=0x234, lpBuffer=0x27b3eac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27b3eac*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.465] CloseHandle (hObject=0x234) returned 1
	[0081.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.466] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg")) returned 1
	[0081.469] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOe7C[1].jpg", cAlternateFileName="BBBOE7~1.JPG")) returned 1
	[0081.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.471] GetFileType (hFile=0x234) returned 0x1
	[0081.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.471] GetFileType (hFile=0x234) returned 0x1
	[0081.471] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2d89
	[0081.472] ReadFile (in: hFile=0x234, lpBuffer=0x27b5778, nNumberOfBytesToRead=0x2d89, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27b5778*, lpNumberOfBytesRead=0x26eb64*=0x2d89, lpOverlapped=0x0) returned 1
	[0081.477] CloseHandle (hObject=0x234) returned 1
	[0081.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.478] GetFileType (hFile=0x234) returned 0x1
	[0081.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.479] GetFileType (hFile=0x234) returned 0x1
	[0081.479] WriteFile (in: hFile=0x234, lpBuffer=0x27b9cf0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27b9cf0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.487] CloseHandle (hObject=0x234) returned 1
	[0081.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.488] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg")) returned 1
	[0081.491] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPThN[1].jpg", cAlternateFileName="BBBPTH~1.JPG")) returned 1
	[0081.491] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.492] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.493] GetFileType (hFile=0x234) returned 0x1
	[0081.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.493] GetFileType (hFile=0x234) returned 0x1
	[0081.494] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1e36
	[0081.494] ReadFile (in: hFile=0x234, lpBuffer=0x27bb5bc, nNumberOfBytesToRead=0x1e36, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27bb5bc*, lpNumberOfBytesRead=0x26eb64*=0x1e36, lpOverlapped=0x0) returned 1
	[0081.498] CloseHandle (hObject=0x234) returned 1
	[0081.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.499] GetFileType (hFile=0x234) returned 0x1
	[0081.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.500] GetFileType (hFile=0x234) returned 0x1
	[0081.500] WriteFile (in: hFile=0x234, lpBuffer=0x27bebe0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27bebe0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.506] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg")) returned 1
	[0081.509] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPUFJ[1].jpg", cAlternateFileName="BBBPUF~1.JPG")) returned 1
	[0081.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.510] GetFileType (hFile=0x234) returned 0x1
	[0081.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.511] GetFileType (hFile=0x234) returned 0x1
	[0081.511] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1ee7
	[0081.511] ReadFile (in: hFile=0x234, lpBuffer=0x27c04ac, nNumberOfBytesToRead=0x1ee7, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27c04ac*, lpNumberOfBytesRead=0x26eb64*=0x1ee7, lpOverlapped=0x0) returned 1
	[0081.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.524] GetFileType (hFile=0x234) returned 0x1
	[0081.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.525] GetFileType (hFile=0x234) returned 0x1
	[0081.525] WriteFile (in: hFile=0x234, lpBuffer=0x27c3b80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27c3b80*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.528] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg")) returned 1
	[0081.531] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBQxzx[1].jpg", cAlternateFileName="BBBQXZ~1.JPG")) returned 1
	[0081.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.533] GetFileType (hFile=0x234) returned 0x1
	[0081.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.534] GetFileType (hFile=0x234) returned 0x1
	[0081.534] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x924
	[0081.534] ReadFile (in: hFile=0x234, lpBuffer=0x27c5d7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27c5d7c*, lpNumberOfBytesRead=0x26eb64*=0x924, lpOverlapped=0x0) returned 1
	[0081.538] CloseHandle (hObject=0x234) returned 1
	[0081.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.540] GetFileType (hFile=0x234) returned 0x1
	[0081.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.540] GetFileType (hFile=0x234) returned 0x1
	[0081.540] WriteFile (in: hFile=0x234, lpBuffer=0x27c8568*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27c8568*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.544] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg")) returned 1
	[0081.547] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBseMP[1].jpg", cAlternateFileName="BBBSEM~1.JPG")) returned 1
	[0081.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.550] GetFileType (hFile=0x234) returned 0x1
	[0081.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.550] GetFileType (hFile=0x234) returned 0x1
	[0081.550] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1963
	[0081.550] ReadFile (in: hFile=0x234, lpBuffer=0x27c9e34, nNumberOfBytesToRead=0x1963, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27c9e34*, lpNumberOfBytesRead=0x26eb64*=0x1963, lpOverlapped=0x0) returned 1
	[0081.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.559] GetFileType (hFile=0x234) returned 0x1
	[0081.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.559] GetFileType (hFile=0x234) returned 0x1
	[0081.562] WriteFile (in: hFile=0x234, lpBuffer=0x27ccf84*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27ccf84*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.565] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg")) returned 1
	[0081.568] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53af3bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53af3bd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53af3bd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBsqNL[1].jpg", cAlternateFileName="BBBSQN~1.JPG")) returned 1
	[0081.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.569] GetFileType (hFile=0x234) returned 0x1
	[0081.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.570] GetFileType (hFile=0x234) returned 0x1
	[0081.570] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x16d6
	[0081.570] ReadFile (in: hFile=0x234, lpBuffer=0x27ce850, nNumberOfBytesToRead=0x16d6, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27ce850*, lpNumberOfBytesRead=0x26eb64*=0x16d6, lpOverlapped=0x0) returned 1
	[0081.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.577] GetFileType (hFile=0x234) returned 0x1
	[0081.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.577] GetFileType (hFile=0x234) returned 0x1
	[0081.577] WriteFile (in: hFile=0x234, lpBuffer=0x27d1714*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27d1714*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.581] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg")) returned 1
	[0081.584] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBTpvW[1].jpg", cAlternateFileName="BBBTPV~1.JPG")) returned 1
	[0081.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.585] GetFileType (hFile=0x234) returned 0x1
	[0081.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.585] GetFileType (hFile=0x234) returned 0x1
	[0081.585] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7ae
	[0081.585] ReadFile (in: hFile=0x234, lpBuffer=0x27d379c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27d379c*, lpNumberOfBytesRead=0x26eb64*=0x7ae, lpOverlapped=0x0) returned 1
	[0081.589] CloseHandle (hObject=0x234) returned 1
	[0081.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.591] GetFileType (hFile=0x234) returned 0x1
	[0081.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.591] GetFileType (hFile=0x234) returned 0x1
	[0081.591] WriteFile (in: hFile=0x234, lpBuffer=0x27d5f88*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27d5f88*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.594] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg")) returned 1
	[0081.597] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 1
	[0081.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.599] GetFileType (hFile=0x234) returned 0x1
	[0081.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.599] GetFileType (hFile=0x234) returned 0x1
	[0081.599] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x974
	[0081.599] ReadFile (in: hFile=0x234, lpBuffer=0x27d81d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27d81d4*, lpNumberOfBytesRead=0x26eb64*=0x974, lpOverlapped=0x0) returned 1
	[0081.603] CloseHandle (hObject=0x234) returned 1
	[0081.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.604] GetFileType (hFile=0x234) returned 0x1
	[0081.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.605] GetFileType (hFile=0x234) returned 0x1
	[0081.605] WriteFile (in: hFile=0x234, lpBuffer=0x27da9c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27da9c0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.608] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg")) returned 1
	[0081.611] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVGsM[1].jpg", cAlternateFileName="BBBVGS~1.JPG")) returned 1
	[0081.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.613] GetFileType (hFile=0x234) returned 0x1
	[0081.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.613] GetFileType (hFile=0x234) returned 0x1
	[0081.613] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1e67
	[0081.613] ReadFile (in: hFile=0x234, lpBuffer=0x27dc28c, nNumberOfBytesToRead=0x1e67, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27dc28c*, lpNumberOfBytesRead=0x26eb64*=0x1e67, lpOverlapped=0x0) returned 1
	[0081.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.623] GetFileType (hFile=0x234) returned 0x1
	[0081.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.623] GetFileType (hFile=0x234) returned 0x1
	[0081.630] WriteFile (in: hFile=0x234, lpBuffer=0x25e1c00*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25e1c00*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.633] CloseHandle (hObject=0x234) returned 1
	[0081.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.634] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg")) returned 1
	[0081.637] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVIzI[1].jpg", cAlternateFileName="BBBVIZ~1.JPG")) returned 1
	[0081.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.641] GetFileType (hFile=0x234) returned 0x1
	[0081.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.641] GetFileType (hFile=0x234) returned 0x1
	[0081.641] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xaa8
	[0081.641] ReadFile (in: hFile=0x234, lpBuffer=0x25e3f80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25e3f80*, lpNumberOfBytesRead=0x26eb64*=0xaa8, lpOverlapped=0x0) returned 1
	[0081.645] CloseHandle (hObject=0x234) returned 1
	[0081.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.647] GetFileType (hFile=0x234) returned 0x1
	[0081.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.647] GetFileType (hFile=0x234) returned 0x1
	[0081.648] WriteFile (in: hFile=0x234, lpBuffer=0x25e676c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25e676c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.651] CloseHandle (hObject=0x234) returned 1
	[0081.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.652] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg")) returned 1
	[0081.655] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVJ4r[1].jpg", cAlternateFileName="BBBVJ4~1.JPG")) returned 1
	[0081.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.658] GetFileType (hFile=0x234) returned 0x1
	[0081.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.659] GetFileType (hFile=0x234) returned 0x1
	[0081.659] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x97a
	[0081.659] ReadFile (in: hFile=0x234, lpBuffer=0x25e89c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25e89c0*, lpNumberOfBytesRead=0x26eb64*=0x97a, lpOverlapped=0x0) returned 1
	[0081.664] CloseHandle (hObject=0x234) returned 1
	[0081.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.664] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.665] GetFileType (hFile=0x234) returned 0x1
	[0081.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.665] GetFileType (hFile=0x234) returned 0x1
	[0081.665] WriteFile (in: hFile=0x234, lpBuffer=0x25eb1ac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25eb1ac*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.668] CloseHandle (hObject=0x234) returned 1
	[0081.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.670] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg")) returned 1
	[0081.673] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5160e6d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5160e6d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5160e6d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVxM8[1].jpg", cAlternateFileName="BBBVXM~1.JPG")) returned 1
	[0081.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.674] GetFileType (hFile=0x234) returned 0x1
	[0081.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.674] GetFileType (hFile=0x234) returned 0x1
	[0081.675] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7d8
	[0081.675] ReadFile (in: hFile=0x234, lpBuffer=0x25ed25c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25ed25c*, lpNumberOfBytesRead=0x26eb64*=0x7d8, lpOverlapped=0x0) returned 1
	[0081.680] CloseHandle (hObject=0x234) returned 1
	[0081.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.681] GetFileType (hFile=0x234) returned 0x1
	[0081.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.681] GetFileType (hFile=0x234) returned 0x1
	[0081.682] WriteFile (in: hFile=0x234, lpBuffer=0x25efa48*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25efa48*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.685] CloseHandle (hObject=0x234) returned 1
	[0081.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.686] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg")) returned 1
	[0081.689] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538de890, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538de890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538de890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBz9wz[1].jpg", cAlternateFileName="BBBZ9W~1.JPG")) returned 1
	[0081.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.691] GetFileType (hFile=0x234) returned 0x1
	[0081.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.691] GetFileType (hFile=0x234) returned 0x1
	[0081.691] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x8d7
	[0081.691] ReadFile (in: hFile=0x234, lpBuffer=0x25f1bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25f1bf8*, lpNumberOfBytesRead=0x26eb64*=0x8d7, lpOverlapped=0x0) returned 1
	[0081.696] CloseHandle (hObject=0x234) returned 1
	[0081.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.697] GetFileType (hFile=0x234) returned 0x1
	[0081.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.697] GetFileType (hFile=0x234) returned 0x1
	[0081.697] WriteFile (in: hFile=0x234, lpBuffer=0x25f43e4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25f43e4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.701] CloseHandle (hObject=0x234) returned 1
	[0081.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.701] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg")) returned 1
	[0081.704] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBzxW1[1].jpg", cAlternateFileName="BBBZXW~1.JPG")) returned 1
	[0081.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.706] GetFileType (hFile=0x234) returned 0x1
	[0081.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.706] GetFileType (hFile=0x234) returned 0x1
	[0081.706] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x24be
	[0081.706] ReadFile (in: hFile=0x234, lpBuffer=0x25f5cb0, nNumberOfBytesToRead=0x24be, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25f5cb0*, lpNumberOfBytesRead=0x26eb64*=0x24be, lpOverlapped=0x0) returned 1
	[0081.711] CloseHandle (hObject=0x234) returned 1
	[0081.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.712] GetFileType (hFile=0x234) returned 0x1
	[0081.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.713] GetFileType (hFile=0x234) returned 0x1
	[0081.713] WriteFile (in: hFile=0x234, lpBuffer=0x25f995c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25f995c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.716] CloseHandle (hObject=0x234) returned 1
	[0081.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.717] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg")) returned 1
	[0081.720] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6125cc20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6125cc20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 1
	[0081.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.723] GetFileType (hFile=0x234) returned 0x1
	[0081.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.723] GetFileType (hFile=0x234) returned 0x1
	[0081.723] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x33a8
	[0081.724] ReadFile (in: hFile=0x234, lpBuffer=0x25fb228, nNumberOfBytesToRead=0x33a8, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25fb228*, lpNumberOfBytesRead=0x26eb64*=0x33a8, lpOverlapped=0x0) returned 1
	[0081.728] CloseHandle (hObject=0x234) returned 1
	[0081.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.729] GetFileType (hFile=0x234) returned 0x1
	[0081.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.729] GetFileType (hFile=0x234) returned 0x1
	[0081.730] WriteFile (in: hFile=0x234, lpBuffer=0x25ffdbc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25ffdbc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.733] CloseHandle (hObject=0x234) returned 1
	[0081.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.733] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg")) returned 1
	[0081.736] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC095c[1].jpg", cAlternateFileName="BBC095~1.JPG")) returned 1
	[0081.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.739] GetFileType (hFile=0x234) returned 0x1
	[0081.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.739] GetFileType (hFile=0x234) returned 0x1
	[0081.739] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x738
	[0081.740] ReadFile (in: hFile=0x234, lpBuffer=0x2601dcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2601dcc*, lpNumberOfBytesRead=0x26eb64*=0x738, lpOverlapped=0x0) returned 1
	[0081.744] CloseHandle (hObject=0x234) returned 1
	[0081.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.745] GetFileType (hFile=0x234) returned 0x1
	[0081.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.745] GetFileType (hFile=0x234) returned 0x1
	[0081.746] WriteFile (in: hFile=0x234, lpBuffer=0x26045b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26045b8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.751] CloseHandle (hObject=0x234) returned 1
	[0081.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.751] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg")) returned 1
	[0081.754] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 1
	[0081.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.757] GetFileType (hFile=0x234) returned 0x1
	[0081.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.757] GetFileType (hFile=0x234) returned 0x1
	[0081.758] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x17a5
	[0081.758] ReadFile (in: hFile=0x234, lpBuffer=0x2605e84, nNumberOfBytesToRead=0x17a5, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2605e84*, lpNumberOfBytesRead=0x26eb64*=0x17a5, lpOverlapped=0x0) returned 1
	[0081.763] CloseHandle (hObject=0x234) returned 1
	[0081.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.764] GetFileType (hFile=0x234) returned 0x1
	[0081.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.764] GetFileType (hFile=0x234) returned 0x1
	[0081.765] WriteFile (in: hFile=0x234, lpBuffer=0x2608e18*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2608e18*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.768] CloseHandle (hObject=0x234) returned 1
	[0081.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.768] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg")) returned 1
	[0081.772] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0lYn[1].jpg", cAlternateFileName="BBC0LY~1.JPG")) returned 1
	[0081.772] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.772] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.774] GetFileType (hFile=0x234) returned 0x1
	[0081.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.774] GetFileType (hFile=0x234) returned 0x1
	[0081.774] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2720
	[0081.775] ReadFile (in: hFile=0x234, lpBuffer=0x260a6e4, nNumberOfBytesToRead=0x2720, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x260a6e4*, lpNumberOfBytesRead=0x26eb64*=0x2720, lpOverlapped=0x0) returned 1
	[0081.779] CloseHandle (hObject=0x234) returned 1
	[0081.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.781] GetFileType (hFile=0x234) returned 0x1
	[0081.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.781] GetFileType (hFile=0x234) returned 0x1
	[0081.781] WriteFile (in: hFile=0x234, lpBuffer=0x260e5f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x260e5f0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.785] CloseHandle (hObject=0x234) returned 1
	[0081.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.785] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg")) returned 1
	[0081.789] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0mlu[1].jpg", cAlternateFileName="BBC0ML~1.JPG")) returned 1
	[0081.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.790] GetFileType (hFile=0x234) returned 0x1
	[0081.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.790] GetFileType (hFile=0x234) returned 0x1
	[0081.790] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x522
	[0081.791] ReadFile (in: hFile=0x234, lpBuffer=0x26103ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26103ec*, lpNumberOfBytesRead=0x26eb64*=0x522, lpOverlapped=0x0) returned 1
	[0081.805] CloseHandle (hObject=0x234) returned 1
	[0081.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.806] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.806] GetFileType (hFile=0x234) returned 0x1
	[0081.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.806] GetFileType (hFile=0x234) returned 0x1
	[0081.807] WriteFile (in: hFile=0x234, lpBuffer=0x2612bd8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2612bd8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.812] CloseHandle (hObject=0x234) returned 1
	[0081.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.813] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg")) returned 1
	[0081.816] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0rDa[1].jpg", cAlternateFileName="BBC0RD~1.JPG")) returned 1
	[0081.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.817] GetFileType (hFile=0x234) returned 0x1
	[0081.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.817] GetFileType (hFile=0x234) returned 0x1
	[0081.817] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x188f
	[0081.818] ReadFile (in: hFile=0x234, lpBuffer=0x26144a4, nNumberOfBytesToRead=0x188f, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26144a4*, lpNumberOfBytesRead=0x26eb64*=0x188f, lpOverlapped=0x0) returned 1
	[0081.822] CloseHandle (hObject=0x234) returned 1
	[0081.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.824] GetFileType (hFile=0x234) returned 0x1
	[0081.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.824] GetFileType (hFile=0x234) returned 0x1
	[0081.824] WriteFile (in: hFile=0x234, lpBuffer=0x2617520*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2617520*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0081.828] CloseHandle (hObject=0x234) returned 1
	[0081.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg", lpFilePart=0x0) returned 0x7e
	[0081.828] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg")) returned 1
	[0081.832] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0rDa[2].jpg", cAlternateFileName="BBC0RD~2.JPG")) returned 1
	[0081.832] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg", lpFilePart=0x0) returned 0x7e
	[0081.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0081.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.833] GetFileType (hFile=0x234) returned 0x1
	[0081.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0081.833] GetFileType (hFile=0x234) returned 0x1
	[0081.833] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7fe
	[0081.834] ReadFile (in: hFile=0x234, lpBuffer=0x26195f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26195f8*, lpNumberOfBytesRead=0x26eb64*=0x7fe, lpOverlapped=0x0) returned 1
	[0081.838] CloseHandle (hObject=0x234) returned 1
	[0081.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0081.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0081.839] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0081.840] GetFileType (hFile=0x234) returned 0x1
	[0081.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0081.840] GetFileType (hFile=0x234) returned 0x1
	[0082.049] WriteFile (in: hFile=0x234, lpBuffer=0x261bde4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x261bde4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.053] CloseHandle (hObject=0x234) returned 1
	[0082.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg", lpFilePart=0x0) returned 0x7e
	[0082.054] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg")) returned 1
	[0082.055] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 1
	[0082.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.060] GetFileType (hFile=0x234) returned 0x1
	[0082.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.061] GetFileType (hFile=0x234) returned 0x1
	[0082.061] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x320d
	[0082.061] ReadFile (in: hFile=0x234, lpBuffer=0x261d6b0, nNumberOfBytesToRead=0x320d, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x261d6b0*, lpNumberOfBytesRead=0x26eb64*=0x320d, lpOverlapped=0x0) returned 1
	[0082.066] CloseHandle (hObject=0x234) returned 1
	[0082.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.067] GetFileType (hFile=0x234) returned 0x1
	[0082.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.068] GetFileType (hFile=0x234) returned 0x1
	[0082.068] WriteFile (in: hFile=0x234, lpBuffer=0x26220ac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26220ac*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.071] CloseHandle (hObject=0x234) returned 1
	[0082.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.072] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg")) returned 1
	[0082.075] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDK7Yy[1].jpg", cAlternateFileName="BBDK7Y~1.JPG")) returned 1
	[0082.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.078] GetFileType (hFile=0x234) returned 0x1
	[0082.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.078] GetFileType (hFile=0x234) returned 0x1
	[0082.078] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x28f2
	[0082.078] ReadFile (in: hFile=0x234, lpBuffer=0x2623978, nNumberOfBytesToRead=0x28f2, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2623978*, lpNumberOfBytesRead=0x26eb64*=0x28f2, lpOverlapped=0x0) returned 1
	[0082.083] CloseHandle (hObject=0x234) returned 1
	[0082.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.083] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.084] GetFileType (hFile=0x234) returned 0x1
	[0082.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.084] GetFileType (hFile=0x234) returned 0x1
	[0082.085] WriteFile (in: hFile=0x234, lpBuffer=0x2627a58*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2627a58*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.088] CloseHandle (hObject=0x234) returned 1
	[0082.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.089] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg")) returned 1
	[0082.093] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDRbsH[1].jpg", cAlternateFileName="BBDRBS~1.JPG")) returned 1
	[0082.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.095] GetFileType (hFile=0x234) returned 0x1
	[0082.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.095] GetFileType (hFile=0x234) returned 0x1
	[0082.095] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x83c
	[0082.096] ReadFile (in: hFile=0x234, lpBuffer=0x2629b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2629b6c*, lpNumberOfBytesRead=0x26eb64*=0x83c, lpOverlapped=0x0) returned 1
	[0082.100] CloseHandle (hObject=0x234) returned 1
	[0082.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.101] GetFileType (hFile=0x234) returned 0x1
	[0082.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.102] GetFileType (hFile=0x234) returned 0x1
	[0082.102] WriteFile (in: hFile=0x234, lpBuffer=0x262c358*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x262c358*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.107] CloseHandle (hObject=0x234) returned 1
	[0082.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.107] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg")) returned 1
	[0082.110] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDZoZR[1].jpg", cAlternateFileName="BBDZOZ~1.JPG")) returned 1
	[0082.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.112] GetFileType (hFile=0x234) returned 0x1
	[0082.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.112] GetFileType (hFile=0x234) returned 0x1
	[0082.112] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x968
	[0082.112] ReadFile (in: hFile=0x234, lpBuffer=0x262e598, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x262e598*, lpNumberOfBytesRead=0x26eb64*=0x968, lpOverlapped=0x0) returned 1
	[0082.117] CloseHandle (hObject=0x234) returned 1
	[0082.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.118] GetFileType (hFile=0x234) returned 0x1
	[0082.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.119] GetFileType (hFile=0x234) returned 0x1
	[0082.119] WriteFile (in: hFile=0x234, lpBuffer=0x2630d84*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2630d84*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.125] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg")) returned 1
	[0082.128] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE97O8[1].jpg", cAlternateFileName="BBE97O~1.JPG")) returned 1
	[0082.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.131] GetFileType (hFile=0x234) returned 0x1
	[0082.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.131] GetFileType (hFile=0x234) returned 0x1
	[0082.131] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x8d4
	[0082.131] ReadFile (in: hFile=0x234, lpBuffer=0x2632f30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2632f30*, lpNumberOfBytesRead=0x26eb64*=0x8d4, lpOverlapped=0x0) returned 1
	[0082.136] CloseHandle (hObject=0x234) returned 1
	[0082.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.137] GetFileType (hFile=0x234) returned 0x1
	[0082.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.137] GetFileType (hFile=0x234) returned 0x1
	[0082.138] WriteFile (in: hFile=0x234, lpBuffer=0x263571c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x263571c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.141] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg")) returned 1
	[0082.144] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE9wSt[1].jpg", cAlternateFileName="BBE9WS~1.JPG")) returned 1
	[0082.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.146] GetFileType (hFile=0x234) returned 0x1
	[0082.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.146] GetFileType (hFile=0x234) returned 0x1
	[0082.146] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x6e0
	[0082.147] ReadFile (in: hFile=0x234, lpBuffer=0x26376d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26376d4*, lpNumberOfBytesRead=0x26eb64*=0x6e0, lpOverlapped=0x0) returned 1
	[0082.151] CloseHandle (hObject=0x234) returned 1
	[0082.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.153] GetFileType (hFile=0x234) returned 0x1
	[0082.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.153] GetFileType (hFile=0x234) returned 0x1
	[0082.153] WriteFile (in: hFile=0x234, lpBuffer=0x2639ec0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2639ec0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.156] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg")) returned 1
	[0082.160] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEcHle[1].jpg", cAlternateFileName="BBECHL~1.JPG")) returned 1
	[0082.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.162] GetFileType (hFile=0x234) returned 0x1
	[0082.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.162] GetFileType (hFile=0x234) returned 0x1
	[0082.162] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x8b9
	[0082.162] ReadFile (in: hFile=0x234, lpBuffer=0x263c054, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x263c054*, lpNumberOfBytesRead=0x26eb64*=0x8b9, lpOverlapped=0x0) returned 1
	[0082.166] CloseHandle (hObject=0x234) returned 1
	[0082.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.167] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.167] GetFileType (hFile=0x234) returned 0x1
	[0082.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.168] GetFileType (hFile=0x234) returned 0x1
	[0082.169] WriteFile (in: hFile=0x234, lpBuffer=0x263e840*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x263e840*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.172] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg")) returned 1
	[0082.175] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdE0f[1].jpg", cAlternateFileName="BBEDE0~1.JPG")) returned 1
	[0082.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.178] GetFileType (hFile=0x234) returned 0x1
	[0082.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.178] GetFileType (hFile=0x234) returned 0x1
	[0082.178] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2086
	[0082.178] ReadFile (in: hFile=0x234, lpBuffer=0x264010c, nNumberOfBytesToRead=0x2086, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x264010c*, lpNumberOfBytesRead=0x26eb64*=0x2086, lpOverlapped=0x0) returned 1
	[0082.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.184] GetFileType (hFile=0x234) returned 0x1
	[0082.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.184] GetFileType (hFile=0x234) returned 0x1
	[0082.185] WriteFile (in: hFile=0x234, lpBuffer=0x2643980*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2643980*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.188] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg")) returned 1
	[0082.191] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdoQv[1].jpg", cAlternateFileName="BBEDOQ~1.JPG")) returned 1
	[0082.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.193] GetFileType (hFile=0x234) returned 0x1
	[0082.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.194] GetFileType (hFile=0x234) returned 0x1
	[0082.194] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x97b
	[0082.194] ReadFile (in: hFile=0x234, lpBuffer=0x2645bd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2645bd4*, lpNumberOfBytesRead=0x26eb64*=0x97b, lpOverlapped=0x0) returned 1
	[0082.198] CloseHandle (hObject=0x234) returned 1
	[0082.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.199] GetFileType (hFile=0x234) returned 0x1
	[0082.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.200] GetFileType (hFile=0x234) returned 0x1
	[0082.200] WriteFile (in: hFile=0x234, lpBuffer=0x26483c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26483c0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.204] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg")) returned 1
	[0082.208] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdqEy[1].jpg", cAlternateFileName="BBEDQE~1.JPG")) returned 1
	[0082.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.210] GetFileType (hFile=0x234) returned 0x1
	[0082.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.211] GetFileType (hFile=0x234) returned 0x1
	[0082.211] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x69a
	[0082.211] ReadFile (in: hFile=0x234, lpBuffer=0x264a334, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x264a334*, lpNumberOfBytesRead=0x26eb64*=0x69a, lpOverlapped=0x0) returned 1
	[0082.215] CloseHandle (hObject=0x234) returned 1
	[0082.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.217] GetFileType (hFile=0x234) returned 0x1
	[0082.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.217] GetFileType (hFile=0x234) returned 0x1
	[0082.217] WriteFile (in: hFile=0x234, lpBuffer=0x264cb20*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x264cb20*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.220] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg")) returned 1
	[0082.224] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdtWw[1].jpg", cAlternateFileName="BBEDTW~1.JPG")) returned 1
	[0082.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.226] GetFileType (hFile=0x234) returned 0x1
	[0082.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.226] GetFileType (hFile=0x234) returned 0x1
	[0082.226] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x6d0
	[0082.226] ReadFile (in: hFile=0x234, lpBuffer=0x264eac8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x264eac8*, lpNumberOfBytesRead=0x26eb64*=0x6d0, lpOverlapped=0x0) returned 1
	[0082.231] CloseHandle (hObject=0x234) returned 1
	[0082.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.232] GetFileType (hFile=0x234) returned 0x1
	[0082.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.232] GetFileType (hFile=0x234) returned 0x1
	[0082.233] WriteFile (in: hFile=0x234, lpBuffer=0x26512b4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26512b4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.236] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg")) returned 1
	[0082.239] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdXJj[1].jpg", cAlternateFileName="BBEDXJ~1.JPG")) returned 1
	[0082.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.241] GetFileType (hFile=0x234) returned 0x1
	[0082.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.241] GetFileType (hFile=0x234) returned 0x1
	[0082.241] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x687
	[0082.242] ReadFile (in: hFile=0x234, lpBuffer=0x2653214, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2653214*, lpNumberOfBytesRead=0x26eb64*=0x687, lpOverlapped=0x0) returned 1
	[0082.246] CloseHandle (hObject=0x234) returned 1
	[0082.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.275] GetFileType (hFile=0x234) returned 0x1
	[0082.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.276] GetFileType (hFile=0x234) returned 0x1
	[0082.276] WriteFile (in: hFile=0x234, lpBuffer=0x2655a00*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2655a00*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.279] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg")) returned 1
	[0082.282] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeP0k[1].jpg", cAlternateFileName="BBEEP0~1.JPG")) returned 1
	[0082.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.284] GetFileType (hFile=0x234) returned 0x1
	[0082.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.284] GetFileType (hFile=0x234) returned 0x1
	[0082.285] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x24c8
	[0082.285] ReadFile (in: hFile=0x234, lpBuffer=0x26572cc, nNumberOfBytesToRead=0x24c8, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26572cc*, lpNumberOfBytesRead=0x26eb64*=0x24c8, lpOverlapped=0x0) returned 1
	[0082.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.291] GetFileType (hFile=0x234) returned 0x1
	[0082.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.291] GetFileType (hFile=0x234) returned 0x1
	[0082.291] WriteFile (in: hFile=0x234, lpBuffer=0x265af80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x265af80*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.295] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg")) returned 1
	[0082.298] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3417, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 1
	[0082.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.301] GetFileType (hFile=0x234) returned 0x1
	[0082.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.302] GetFileType (hFile=0x234) returned 0x1
	[0082.302] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3417
	[0082.302] ReadFile (in: hFile=0x234, lpBuffer=0x265c84c, nNumberOfBytesToRead=0x3417, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x265c84c*, lpNumberOfBytesRead=0x26eb64*=0x3417, lpOverlapped=0x0) returned 1
	[0082.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.307] GetFileType (hFile=0x234) returned 0x1
	[0082.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.308] GetFileType (hFile=0x234) returned 0x1
	[0082.308] WriteFile (in: hFile=0x234, lpBuffer=0x2661450*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2661450*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.312] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg")) returned 1
	[0082.315] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xc0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfE6e[1].jpg", cAlternateFileName="BBEFE6~1.JPG")) returned 1
	[0082.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.318] GetFileType (hFile=0x234) returned 0x1
	[0082.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.318] GetFileType (hFile=0x234) returned 0x1
	[0082.318] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xc0b
	[0082.319] ReadFile (in: hFile=0x234, lpBuffer=0x2663934, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2663934*, lpNumberOfBytesRead=0x26eb64*=0xc0b, lpOverlapped=0x0) returned 1
	[0082.323] CloseHandle (hObject=0x234) returned 1
	[0082.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.324] GetFileType (hFile=0x234) returned 0x1
	[0082.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.325] GetFileType (hFile=0x234) returned 0x1
	[0082.325] WriteFile (in: hFile=0x234, lpBuffer=0x2666120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2666120*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.328] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg")) returned 1
	[0082.332] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 1
	[0082.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.334] GetFileType (hFile=0x234) returned 0x1
	[0082.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.334] GetFileType (hFile=0x234) returned 0x1
	[0082.334] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3c4c
	[0082.335] ReadFile (in: hFile=0x234, lpBuffer=0x26679ec, nNumberOfBytesToRead=0x3c4c, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26679ec*, lpNumberOfBytesRead=0x26eb64*=0x3c4c, lpOverlapped=0x0) returned 1
	[0082.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.346] GetFileType (hFile=0x234) returned 0x1
	[0082.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.346] GetFileType (hFile=0x234) returned 0x1
	[0082.346] WriteFile (in: hFile=0x234, lpBuffer=0x266ce24*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x266ce24*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.349] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg")) returned 1
	[0082.353] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEg9QV[1].jpg", cAlternateFileName="BBEG9Q~1.JPG")) returned 1
	[0082.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.355] GetFileType (hFile=0x234) returned 0x1
	[0082.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.355] GetFileType (hFile=0x234) returned 0x1
	[0082.356] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1f0e
	[0082.356] ReadFile (in: hFile=0x234, lpBuffer=0x266e6f0, nNumberOfBytesToRead=0x1f0e, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x266e6f0*, lpNumberOfBytesRead=0x26eb64*=0x1f0e, lpOverlapped=0x0) returned 1
	[0082.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.361] GetFileType (hFile=0x234) returned 0x1
	[0082.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.362] GetFileType (hFile=0x234) returned 0x1
	[0082.362] WriteFile (in: hFile=0x234, lpBuffer=0x2671dec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2671dec*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.365] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg")) returned 1
	[0082.368] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgGSl[1].jpg", cAlternateFileName="BBEGGS~1.JPG")) returned 1
	[0082.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.370] GetFileType (hFile=0x234) returned 0x1
	[0082.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.371] GetFileType (hFile=0x234) returned 0x1
	[0082.371] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x980
	[0082.371] ReadFile (in: hFile=0x234, lpBuffer=0x2674044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2674044*, lpNumberOfBytesRead=0x26eb64*=0x980, lpOverlapped=0x0) returned 1
	[0082.375] CloseHandle (hObject=0x234) returned 1
	[0082.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.376] GetFileType (hFile=0x234) returned 0x1
	[0082.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.377] GetFileType (hFile=0x234) returned 0x1
	[0082.377] WriteFile (in: hFile=0x234, lpBuffer=0x2676830*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2676830*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.380] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg")) returned 1
	[0082.383] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgiYw[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 1
	[0082.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.390] GetFileType (hFile=0x234) returned 0x1
	[0082.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.390] GetFileType (hFile=0x234) returned 0x1
	[0082.390] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x23fd
	[0082.391] ReadFile (in: hFile=0x234, lpBuffer=0x26780fc, nNumberOfBytesToRead=0x23fd, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26780fc*, lpNumberOfBytesRead=0x26eb64*=0x23fd, lpOverlapped=0x0) returned 1
	[0082.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.397] GetFileType (hFile=0x234) returned 0x1
	[0082.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.397] GetFileType (hFile=0x234) returned 0x1
	[0082.397] WriteFile (in: hFile=0x234, lpBuffer=0x267bce8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x267bce8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.401] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg")) returned 1
	[0082.404] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a59, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 1
	[0082.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.406] GetFileType (hFile=0x234) returned 0x1
	[0082.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.406] GetFileType (hFile=0x234) returned 0x1
	[0082.407] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1a59
	[0082.407] ReadFile (in: hFile=0x234, lpBuffer=0x267d5b4, nNumberOfBytesToRead=0x1a59, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x267d5b4*, lpNumberOfBytesRead=0x26eb64*=0x1a59, lpOverlapped=0x0) returned 1
	[0082.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.412] GetFileType (hFile=0x234) returned 0x1
	[0082.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.412] GetFileType (hFile=0x234) returned 0x1
	[0082.413] WriteFile (in: hFile=0x234, lpBuffer=0x26807fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26807fc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.416] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg")) returned 1
	[0082.481] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgqtY[1].jpg", cAlternateFileName="BBEGQT~1.JPG")) returned 1
	[0082.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.483] GetFileType (hFile=0x234) returned 0x1
	[0082.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.483] GetFileType (hFile=0x234) returned 0x1
	[0082.483] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7b0
	[0082.484] ReadFile (in: hFile=0x234, lpBuffer=0x2682884, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2682884*, lpNumberOfBytesRead=0x26eb64*=0x7b0, lpOverlapped=0x0) returned 1
	[0082.510] CloseHandle (hObject=0x234) returned 1
	[0082.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.512] GetFileType (hFile=0x234) returned 0x1
	[0082.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.513] GetFileType (hFile=0x234) returned 0x1
	[0082.513] WriteFile (in: hFile=0x234, lpBuffer=0x2685070*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2685070*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.516] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.516] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg")) returned 1
	[0082.519] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x44ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 1
	[0082.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.535] GetFileType (hFile=0x234) returned 0x1
	[0082.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.535] GetFileType (hFile=0x234) returned 0x1
	[0082.535] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x44ec
	[0082.535] ReadFile (in: hFile=0x234, lpBuffer=0x268693c, nNumberOfBytesToRead=0x44ec, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x268693c*, lpNumberOfBytesRead=0x26eb64*=0x44ec, lpOverlapped=0x0) returned 1
	[0082.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.541] GetFileType (hFile=0x234) returned 0x1
	[0082.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.541] GetFileType (hFile=0x234) returned 0x1
	[0082.542] WriteFile (in: hFile=0x234, lpBuffer=0x268c614*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x268c614*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.546] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg")) returned 1
	[0082.550] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x171b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgtcS[1].jpg", cAlternateFileName="BBEGTC~1.JPG")) returned 1
	[0082.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.552] GetFileType (hFile=0x234) returned 0x1
	[0082.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.552] GetFileType (hFile=0x234) returned 0x1
	[0082.552] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x171b
	[0082.553] ReadFile (in: hFile=0x234, lpBuffer=0x268dee0, nNumberOfBytesToRead=0x171b, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x268dee0*, lpNumberOfBytesRead=0x26eb64*=0x171b, lpOverlapped=0x0) returned 1
	[0082.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.559] GetFileType (hFile=0x234) returned 0x1
	[0082.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.559] GetFileType (hFile=0x234) returned 0x1
	[0082.560] WriteFile (in: hFile=0x234, lpBuffer=0x2690de8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2690de8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.563] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg")) returned 1
	[0082.566] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgtcS[2].jpg", cAlternateFileName="BBEGTC~2.JPG")) returned 1
	[0082.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg", lpFilePart=0x0) returned 0x7e
	[0082.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.569] GetFileType (hFile=0x234) returned 0x1
	[0082.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.569] GetFileType (hFile=0x234) returned 0x1
	[0082.570] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1826
	[0082.570] ReadFile (in: hFile=0x234, lpBuffer=0x26926b4, nNumberOfBytesToRead=0x1826, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26926b4*, lpNumberOfBytesRead=0x26eb64*=0x1826, lpOverlapped=0x0) returned 1
	[0082.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.575] GetFileType (hFile=0x234) returned 0x1
	[0082.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.576] GetFileType (hFile=0x234) returned 0x1
	[0082.577] WriteFile (in: hFile=0x234, lpBuffer=0x26956c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26956c8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg", lpFilePart=0x0) returned 0x7e
	[0082.580] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg")) returned 1
	[0082.583] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgx5f[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 1
	[0082.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.586] GetFileType (hFile=0x234) returned 0x1
	[0082.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.586] GetFileType (hFile=0x234) returned 0x1
	[0082.586] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x5e5
	[0082.586] ReadFile (in: hFile=0x234, lpBuffer=0x2697588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2697588*, lpNumberOfBytesRead=0x26eb64*=0x5e5, lpOverlapped=0x0) returned 1
	[0082.591] CloseHandle (hObject=0x234) returned 1
	[0082.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.592] GetFileType (hFile=0x234) returned 0x1
	[0082.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.592] GetFileType (hFile=0x234) returned 0x1
	[0082.593] WriteFile (in: hFile=0x234, lpBuffer=0x2699d74*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2699d74*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.596] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg")) returned 1
	[0082.599] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgx5f[2].jpg", cAlternateFileName="BBEGX5~2.JPG")) returned 1
	[0082.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg", lpFilePart=0x0) returned 0x7e
	[0082.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.601] GetFileType (hFile=0x234) returned 0x1
	[0082.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.602] GetFileType (hFile=0x234) returned 0x1
	[0082.602] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x5e5
	[0082.602] ReadFile (in: hFile=0x234, lpBuffer=0x269bc34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x269bc34*, lpNumberOfBytesRead=0x26eb64*=0x5e5, lpOverlapped=0x0) returned 1
	[0082.607] CloseHandle (hObject=0x234) returned 1
	[0082.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.608] GetFileType (hFile=0x234) returned 0x1
	[0082.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.608] GetFileType (hFile=0x234) returned 0x1
	[0082.609] WriteFile (in: hFile=0x234, lpBuffer=0x269e420*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x269e420*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg", lpFilePart=0x0) returned 0x7e
	[0082.612] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg")) returned 1
	[0082.615] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgyIm[1].jpg", cAlternateFileName="BBEGYI~1.JPG")) returned 1
	[0082.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.616] GetFileType (hFile=0x234) returned 0x1
	[0082.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.617] GetFileType (hFile=0x234) returned 0x1
	[0082.617] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3565
	[0082.617] ReadFile (in: hFile=0x234, lpBuffer=0x269fcec, nNumberOfBytesToRead=0x3565, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x269fcec*, lpNumberOfBytesRead=0x26eb64*=0x3565, lpOverlapped=0x0) returned 1
	[0082.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.623] GetFileType (hFile=0x234) returned 0x1
	[0082.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.623] GetFileType (hFile=0x234) returned 0x1
	[0082.623] WriteFile (in: hFile=0x234, lpBuffer=0x26a4a40*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26a4a40*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.626] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg")) returned 1
	[0082.629] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBg3ODX[2].png", cAlternateFileName="BBG3OD~2.PNG")) returned 1
	[0082.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png", lpFilePart=0x0) returned 0x7e
	[0082.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.632] GetFileType (hFile=0x234) returned 0x1
	[0082.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.632] GetFileType (hFile=0x234) returned 0x1
	[0082.632] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xf3
	[0082.632] ReadFile (in: hFile=0x234, lpBuffer=0x26a640c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26a640c*, lpNumberOfBytesRead=0x26eb64*=0xf3, lpOverlapped=0x0) returned 1
	[0082.636] CloseHandle (hObject=0x234) returned 1
	[0082.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.KEKW", lpFilePart=0x0) returned 0x83
	[0082.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.637] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.638] GetFileType (hFile=0x234) returned 0x1
	[0082.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.638] GetFileType (hFile=0x234) returned 0x1
	[0082.638] WriteFile (in: hFile=0x234, lpBuffer=0x26a8bf8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26a8bf8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png", lpFilePart=0x0) returned 0x7e
	[0082.642] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png")) returned 1
	[0082.646] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBiyCq[1].png", cAlternateFileName="BBIYCQ~1.PNG")) returned 1
	[0082.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png", lpFilePart=0x0) returned 0x7d
	[0082.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.647] GetFileType (hFile=0x234) returned 0x1
	[0082.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.647] GetFileType (hFile=0x234) returned 0x1
	[0082.647] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3b9
	[0082.647] ReadFile (in: hFile=0x234, lpBuffer=0x26aa874, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26aa874*, lpNumberOfBytesRead=0x26eb64*=0x3b9, lpOverlapped=0x0) returned 1
	[0082.652] CloseHandle (hObject=0x234) returned 1
	[0082.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.KEKW", lpFilePart=0x0) returned 0x82
	[0082.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.653] GetFileType (hFile=0x234) returned 0x1
	[0082.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.654] GetFileType (hFile=0x234) returned 0x1
	[0082.654] WriteFile (in: hFile=0x234, lpBuffer=0x26ad060*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26ad060*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png", lpFilePart=0x0) returned 0x7d
	[0082.659] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png")) returned 1
	[0082.663] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBn4lUU[1].png", cAlternateFileName="BBN4LU~1.PNG")) returned 1
	[0082.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png", lpFilePart=0x0) returned 0x7e
	[0082.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.664] GetFileType (hFile=0x234) returned 0x1
	[0082.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.664] GetFileType (hFile=0x234) returned 0x1
	[0082.664] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x14d
	[0082.664] ReadFile (in: hFile=0x234, lpBuffer=0x26aea84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26aea84*, lpNumberOfBytesRead=0x26eb64*=0x14d, lpOverlapped=0x0) returned 1
	[0082.669] CloseHandle (hObject=0x234) returned 1
	[0082.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0082.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.670] GetFileType (hFile=0x234) returned 0x1
	[0082.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.671] GetFileType (hFile=0x234) returned 0x1
	[0082.671] WriteFile (in: hFile=0x234, lpBuffer=0x26b1270*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26b1270*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png", lpFilePart=0x0) returned 0x7e
	[0082.675] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png")) returned 1
	[0082.678] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBnMKeN[1].png", cAlternateFileName="BBNMKE~1.PNG")) returned 1
	[0082.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png", lpFilePart=0x0) returned 0x7e
	[0082.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.679] GetFileType (hFile=0x234) returned 0x1
	[0082.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.680] GetFileType (hFile=0x234) returned 0x1
	[0082.680] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x24b
	[0082.680] ReadFile (in: hFile=0x234, lpBuffer=0x26b2d94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26b2d94*, lpNumberOfBytesRead=0x26eb64*=0x24b, lpOverlapped=0x0) returned 1
	[0082.684] CloseHandle (hObject=0x234) returned 1
	[0082.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0082.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.686] GetFileType (hFile=0x234) returned 0x1
	[0082.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.686] GetFileType (hFile=0x234) returned 0x1
	[0082.686] WriteFile (in: hFile=0x234, lpBuffer=0x26b5580*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26b5580*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png", lpFilePart=0x0) returned 0x7e
	[0082.690] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png")) returned 1
	[0082.693] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x38b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBwGan9[1].jpg", cAlternateFileName="BBWGAN~1.JPG")) returned 1
	[0082.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.693] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.695] GetFileType (hFile=0x234) returned 0x1
	[0082.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.695] GetFileType (hFile=0x234) returned 0x1
	[0082.695] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x38b7
	[0082.696] ReadFile (in: hFile=0x234, lpBuffer=0x26b6e4c, nNumberOfBytesToRead=0x38b7, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26b6e4c*, lpNumberOfBytesRead=0x26eb64*=0x38b7, lpOverlapped=0x0) returned 1
	[0082.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0082.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.702] GetFileType (hFile=0x234) returned 0x1
	[0082.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.702] GetFileType (hFile=0x234) returned 0x1
	[0082.702] WriteFile (in: hFile=0x234, lpBuffer=0x26bbef0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26bbef0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg", lpFilePart=0x0) returned 0x7e
	[0082.705] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg")) returned 1
	[0082.708] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBz3ebk[1].png", cAlternateFileName="BBZ3EB~1.PNG")) returned 1
	[0082.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png", lpFilePart=0x0) returned 0x7e
	[0082.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.709] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.709] GetFileType (hFile=0x234) returned 0x1
	[0082.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.709] GetFileType (hFile=0x234) returned 0x1
	[0082.709] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x36c
	[0082.710] ReadFile (in: hFile=0x234, lpBuffer=0x26bdb34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26bdb34*, lpNumberOfBytesRead=0x26eb64*=0x36c, lpOverlapped=0x0) returned 1
	[0082.714] CloseHandle (hObject=0x234) returned 1
	[0082.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0082.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.716] GetFileType (hFile=0x234) returned 0x1
	[0082.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.716] GetFileType (hFile=0x234) returned 0x1
	[0082.717] WriteFile (in: hFile=0x234, lpBuffer=0x26c0320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26c0320*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png", lpFilePart=0x0) returned 0x7e
	[0082.720] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png")) returned 1
	[0082.723] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d4dd60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d4dd60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="benefits-5-mobile[1].png", cAlternateFileName="BENEFI~1.PNG")) returned 1
	[0082.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png", lpFilePart=0x0) returned 0x88
	[0082.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.726] GetFileType (hFile=0x234) returned 0x1
	[0082.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.726] GetFileType (hFile=0x234) returned 0x1
	[0082.727] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x29ed
	[0082.727] ReadFile (in: hFile=0x234, lpBuffer=0x26c1c8c, nNumberOfBytesToRead=0x29ed, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26c1c8c*, lpNumberOfBytesRead=0x26eb64*=0x29ed, lpOverlapped=0x0) returned 1
	[0082.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.KEKW", lpFilePart=0x0) returned 0x8d
	[0082.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.733] GetFileType (hFile=0x234) returned 0x1
	[0082.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.733] GetFileType (hFile=0x234) returned 0x1
	[0082.734] WriteFile (in: hFile=0x234, lpBuffer=0x26c5ea4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26c5ea4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png", lpFilePart=0x0) returned 0x88
	[0082.737] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png")) returned 1
	[0082.740] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61804060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61804060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61850320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1
	[0082.741] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ea49c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ea49c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60ef0c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome-new[1].jpg", cAlternateFileName="CHROME~1.JPG")) returned 1
	[0082.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg", lpFilePart=0x0) returned 0x81
	[0082.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.743] GetFileType (hFile=0x234) returned 0x1
	[0082.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.744] GetFileType (hFile=0x234) returned 0x1
	[0082.744] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x10c6c
	[0082.744] ReadFile (in: hFile=0x234, lpBuffer=0x26c7e10, nNumberOfBytesToRead=0x10c6c, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26c7e10*, lpNumberOfBytesRead=0x26eb64*=0x10c6c, lpOverlapped=0x0) returned 1
	[0082.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.KEKW", lpFilePart=0x0) returned 0x86
	[0082.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.751] GetFileType (hFile=0x234) returned 0x1
	[0082.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.752] GetFileType (hFile=0x234) returned 0x1
	[0082.752] WriteFile (in: hFile=0x234, lpBuffer=0x26da280*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26da280*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg", lpFilePart=0x0) returned 0x81
	[0082.756] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg")) returned 1
	[0082.760] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60b128c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4739, dwReserved0=0x0, dwReserved1=0x0, cFileName="cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot", cAlternateFileName="CJZKEO~1.EOT")) returned 1
	[0082.762] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bb22b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1
	[0082.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js", lpFilePart=0x0) returned 0x82
	[0082.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.764] GetFileType (hFile=0x234) returned 0x1
	[0082.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.764] GetFileType (hFile=0x234) returned 0x1
	[0082.765] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7b1
	[0082.765] ReadFile (in: hFile=0x234, lpBuffer=0x26dcb20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26dcb20*, lpNumberOfBytesRead=0x26eb64*=0x7b1, lpOverlapped=0x0) returned 1
	[0082.769] CloseHandle (hObject=0x234) returned 1
	[0082.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js.KEKW", lpFilePart=0x0) returned 0x87
	[0082.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.771] GetFileType (hFile=0x234) returned 0x1
	[0082.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.771] GetFileType (hFile=0x234) returned 0x1
	[0082.771] WriteFile (in: hFile=0x234, lpBuffer=0x26df324*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26df324*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.774] CloseHandle (hObject=0x234) returned 1
	[0082.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js", lpFilePart=0x0) returned 0x82
	[0082.775] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js")) returned 1
	[0082.778] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe6dfad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe6dfad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe6dfad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContainerTag[2].js", cAlternateFileName="CONTAI~2.JS")) returned 1
	[0082.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js", lpFilePart=0x0) returned 0x82
	[0082.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.780] GetFileType (hFile=0x234) returned 0x1
	[0082.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.780] GetFileType (hFile=0x234) returned 0x1
	[0082.780] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7b1
	[0082.781] ReadFile (in: hFile=0x234, lpBuffer=0x26e13f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26e13f8*, lpNumberOfBytesRead=0x26eb64*=0x7b1, lpOverlapped=0x0) returned 1
	[0082.785] CloseHandle (hObject=0x234) returned 1
	[0082.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js.KEKW", lpFilePart=0x0) returned 0x87
	[0082.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.786] GetFileType (hFile=0x234) returned 0x1
	[0082.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.787] GetFileType (hFile=0x234) returned 0x1
	[0082.787] WriteFile (in: hFile=0x234, lpBuffer=0x26e3bfc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26e3bfc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.790] CloseHandle (hObject=0x234) returned 1
	[0082.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js", lpFilePart=0x0) returned 0x82
	[0082.791] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js")) returned 1
	[0082.796] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ddbc1a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ddbc1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ddbc1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="css[2].txt", cAlternateFileName="CSS_2_~1.TXT")) returned 1
	[0082.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt", lpFilePart=0x0) returned 0x7a
	[0082.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.810] GetFileType (hFile=0x234) returned 0x1
	[0082.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.811] GetFileType (hFile=0x234) returned 0x1
	[0082.811] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xbb
	[0082.811] ReadFile (in: hFile=0x234, lpBuffer=0x26e5558, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26e5558*, lpNumberOfBytesRead=0x26eb64*=0xbb, lpOverlapped=0x0) returned 1
	[0082.814] CloseHandle (hObject=0x234) returned 1
	[0082.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.KEKW", lpFilePart=0x0) returned 0x7f
	[0082.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.816] GetFileType (hFile=0x234) returned 0x1
	[0082.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.817] GetFileType (hFile=0x234) returned 0x1
	[0082.817] WriteFile (in: hFile=0x234, lpBuffer=0x26e7d2c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26e7d2c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.820] CloseHandle (hObject=0x234) returned 1
	[0082.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt", lpFilePart=0x0) returned 0x7a
	[0082.821] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt")) returned 1
	[0082.826] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0082.826] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5114bad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5114bad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x511bdef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39a21, dwReserved0=0x0, dwReserved1=0x0, cFileName="f8-028d9f-f30905ea[1]", cAlternateFileName="F8-028~1")) returned 1
	[0082.827] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf893e70, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf893e70, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf893e70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="fallback_728x90[1].jpg", cAlternateFileName="FALLBA~1.JPG")) returned 1
	[0082.827] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg", lpFilePart=0x0) returned 0x86
	[0082.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.830] GetFileType (hFile=0x234) returned 0x1
	[0082.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.830] GetFileType (hFile=0x234) returned 0x1
	[0082.830] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7f78
	[0082.830] ReadFile (in: hFile=0x234, lpBuffer=0x26ea2d8, nNumberOfBytesToRead=0x7f78, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26ea2d8*, lpNumberOfBytesRead=0x26eb64*=0x7f78, lpOverlapped=0x0) returned 1
	[0082.835] CloseHandle (hObject=0x234) returned 1
	[0082.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.KEKW", lpFilePart=0x0) returned 0x8b
	[0082.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.837] GetFileType (hFile=0x234) returned 0x1
	[0082.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.837] GetFileType (hFile=0x234) returned 0x1
	[0082.837] WriteFile (in: hFile=0x234, lpBuffer=0x26f3a6c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26f3a6c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.841] CloseHandle (hObject=0x234) returned 1
	[0082.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg", lpFilePart=0x0) returned 0x86
	[0082.842] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg")) returned 1
	[0082.846] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1
	[0082.846] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde189b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde189b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde189b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1
	[0082.847] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x551dcf90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie8[1].txt", cAlternateFileName="IE8_1_~1.TXT")) returned 1
	[0082.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt", lpFilePart=0x0) returned 0x7a
	[0082.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.848] GetFileType (hFile=0x234) returned 0x1
	[0082.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.849] GetFileType (hFile=0x234) returned 0x1
	[0082.849] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x66
	[0082.849] ReadFile (in: hFile=0x234, lpBuffer=0x26f6e5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26f6e5c*, lpNumberOfBytesRead=0x26eb64*=0x66, lpOverlapped=0x0) returned 1
	[0082.854] CloseHandle (hObject=0x234) returned 1
	[0082.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.KEKW", lpFilePart=0x0) returned 0x7f
	[0082.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.856] GetFileType (hFile=0x234) returned 0x1
	[0082.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.856] GetFileType (hFile=0x234) returned 0x1
	[0082.856] WriteFile (in: hFile=0x234, lpBuffer=0x26f9630*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26f9630*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.860] CloseHandle (hObject=0x234) returned 1
	[0082.860] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt", lpFilePart=0x0) returned 0x7a
	[0082.860] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt")) returned 1
	[0082.863] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bff750, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bff750, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bff750, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1
	[0082.864] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x88e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1
	[0082.865] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1180, dwReserved0=0x0, dwReserved1=0x0, cFileName="meversion[1]", cAlternateFileName="MEVERS~1")) returned 1
	[0082.865] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfaa91b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfaa91b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfaa91b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1
	[0082.865] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56ed3860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56ed3860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x56ed3860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="Passport[1].htm", cAlternateFileName="PASSPO~1.HTM")) returned 1
	[0082.866] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9f32, dwReserved0=0x0, dwReserved1=0x0, cFileName="plusone[1].js", cAlternateFileName="PLUSON~1.JS")) returned 1
	[0082.866] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js", lpFilePart=0x0) returned 0x7d
	[0082.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.869] GetFileType (hFile=0x234) returned 0x1
	[0082.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.869] GetFileType (hFile=0x234) returned 0x1
	[0082.870] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x9f32
	[0082.870] ReadFile (in: hFile=0x234, lpBuffer=0x26fccd8, nNumberOfBytesToRead=0x9f32, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26fccd8*, lpNumberOfBytesRead=0x26eb64*=0x9f32, lpOverlapped=0x0) returned 1
	[0082.875] CloseHandle (hObject=0x234) returned 1
	[0082.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js.KEKW", lpFilePart=0x0) returned 0x82
	[0082.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.877] GetFileType (hFile=0x234) returned 0x1
	[0082.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.877] GetFileType (hFile=0x234) returned 0x1
	[0082.878] WriteFile (in: hFile=0x234, lpBuffer=0x27083f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27083f8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.881] CloseHandle (hObject=0x234) returned 1
	[0082.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js", lpFilePart=0x0) returned 0x7d
	[0082.881] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js")) returned 1
	[0082.886] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6371bfc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6371bfc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6371bfc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="postmessageRelay[1].htm", cAlternateFileName="POSTME~1.HTM")) returned 1
	[0082.887] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555ac120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555ac120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55a97d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="search[1].htm", cAlternateFileName="SEARCH~1.HTM")) returned 1
	[0082.887] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c85b, dwReserved0=0x0, dwReserved1=0x0, cFileName="uhf-west-european-default.min[1].css", cAlternateFileName="UHF-WE~1.CSS")) returned 1
	[0082.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css", lpFilePart=0x0) returned 0x94
	[0082.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.888] GetFileType (hFile=0x234) returned 0x1
	[0082.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.889] GetFileType (hFile=0x234) returned 0x1
	[0082.889] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1c85b
	[0082.890] ReadFile (in: hFile=0x234, lpBuffer=0x36da750, nNumberOfBytesToRead=0x1c85b, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x36da750*, lpNumberOfBytesRead=0x26eb64*=0x1c85b, lpOverlapped=0x0) returned 1
	[0082.900] CloseHandle (hObject=0x234) returned 1
	[0082.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css.KEKW", lpFilePart=0x0) returned 0x99
	[0082.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.901] GetFileType (hFile=0x234) returned 0x1
	[0082.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.902] GetFileType (hFile=0x234) returned 0x1
	[0082.902] WriteFile (in: hFile=0x234, lpBuffer=0x270c330*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x270c330*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.905] CloseHandle (hObject=0x234) returned 1
	[0082.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css", lpFilePart=0x0) returned 0x94
	[0082.906] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css")) returned 1
	[0082.911] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 1
	[0082.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css", lpFilePart=0x0) returned 0x93
	[0082.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0082.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.912] GetFileType (hFile=0x234) returned 0x1
	[0082.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0082.912] GetFileType (hFile=0x234) returned 0x1
	[0082.913] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1687
	[0082.913] ReadFile (in: hFile=0x234, lpBuffer=0x270ddd4, nNumberOfBytesToRead=0x1687, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x270ddd4*, lpNumberOfBytesRead=0x26eb64*=0x1687, lpOverlapped=0x0) returned 1
	[0082.918] CloseHandle (hObject=0x234) returned 1
	[0082.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css.KEKW", lpFilePart=0x0) returned 0x98
	[0082.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0082.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0082.919] GetFileType (hFile=0x234) returned 0x1
	[0082.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0082.919] GetFileType (hFile=0x234) returned 0x1
	[0082.919] WriteFile (in: hFile=0x234, lpBuffer=0x2710ccc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2710ccc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0082.923] CloseHandle (hObject=0x234) returned 1
	[0082.923] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css", lpFilePart=0x0) returned 0x93
	[0082.924] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css")) returned 1
	[0082.927] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0082.927] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0082.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0082.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0082.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Decrypt.txt", lpFilePart=0x0) returned 0x7b
	[0082.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0082.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0082.929] GetFileType (hFile=0x230) returned 0x1
	[0082.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0082.929] GetFileType (hFile=0x230) returned 0x1
	[0082.929] WriteFile (in: hFile=0x230, lpBuffer=0x2713558*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x2713558*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0082.933] CloseHandle (hObject=0x230) returned 1
	[0082.933] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ABV8L7MY", cAlternateFileName="")) returned 1
	[0082.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0082.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY", lpFilePart=0x0) returned 0x6f
	[0082.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpFilePart=0x0) returned 0x70
	[0082.934] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0082.940] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0082.944] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa36d90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa36d90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa83050, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xe455, dwReserved0=0x0, dwReserved1=0x0, cFileName="000000929096[1].gif", cAlternateFileName="000000~1.GIF")) returned 1
	[0082.944] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6384cac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6384cac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6384cac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2929, dwReserved0=0x0, dwReserved1=0x0, cFileName="1223855322-postmessagerelay[1].js", cAlternateFileName="122385~1.JS")) returned 1
	[0082.945] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA3e1oO[1].png", cAlternateFileName="AA3E1O~1.PNG")) returned 1
	[0082.945] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA429NP[1].png", cAlternateFileName="AA429N~1.PNG")) returned 1
	[0082.946] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530fbfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA42pjY[1].png", cAlternateFileName="AA42PJ~1.PNG")) returned 1
	[0082.947] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe327870, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA61AKN[2].png", cAlternateFileName="AA61AK~2.PNG")) returned 1
	[0082.947] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA6KizP[2].png", cAlternateFileName="AA6KIZ~2.PNG")) returned 1
	[0082.949] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA7XCQ3[1].png", cAlternateFileName="AA7XCQ~1.PNG")) returned 1
	[0082.949] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA8Tave[1].png", cAlternateFileName="AA8TAV~1.PNG")) returned 1
	[0082.950] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAfOIDq[1].png", cAlternateFileName="AAFOID~1.PNG")) returned 1
	[0082.951] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAkhMz9[2].png", cAlternateFileName="AAKHMZ~2.PNG")) returned 1
	[0082.951] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAmRY2Q[1].png", cAlternateFileName="AAMRY2~1.PNG")) returned 1
	[0082.952] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAni8qk[1].png", cAlternateFileName="AANI8Q~1.PNG")) returned 1
	[0082.952] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf1239b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf1239b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf1239b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7a52, dwReserved0=0x0, dwReserved1=0x0, cFileName="adition[1].js", cAlternateFileName="ADITIO~1.JS")) returned 1
	[0082.953] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c4a830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="async_usersync[1].htm", cAlternateFileName="ASYNC_~1.HTM")) returned 1
	[0082.953] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bb22b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bb22b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bfe570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5feb, dwReserved0=0x0, dwReserved1=0x0, cFileName="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", cAlternateFileName="B367C0~1.JPG")) returned 1
	[0082.954] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB8jcOr[2].png", cAlternateFileName="BB8JCO~2.PNG")) returned 1
	[0082.955] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBB8ZbM[1].jpg", cAlternateFileName="BBB8ZB~1.JPG")) returned 1
	[0082.955] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBB9wH0[1].png", cAlternateFileName="BBB9WH~1.PNG")) returned 1
	[0082.956] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x642446e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x642446e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBCFjo[1].jpg", cAlternateFileName="BBBCFJ~1.JPG")) returned 1
	[0082.956] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBDtcM[1].jpg", cAlternateFileName="BBBDTC~1.JPG")) returned 1
	[0082.957] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f19, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBIeNJ[1].jpg", cAlternateFileName="BBBIEN~1.JPG")) returned 1
	[0082.958] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53598a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBImKX[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 1
	[0082.958] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2569, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBL4R9[1].jpg", cAlternateFileName="BBBL4R~1.JPG")) returned 1
	[0082.959] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBLhTZ[1].jpg", cAlternateFileName="BBBLHT~1.JPG")) returned 1
	[0082.959] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBnhZY[1].jpg", cAlternateFileName="BBBNHZ~1.JPG")) returned 1
	[0082.960] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671dfee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x671dfee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x67206040, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPhAr[1].jpg", cAlternateFileName="BBBPHA~1.JPG")) returned 1
	[0082.960] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c21, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPiby[1].jpg", cAlternateFileName="BBBPIB~1.JPG")) returned 1
	[0082.961] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPmXJ[1].jpg", cAlternateFileName="BBBPMX~1.JPG")) returned 1
	[0082.961] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21feb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPS37[1].png", cAlternateFileName="BBBPS3~1.PNG")) returned 1
	[0082.962] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBQiBF[1].jpg", cAlternateFileName="BBBQIB~1.JPG")) returned 1
	[0082.966] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBty8h[1].jpg", cAlternateFileName="BBBTY8~1.JPG")) returned 1
	[0082.966] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVACL[1].jpg", cAlternateFileName="BBBVAC~1.JPG")) returned 1
	[0082.967] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e29b2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e29b2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e29b2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c41, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVGyR[1].jpg", cAlternateFileName="BBBVGY~1.JPG")) returned 1
	[0082.967] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVMtX[1].jpg", cAlternateFileName="BBBVMT~1.JPG")) returned 1
	[0082.968] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVYsu[1].jpg", cAlternateFileName="BBBVYS~1.JPG")) returned 1
	[0082.969] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5154fff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5154fff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51576150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x76a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBWLtW[1].jpg", cAlternateFileName="BBBWLT~1.JPG")) returned 1
	[0082.969] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBX3xB[1].jpg", cAlternateFileName="BBBX3X~1.JPG")) returned 1
	[0082.970] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533112f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533112f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533112f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBY98e[1].jpg", cAlternateFileName="BBBY98~1.JPG")) returned 1
	[0082.971] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBZYVP[1].jpg", cAlternateFileName="BBBZYV~1.JPG")) returned 1
	[0082.971] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 1
	[0082.972] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC04ok[1].jpg", cAlternateFileName="BBC04O~2.JPG")) returned 1
	[0082.973] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539e9230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a99, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC04we[1].jpg", cAlternateFileName="BBC04W~1.JPG")) returned 1
	[0082.973] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e02430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e02430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC05rl[1].jpg", cAlternateFileName="BBC05R~1.JPG")) returned 1
	[0082.974] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC05rl[2].jpg", cAlternateFileName="BBC05R~2.JPG")) returned 1
	[0082.974] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0ATj[1].jpg", cAlternateFileName="BBC0AT~1.JPG")) returned 1
	[0082.975] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x751, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0D8i[1].jpg", cAlternateFileName="BBC0D8~1.JPG")) returned 1
	[0082.976] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 1
	[0082.976] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0w1b[1].jpg", cAlternateFileName="BBC0W1~1.JPG")) returned 1
	[0082.977] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0xLt[1].jpg", cAlternateFileName="BBC0XL~1.JPG")) returned 1
	[0082.977] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDWA22[1].jpg", cAlternateFileName="BBDWA2~1.JPG")) returned 1
	[0082.978] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE7d3b[1].jpg", cAlternateFileName="BBE7D3~1.JPG")) returned 1
	[0082.979] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45583010, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45583010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455a9170, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2850, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE85ld[1].jpg", cAlternateFileName="BBE85L~1.JPG")) returned 1
	[0082.980] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x16ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdckp[1].jpg", cAlternateFileName="BBEDCK~1.JPG")) returned 1
	[0082.981] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdMci[1].jpg", cAlternateFileName="BBEDMC~1.JPG")) returned 1
	[0082.981] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdSLV[1].jpg", cAlternateFileName="BBEDSL~1.JPG")) returned 1
	[0082.982] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEe2Pd[1].jpg", cAlternateFileName="BBEE2P~1.JPG")) returned 1
	[0082.983] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3faf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEe4Oo[1].png", cAlternateFileName="BBEE4O~1.PNG")) returned 1
	[0082.983] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEe6Ew[1].jpg", cAlternateFileName="BBEE6E~1.JPG")) returned 1
	[0082.984] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeFp3[1].jpg", cAlternateFileName="BBEEFP~1.JPG")) returned 1
	[0082.984] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe3bfdf0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe3bfdf0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe3bfdf0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeGwU[1].jpg", cAlternateFileName="BBEEGW~1.JPG")) returned 1
	[0082.985] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7be, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeUg0[1].jpg", cAlternateFileName="BBEEUG~1.JPG")) returned 1
	[0082.986] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeZnr[1].jpg", cAlternateFileName="BBEEZN~1.JPG")) returned 1
	[0082.993] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEf5Lq[1].jpg", cAlternateFileName="BBEF5L~1.JPG")) returned 1
	[0082.994] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 1
	[0082.995] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfzSd[1].jpg", cAlternateFileName="BBEFZS~1.JPG")) returned 1
	[0082.995] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgCuQ[1].jpg", cAlternateFileName="BBEGCU~1.JPG")) returned 1
	[0082.996] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a65, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgHzB[1].jpg", cAlternateFileName="BBEGHZ~1.JPG")) returned 1
	[0082.996] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdeb0f30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5a45, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgIl2[1].jpg", cAlternateFileName="BBEGIL~1.JPG")) returned 1
	[0082.997] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x388f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgIl2[2].jpg", cAlternateFileName="BBEGIL~2.JPG")) returned 1
	[0082.998] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1e97, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgIyL[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 1
	[0082.998] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgkY6[1].jpg", cAlternateFileName="BBEGKY~1.JPG")) returned 1
	[0082.999] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8df, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgLzV[1].jpg", cAlternateFileName="BBEGLZ~1.JPG")) returned 1
	[0082.999] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgUri[1].jpg", cAlternateFileName="BBEGUR~1.JPG")) returned 1
	[0083.000] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgXBv[1].jpg", cAlternateFileName="BBEGXB~1.JPG")) returned 1
	[0083.001] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgZME[1].jpg", cAlternateFileName="BBEGZM~1.JPG")) returned 1
	[0083.001] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBghfVy[1].png", cAlternateFileName="BBGHFV~1.PNG")) returned 1
	[0083.002] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBkwUr[1].png", cAlternateFileName="BBKWUR~1.PNG")) returned 1
	[0083.002] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBlBV0U[1].png", cAlternateFileName="BBLBV0~1.PNG")) returned 1
	[0083.003] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3376, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBzhWWE[1].jpg", cAlternateFileName="BBZHWW~1.JPG")) returned 1
	[0083.004] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60baae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60baae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c433c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13c06, dwReserved0=0x0, dwReserved1=0x0, cFileName="benefits-2[1].jpg", cAlternateFileName="BENEFI~2.JPG")) returned 1
	[0083.004] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b84ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b84ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c1d260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="benefits-4[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 1
	[0083.005] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4dbc10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4dbc10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4dbc10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6f15, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap[1].js", cAlternateFileName="BOOTST~1.JS")) returned 1
	[0083.006] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x583e0320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x583e0320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x583e0320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="browser[1].htm", cAlternateFileName="BROWSE~1.HTM")) returned 1
	[0083.006] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b2b1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bs-jsdep[1].css", cAlternateFileName="BS-JSD~1.CSS")) returned 1
	[0083.007] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61341460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61341460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x613675c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1
	[0083.008] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1
	[0083.008] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29349, dwReserved0=0x0, dwReserved1=0x0, cFileName="core[1].css", cAlternateFileName="CORE_1~1.CSS")) returned 1
	[0083.009] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0083.010] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54ca7f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ca7f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54ca7f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DevCMDL2.2.18[1].eot", cAlternateFileName="DEVCMD~1.EOT")) returned 1
	[0083.010] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5120a1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5120a1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5120a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="e151e5[1].gif", cAlternateFileName="E151E5~1.GIF")) returned 1
	[0083.011] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5101afd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5101afd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5101afd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x0, dwReserved1=0x0, cFileName="e4-190963-91cdfbc1[1].txt", cAlternateFileName="E4-190~1.TXT")) returned 1
	[0083.012] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b5eb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b5eb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f89200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula_text[1].htm", cAlternateFileName="EULA_T~1.HTM")) returned 1
	[0083.012] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="f[1].txt", cAlternateFileName="F_1_~1.TXT")) returned 1
	[0083.013] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1254, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1
	[0083.014] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ef0c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ef0c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f16de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="google_plus_16dp[1].png", cAlternateFileName="GOOGLE~1.PNG")) returned 1
	[0083.014] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de2e5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5de2e5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5de54720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="index[1].htm", cAlternateFileName="INDEX_~1.HTM")) returned 1
	[0083.014] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa1af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54fa1af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54fa1af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="print[1].txt", cAlternateFileName="PRINT_~1.TXT")) returned 1
	[0083.015] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44f697b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44f697b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44f8f910, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x15429, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard[1]", cAlternateFileName="STANDA~1")) returned 1
	[0083.015] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 1
	[0083.016] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x548efd10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x548efd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x548efd10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="uhf-main.var.min[1].js", cAlternateFileName="UHF-MA~1.JS")) returned 1
	[0083.016] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2dd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1
	[0083.016] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d29, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2[2]", cAlternateFileName="V2_2_~1")) returned 1
	[0083.017] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe751ef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe751ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe751ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2[3]", cAlternateFileName="V2_3_~1")) returned 1
	[0083.017] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 1
	[0083.017] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 0
	[0083.018] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0083.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0083.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0083.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0083.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY", lpFilePart=0x0) returned 0x6f
	[0083.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\", lpFilePart=0x0) returned 0x70
	[0083.022] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0083.025] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0083.026] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa36d90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa36d90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa83050, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xe455, dwReserved0=0x0, dwReserved1=0x0, cFileName="000000929096[1].gif", cAlternateFileName="000000~1.GIF")) returned 1
	[0083.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif", lpFilePart=0x0) returned 0x83
	[0083.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.027] GetFileType (hFile=0x234) returned 0x1
	[0083.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.027] GetFileType (hFile=0x234) returned 0x1
	[0083.027] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xe455
	[0083.027] ReadFile (in: hFile=0x234, lpBuffer=0x2727680, nNumberOfBytesToRead=0xe455, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2727680*, lpNumberOfBytesRead=0x26eb64*=0xe455, lpOverlapped=0x0) returned 1
	[0083.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif.KEKW", lpFilePart=0x0) returned 0x88
	[0083.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.036] GetFileType (hFile=0x234) returned 0x1
	[0083.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.037] GetFileType (hFile=0x234) returned 0x1
	[0083.037] WriteFile (in: hFile=0x234, lpBuffer=0x27372e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27372e8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif", lpFilePart=0x0) returned 0x83
	[0083.042] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif")) returned 1
	[0083.046] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6384cac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6384cac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6384cac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2929, dwReserved0=0x0, dwReserved1=0x0, cFileName="1223855322-postmessagerelay[1].js", cAlternateFileName="122385~1.JS")) returned 1
	[0083.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js", lpFilePart=0x0) returned 0x91
	[0083.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.049] GetFileType (hFile=0x234) returned 0x1
	[0083.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.049] GetFileType (hFile=0x234) returned 0x1
	[0083.049] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2929
	[0083.049] ReadFile (in: hFile=0x234, lpBuffer=0x2738ce0, nNumberOfBytesToRead=0x2929, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2738ce0*, lpNumberOfBytesRead=0x26eb64*=0x2929, lpOverlapped=0x0) returned 1
	[0083.056] CloseHandle (hObject=0x234) returned 1
	[0083.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js.KEKW", lpFilePart=0x0) returned 0x96
	[0083.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.058] GetFileType (hFile=0x234) returned 0x1
	[0083.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.058] GetFileType (hFile=0x234) returned 0x1
	[0083.058] WriteFile (in: hFile=0x234, lpBuffer=0x273ce70*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x273ce70*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.062] CloseHandle (hObject=0x234) returned 1
	[0083.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js", lpFilePart=0x0) returned 0x91
	[0083.062] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js")) returned 1
	[0083.066] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA3e1oO[1].png", cAlternateFileName="AA3E1O~1.PNG")) returned 1
	[0083.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png", lpFilePart=0x0) returned 0x7e
	[0083.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.067] GetFileType (hFile=0x234) returned 0x1
	[0083.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.067] GetFileType (hFile=0x234) returned 0x1
	[0083.067] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x29b
	[0083.068] ReadFile (in: hFile=0x234, lpBuffer=0x273ea08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x273ea08*, lpNumberOfBytesRead=0x26eb64*=0x29b, lpOverlapped=0x0) returned 1
	[0083.072] CloseHandle (hObject=0x234) returned 1
	[0083.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.074] GetFileType (hFile=0x234) returned 0x1
	[0083.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.074] GetFileType (hFile=0x234) returned 0x1
	[0083.074] WriteFile (in: hFile=0x234, lpBuffer=0x27411f4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27411f4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.078] CloseHandle (hObject=0x234) returned 1
	[0083.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png", lpFilePart=0x0) returned 0x7e
	[0083.078] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png")) returned 1
	[0083.082] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA429NP[1].png", cAlternateFileName="AA429N~1.PNG")) returned 1
	[0083.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png", lpFilePart=0x0) returned 0x7e
	[0083.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.083] GetFileType (hFile=0x234) returned 0x1
	[0083.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.083] GetFileType (hFile=0x234) returned 0x1
	[0083.083] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x265
	[0083.084] ReadFile (in: hFile=0x234, lpBuffer=0x2742d34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2742d34*, lpNumberOfBytesRead=0x26eb64*=0x265, lpOverlapped=0x0) returned 1
	[0083.089] CloseHandle (hObject=0x234) returned 1
	[0083.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.090] GetFileType (hFile=0x234) returned 0x1
	[0083.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.090] GetFileType (hFile=0x234) returned 0x1
	[0083.091] WriteFile (in: hFile=0x234, lpBuffer=0x2745520*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2745520*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.093] CloseHandle (hObject=0x234) returned 1
	[0083.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png", lpFilePart=0x0) returned 0x7e
	[0083.094] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png")) returned 1
	[0083.097] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530fbfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA42pjY[1].png", cAlternateFileName="AA42PJ~1.PNG")) returned 1
	[0083.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png", lpFilePart=0x0) returned 0x7e
	[0083.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.099] GetFileType (hFile=0x234) returned 0x1
	[0083.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.099] GetFileType (hFile=0x234) returned 0x1
	[0083.099] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x252
	[0083.100] ReadFile (in: hFile=0x234, lpBuffer=0x274704c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x274704c*, lpNumberOfBytesRead=0x26eb64*=0x252, lpOverlapped=0x0) returned 1
	[0083.104] CloseHandle (hObject=0x234) returned 1
	[0083.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.106] GetFileType (hFile=0x234) returned 0x1
	[0083.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.106] GetFileType (hFile=0x234) returned 0x1
	[0083.106] WriteFile (in: hFile=0x234, lpBuffer=0x2749838*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2749838*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.109] CloseHandle (hObject=0x234) returned 1
	[0083.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png", lpFilePart=0x0) returned 0x7e
	[0083.110] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png")) returned 1
	[0083.113] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe327870, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA61AKN[2].png", cAlternateFileName="AA61AK~2.PNG")) returned 1
	[0083.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png", lpFilePart=0x0) returned 0x7e
	[0083.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.115] GetFileType (hFile=0x234) returned 0x1
	[0083.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.115] GetFileType (hFile=0x234) returned 0x1
	[0083.115] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x248
	[0083.116] ReadFile (in: hFile=0x234, lpBuffer=0x274b358, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x274b358*, lpNumberOfBytesRead=0x26eb64*=0x248, lpOverlapped=0x0) returned 1
	[0083.121] CloseHandle (hObject=0x234) returned 1
	[0083.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.123] GetFileType (hFile=0x234) returned 0x1
	[0083.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.123] GetFileType (hFile=0x234) returned 0x1
	[0083.123] WriteFile (in: hFile=0x234, lpBuffer=0x274db44*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x274db44*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.126] CloseHandle (hObject=0x234) returned 1
	[0083.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png", lpFilePart=0x0) returned 0x7e
	[0083.127] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png")) returned 1
	[0083.131] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA6KizP[2].png", cAlternateFileName="AA6KIZ~2.PNG")) returned 1
	[0083.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png", lpFilePart=0x0) returned 0x7e
	[0083.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.132] GetFileType (hFile=0x234) returned 0x1
	[0083.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.132] GetFileType (hFile=0x234) returned 0x1
	[0083.133] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x21b
	[0083.133] ReadFile (in: hFile=0x234, lpBuffer=0x274f638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x274f638*, lpNumberOfBytesRead=0x26eb64*=0x21b, lpOverlapped=0x0) returned 1
	[0083.149] CloseHandle (hObject=0x234) returned 1
	[0083.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.150] GetFileType (hFile=0x234) returned 0x1
	[0083.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.151] GetFileType (hFile=0x234) returned 0x1
	[0083.151] WriteFile (in: hFile=0x234, lpBuffer=0x2751e24*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2751e24*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.154] CloseHandle (hObject=0x234) returned 1
	[0083.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png", lpFilePart=0x0) returned 0x7e
	[0083.155] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png")) returned 1
	[0083.158] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA7XCQ3[1].png", cAlternateFileName="AA7XCQ~1.PNG")) returned 1
	[0083.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png", lpFilePart=0x0) returned 0x7e
	[0083.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.160] GetFileType (hFile=0x234) returned 0x1
	[0083.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.161] GetFileType (hFile=0x234) returned 0x1
	[0083.161] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x27b
	[0083.161] ReadFile (in: hFile=0x234, lpBuffer=0x2753978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2753978*, lpNumberOfBytesRead=0x26eb64*=0x27b, lpOverlapped=0x0) returned 1
	[0083.168] CloseHandle (hObject=0x234) returned 1
	[0083.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.169] GetFileType (hFile=0x234) returned 0x1
	[0083.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.170] GetFileType (hFile=0x234) returned 0x1
	[0083.170] WriteFile (in: hFile=0x234, lpBuffer=0x2756164*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2756164*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.173] CloseHandle (hObject=0x234) returned 1
	[0083.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png", lpFilePart=0x0) returned 0x7e
	[0083.174] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png")) returned 1
	[0083.177] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA8Tave[1].png", cAlternateFileName="AA8TAV~1.PNG")) returned 1
	[0083.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png", lpFilePart=0x0) returned 0x7e
	[0083.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.178] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.179] GetFileType (hFile=0x234) returned 0x1
	[0083.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.179] GetFileType (hFile=0x234) returned 0x1
	[0083.180] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x268
	[0083.180] ReadFile (in: hFile=0x234, lpBuffer=0x2757ca4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2757ca4*, lpNumberOfBytesRead=0x26eb64*=0x268, lpOverlapped=0x0) returned 1
	[0083.187] CloseHandle (hObject=0x234) returned 1
	[0083.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.189] GetFileType (hFile=0x234) returned 0x1
	[0083.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.189] GetFileType (hFile=0x234) returned 0x1
	[0083.190] WriteFile (in: hFile=0x234, lpBuffer=0x275a490*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x275a490*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.193] CloseHandle (hObject=0x234) returned 1
	[0083.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png", lpFilePart=0x0) returned 0x7e
	[0083.193] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png")) returned 1
	[0083.197] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAfOIDq[1].png", cAlternateFileName="AAFOID~1.PNG")) returned 1
	[0083.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png", lpFilePart=0x0) returned 0x7e
	[0083.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.199] GetFileType (hFile=0x234) returned 0x1
	[0083.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.199] GetFileType (hFile=0x234) returned 0x1
	[0083.199] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x21e
	[0083.199] ReadFile (in: hFile=0x234, lpBuffer=0x275bf88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x275bf88*, lpNumberOfBytesRead=0x26eb64*=0x21e, lpOverlapped=0x0) returned 1
	[0083.204] CloseHandle (hObject=0x234) returned 1
	[0083.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.205] GetFileType (hFile=0x234) returned 0x1
	[0083.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.206] GetFileType (hFile=0x234) returned 0x1
	[0083.206] WriteFile (in: hFile=0x234, lpBuffer=0x275e774*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x275e774*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.209] CloseHandle (hObject=0x234) returned 1
	[0083.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png", lpFilePart=0x0) returned 0x7e
	[0083.210] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png")) returned 1
	[0083.213] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAkhMz9[2].png", cAlternateFileName="AAKHMZ~2.PNG")) returned 1
	[0083.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png", lpFilePart=0x0) returned 0x7e
	[0083.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.214] GetFileType (hFile=0x234) returned 0x1
	[0083.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.214] GetFileType (hFile=0x234) returned 0x1
	[0083.214] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2e3
	[0083.215] ReadFile (in: hFile=0x234, lpBuffer=0x2760330, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2760330*, lpNumberOfBytesRead=0x26eb64*=0x2e3, lpOverlapped=0x0) returned 1
	[0083.219] CloseHandle (hObject=0x234) returned 1
	[0083.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.221] GetFileType (hFile=0x234) returned 0x1
	[0083.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.221] GetFileType (hFile=0x234) returned 0x1
	[0083.222] WriteFile (in: hFile=0x234, lpBuffer=0x2762b1c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2762b1c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.225] CloseHandle (hObject=0x234) returned 1
	[0083.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png", lpFilePart=0x0) returned 0x7e
	[0083.226] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png")) returned 1
	[0083.230] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAmRY2Q[1].png", cAlternateFileName="AAMRY2~1.PNG")) returned 1
	[0083.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png", lpFilePart=0x0) returned 0x7e
	[0083.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.231] GetFileType (hFile=0x234) returned 0x1
	[0083.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.231] GetFileType (hFile=0x234) returned 0x1
	[0083.232] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x12c
	[0083.232] ReadFile (in: hFile=0x234, lpBuffer=0x2764520, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2764520*, lpNumberOfBytesRead=0x26eb64*=0x12c, lpOverlapped=0x0) returned 1
	[0083.239] CloseHandle (hObject=0x234) returned 1
	[0083.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.240] GetFileType (hFile=0x234) returned 0x1
	[0083.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.240] GetFileType (hFile=0x234) returned 0x1
	[0083.241] WriteFile (in: hFile=0x234, lpBuffer=0x2766d0c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2766d0c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.248] CloseHandle (hObject=0x234) returned 1
	[0083.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png", lpFilePart=0x0) returned 0x7e
	[0083.250] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png")) returned 1
	[0083.254] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAni8qk[1].png", cAlternateFileName="AANI8Q~1.PNG")) returned 1
	[0083.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png", lpFilePart=0x0) returned 0x7e
	[0083.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.255] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.255] GetFileType (hFile=0x234) returned 0x1
	[0083.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.255] GetFileType (hFile=0x234) returned 0x1
	[0083.255] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x391
	[0083.256] ReadFile (in: hFile=0x234, lpBuffer=0x2768978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2768978*, lpNumberOfBytesRead=0x26eb64*=0x391, lpOverlapped=0x0) returned 1
	[0083.269] CloseHandle (hObject=0x234) returned 1
	[0083.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.279] GetFileType (hFile=0x234) returned 0x1
	[0083.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.279] GetFileType (hFile=0x234) returned 0x1
	[0083.280] WriteFile (in: hFile=0x234, lpBuffer=0x276b164*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x276b164*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.283] CloseHandle (hObject=0x234) returned 1
	[0083.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png", lpFilePart=0x0) returned 0x7e
	[0083.284] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png")) returned 1
	[0083.288] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf1239b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf1239b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf1239b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7a52, dwReserved0=0x0, dwReserved1=0x0, cFileName="adition[1].js", cAlternateFileName="ADITIO~1.JS")) returned 1
	[0083.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js", lpFilePart=0x0) returned 0x7d
	[0083.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.289] GetFileType (hFile=0x234) returned 0x1
	[0083.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.289] GetFileType (hFile=0x234) returned 0x1
	[0083.289] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7a52
	[0083.290] ReadFile (in: hFile=0x234, lpBuffer=0x276ca14, nNumberOfBytesToRead=0x7a52, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x276ca14*, lpNumberOfBytesRead=0x26eb64*=0x7a52, lpOverlapped=0x0) returned 1
	[0083.296] CloseHandle (hObject=0x234) returned 1
	[0083.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js.KEKW", lpFilePart=0x0) returned 0x82
	[0083.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.297] GetFileType (hFile=0x234) returned 0x1
	[0083.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.297] GetFileType (hFile=0x234) returned 0x1
	[0083.298] WriteFile (in: hFile=0x234, lpBuffer=0x2775c54*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2775c54*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.301] CloseHandle (hObject=0x234) returned 1
	[0083.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js", lpFilePart=0x0) returned 0x7d
	[0083.301] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js")) returned 1
	[0083.306] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c4a830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="async_usersync[1].htm", cAlternateFileName="ASYNC_~1.HTM")) returned 1
	[0083.306] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bb22b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bb22b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bfe570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5feb, dwReserved0=0x0, dwReserved1=0x0, cFileName="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", cAlternateFileName="B367C0~1.JPG")) returned 1
	[0083.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", lpFilePart=0x0) returned 0x9b
	[0083.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.307] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.308] GetFileType (hFile=0x234) returned 0x1
	[0083.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.308] GetFileType (hFile=0x234) returned 0x1
	[0083.308] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x5feb
	[0083.308] ReadFile (in: hFile=0x234, lpBuffer=0x2777d54, nNumberOfBytesToRead=0x5feb, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2777d54*, lpNumberOfBytesRead=0x26eb64*=0x5feb, lpOverlapped=0x0) returned 1
	[0083.314] CloseHandle (hObject=0x234) returned 1
	[0083.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.KEKW", lpFilePart=0x0) returned 0xa0
	[0083.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.315] GetFileType (hFile=0x234) returned 0x1
	[0083.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.315] GetFileType (hFile=0x234) returned 0x1
	[0083.316] WriteFile (in: hFile=0x234, lpBuffer=0x277f5e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x277f5e0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.319] CloseHandle (hObject=0x234) returned 1
	[0083.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", lpFilePart=0x0) returned 0x9b
	[0083.320] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg")) returned 1
	[0083.325] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB8jcOr[2].png", cAlternateFileName="BB8JCO~2.PNG")) returned 1
	[0083.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png", lpFilePart=0x0) returned 0x7e
	[0083.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.326] GetFileType (hFile=0x234) returned 0x1
	[0083.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.327] GetFileType (hFile=0x234) returned 0x1
	[0083.327] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1aa
	[0083.327] ReadFile (in: hFile=0x234, lpBuffer=0x278109c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x278109c*, lpNumberOfBytesRead=0x26eb64*=0x1aa, lpOverlapped=0x0) returned 1
	[0083.332] CloseHandle (hObject=0x234) returned 1
	[0083.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.333] GetFileType (hFile=0x234) returned 0x1
	[0083.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.334] GetFileType (hFile=0x234) returned 0x1
	[0083.334] WriteFile (in: hFile=0x234, lpBuffer=0x2783888*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2783888*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.337] CloseHandle (hObject=0x234) returned 1
	[0083.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png", lpFilePart=0x0) returned 0x7e
	[0083.338] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png")) returned 1
	[0083.341] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBB8ZbM[1].jpg", cAlternateFileName="BBB8ZB~1.JPG")) returned 1
	[0083.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.343] GetFileType (hFile=0x234) returned 0x1
	[0083.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.343] GetFileType (hFile=0x234) returned 0x1
	[0083.343] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1c22
	[0083.343] ReadFile (in: hFile=0x234, lpBuffer=0x2785154, nNumberOfBytesToRead=0x1c22, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2785154*, lpNumberOfBytesRead=0x26eb64*=0x1c22, lpOverlapped=0x0) returned 1
	[0083.347] CloseHandle (hObject=0x234) returned 1
	[0083.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0083.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.349] GetFileType (hFile=0x234) returned 0x1
	[0083.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.349] GetFileType (hFile=0x234) returned 0x1
	[0083.349] WriteFile (in: hFile=0x234, lpBuffer=0x2788564*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2788564*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.356] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg")) returned 1
	[0083.359] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBB9wH0[1].png", cAlternateFileName="BBB9WH~1.PNG")) returned 1
	[0083.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png", lpFilePart=0x0) returned 0x7e
	[0083.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.360] GetFileType (hFile=0x234) returned 0x1
	[0083.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.361] GetFileType (hFile=0x234) returned 0x1
	[0083.361] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x234
	[0083.361] ReadFile (in: hFile=0x234, lpBuffer=0x278a070, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x278a070*, lpNumberOfBytesRead=0x26eb64*=0x234, lpOverlapped=0x0) returned 1
	[0083.365] CloseHandle (hObject=0x234) returned 1
	[0083.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.367] GetFileType (hFile=0x234) returned 0x1
	[0083.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.367] GetFileType (hFile=0x234) returned 0x1
	[0083.367] WriteFile (in: hFile=0x234, lpBuffer=0x278c85c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x278c85c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png", lpFilePart=0x0) returned 0x7e
	[0083.371] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png")) returned 1
	[0083.374] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x642446e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x642446e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBCFjo[1].jpg", cAlternateFileName="BBBCFJ~1.JPG")) returned 1
	[0083.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.375] GetFileType (hFile=0x234) returned 0x1
	[0083.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.375] GetFileType (hFile=0x234) returned 0x1
	[0083.375] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2ac7
	[0083.376] ReadFile (in: hFile=0x234, lpBuffer=0x278e128, nNumberOfBytesToRead=0x2ac7, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x278e128*, lpNumberOfBytesRead=0x26eb64*=0x2ac7, lpOverlapped=0x0) returned 1
	[0083.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0083.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.390] GetFileType (hFile=0x234) returned 0x1
	[0083.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.390] GetFileType (hFile=0x234) returned 0x1
	[0083.391] WriteFile (in: hFile=0x234, lpBuffer=0x27923dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27923dc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.394] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg")) returned 1
	[0083.397] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBDtcM[1].jpg", cAlternateFileName="BBBDTC~1.JPG")) returned 1
	[0083.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.400] GetFileType (hFile=0x234) returned 0x1
	[0083.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.400] GetFileType (hFile=0x234) returned 0x1
	[0083.404] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7c9
	[0083.404] ReadFile (in: hFile=0x234, lpBuffer=0x2794480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2794480*, lpNumberOfBytesRead=0x26eb64*=0x7c9, lpOverlapped=0x0) returned 1
	[0083.409] CloseHandle (hObject=0x234) returned 1
	[0083.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0083.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.409] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.410] GetFileType (hFile=0x234) returned 0x1
	[0083.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.411] GetFileType (hFile=0x234) returned 0x1
	[0083.411] WriteFile (in: hFile=0x234, lpBuffer=0x2796c6c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2796c6c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.414] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg")) returned 1
	[0083.446] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f19, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBIeNJ[1].jpg", cAlternateFileName="BBBIEN~1.JPG")) returned 1
	[0083.447] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.453] GetFileType (hFile=0x234) returned 0x1
	[0083.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.453] GetFileType (hFile=0x234) returned 0x1
	[0083.453] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1f19
	[0083.454] ReadFile (in: hFile=0x234, lpBuffer=0x2798538, nNumberOfBytesToRead=0x1f19, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2798538*, lpNumberOfBytesRead=0x26eb64*=0x1f19, lpOverlapped=0x0) returned 1
	[0083.460] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0083.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.462] GetFileType (hFile=0x234) returned 0x1
	[0083.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.462] GetFileType (hFile=0x234) returned 0x1
	[0083.462] WriteFile (in: hFile=0x234, lpBuffer=0x279bc40*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x279bc40*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.465] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg")) returned 1
	[0083.469] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53598a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBImKX[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 1
	[0083.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.472] GetFileType (hFile=0x234) returned 0x1
	[0083.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.472] GetFileType (hFile=0x234) returned 0x1
	[0083.473] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x711
	[0083.473] ReadFile (in: hFile=0x234, lpBuffer=0x279dc2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x279dc2c*, lpNumberOfBytesRead=0x26eb64*=0x711, lpOverlapped=0x0) returned 1
	[0083.534] CloseHandle (hObject=0x234) returned 1
	[0083.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0083.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.535] GetFileType (hFile=0x234) returned 0x1
	[0083.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.536] GetFileType (hFile=0x234) returned 0x1
	[0083.536] WriteFile (in: hFile=0x234, lpBuffer=0x27a0418*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27a0418*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.539] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg")) returned 1
	[0083.543] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2569, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBL4R9[1].jpg", cAlternateFileName="BBBL4R~1.JPG")) returned 1
	[0083.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.572] GetFileType (hFile=0x234) returned 0x1
	[0083.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.573] GetFileType (hFile=0x234) returned 0x1
	[0083.573] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2569
	[0083.591] ReadFile (in: hFile=0x234, lpBuffer=0x27a1ce4, nNumberOfBytesToRead=0x2569, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27a1ce4*, lpNumberOfBytesRead=0x26eb64*=0x2569, lpOverlapped=0x0) returned 1
	[0083.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0083.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.610] GetFileType (hFile=0x234) returned 0x1
	[0083.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.610] GetFileType (hFile=0x234) returned 0x1
	[0083.611] WriteFile (in: hFile=0x234, lpBuffer=0x27a5a3c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27a5a3c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.613] CloseHandle (hObject=0x234) returned 1
	[0083.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.614] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg")) returned 1
	[0083.617] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBLhTZ[1].jpg", cAlternateFileName="BBBLHT~1.JPG")) returned 1
	[0083.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.621] GetFileType (hFile=0x234) returned 0x1
	[0083.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.621] GetFileType (hFile=0x234) returned 0x1
	[0083.622] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x30d2
	[0083.622] ReadFile (in: hFile=0x234, lpBuffer=0x27a7308, nNumberOfBytesToRead=0x30d2, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27a7308*, lpNumberOfBytesRead=0x26eb64*=0x30d2, lpOverlapped=0x0) returned 1
	[0083.629] CloseHandle (hObject=0x234) returned 1
	[0083.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0083.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.631] GetFileType (hFile=0x234) returned 0x1
	[0083.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.632] GetFileType (hFile=0x234) returned 0x1
	[0083.633] WriteFile (in: hFile=0x234, lpBuffer=0x27abbc8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27abbc8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.643] CloseHandle (hObject=0x234) returned 1
	[0083.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.644] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg")) returned 1
	[0083.648] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBnhZY[1].jpg", cAlternateFileName="BBBNHZ~1.JPG")) returned 1
	[0083.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.654] GetFileType (hFile=0x234) returned 0x1
	[0083.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.654] GetFileType (hFile=0x234) returned 0x1
	[0083.654] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x9b9
	[0083.655] ReadFile (in: hFile=0x234, lpBuffer=0x27ade5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27ade5c*, lpNumberOfBytesRead=0x26eb64*=0x9b9, lpOverlapped=0x0) returned 1
	[0083.661] CloseHandle (hObject=0x234) returned 1
	[0083.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0083.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.663] GetFileType (hFile=0x234) returned 0x1
	[0083.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.664] GetFileType (hFile=0x234) returned 0x1
	[0083.664] WriteFile (in: hFile=0x234, lpBuffer=0x27b0648*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27b0648*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.669] CloseHandle (hObject=0x234) returned 1
	[0083.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.670] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg")) returned 1
	[0083.674] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671dfee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x671dfee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x67206040, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPhAr[1].jpg", cAlternateFileName="BBBPHA~1.JPG")) returned 1
	[0083.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.677] GetFileType (hFile=0x234) returned 0x1
	[0083.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.678] GetFileType (hFile=0x234) returned 0x1
	[0083.678] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x48f4
	[0083.678] ReadFile (in: hFile=0x234, lpBuffer=0x27b1f14, nNumberOfBytesToRead=0x48f4, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27b1f14*, lpNumberOfBytesRead=0x26eb64*=0x48f4, lpOverlapped=0x0) returned 1
	[0083.683] CloseHandle (hObject=0x234) returned 1
	[0083.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0083.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.684] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.684] GetFileType (hFile=0x234) returned 0x1
	[0083.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.685] GetFileType (hFile=0x234) returned 0x1
	[0083.685] WriteFile (in: hFile=0x234, lpBuffer=0x27b7ff4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27b7ff4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.689] CloseHandle (hObject=0x234) returned 1
	[0083.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.689] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg")) returned 1
	[0083.694] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c21, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPiby[1].jpg", cAlternateFileName="BBBPIB~1.JPG")) returned 1
	[0083.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.696] GetFileType (hFile=0x234) returned 0x1
	[0083.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.696] GetFileType (hFile=0x234) returned 0x1
	[0083.696] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1c21
	[0083.696] ReadFile (in: hFile=0x234, lpBuffer=0x27b98c0, nNumberOfBytesToRead=0x1c21, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27b98c0*, lpNumberOfBytesRead=0x26eb64*=0x1c21, lpOverlapped=0x0) returned 1
	[0083.701] CloseHandle (hObject=0x234) returned 1
	[0083.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0083.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.703] GetFileType (hFile=0x234) returned 0x1
	[0083.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.703] GetFileType (hFile=0x234) returned 0x1
	[0083.704] WriteFile (in: hFile=0x234, lpBuffer=0x27bccd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27bccd0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.707] CloseHandle (hObject=0x234) returned 1
	[0083.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.708] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg")) returned 1
	[0083.711] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPmXJ[1].jpg", cAlternateFileName="BBBPMX~1.JPG")) returned 1
	[0083.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.712] GetFileType (hFile=0x234) returned 0x1
	[0083.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.713] GetFileType (hFile=0x234) returned 0x1
	[0083.713] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x16bf
	[0083.713] ReadFile (in: hFile=0x234, lpBuffer=0x27be59c, nNumberOfBytesToRead=0x16bf, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27be59c*, lpNumberOfBytesRead=0x26eb64*=0x16bf, lpOverlapped=0x0) returned 1
	[0083.718] CloseHandle (hObject=0x234) returned 1
	[0083.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0083.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.719] GetFileType (hFile=0x234) returned 0x1
	[0083.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.719] GetFileType (hFile=0x234) returned 0x1
	[0083.720] WriteFile (in: hFile=0x234, lpBuffer=0x27c1448*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27c1448*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.723] CloseHandle (hObject=0x234) returned 1
	[0083.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.724] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg")) returned 1
	[0083.727] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21feb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPS37[1].png", cAlternateFileName="BBBPS3~1.PNG")) returned 1
	[0083.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png", lpFilePart=0x0) returned 0x7e
	[0083.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.729] GetFileType (hFile=0x234) returned 0x1
	[0083.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.729] GetFileType (hFile=0x234) returned 0x1
	[0083.729] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x21feb
	[0083.730] ReadFile (in: hFile=0x234, lpBuffer=0x36f6fc8, nNumberOfBytesToRead=0x21feb, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x36f6fc8*, lpNumberOfBytesRead=0x26eb64*=0x21feb, lpOverlapped=0x0) returned 1
	[0083.746] CloseHandle (hObject=0x234) returned 1
	[0083.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0083.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.750] GetFileType (hFile=0x234) returned 0x1
	[0083.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.750] GetFileType (hFile=0x234) returned 0x1
	[0083.751] WriteFile (in: hFile=0x234, lpBuffer=0x27c44f4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27c44f4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.754] CloseHandle (hObject=0x234) returned 1
	[0083.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png", lpFilePart=0x0) returned 0x7e
	[0083.754] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png")) returned 1
	[0083.760] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBQiBF[1].jpg", cAlternateFileName="BBBQIB~1.JPG")) returned 1
	[0083.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.762] GetFileType (hFile=0x234) returned 0x1
	[0083.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.762] GetFileType (hFile=0x234) returned 0x1
	[0083.762] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x12f9
	[0083.762] ReadFile (in: hFile=0x234, lpBuffer=0x27c5dc0, nNumberOfBytesToRead=0x12f9, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27c5dc0*, lpNumberOfBytesRead=0x26eb64*=0x12f9, lpOverlapped=0x0) returned 1
	[0083.776] CloseHandle (hObject=0x234) returned 1
	[0083.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0083.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0083.777] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.777] GetFileType (hFile=0x234) returned 0x1
	[0083.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0083.778] GetFileType (hFile=0x234) returned 0x1
	[0083.778] WriteFile (in: hFile=0x234, lpBuffer=0x27c88a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27c88a8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0083.781] CloseHandle (hObject=0x234) returned 1
	[0083.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.781] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg")) returned 1
	[0083.784] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBty8h[1].jpg", cAlternateFileName="BBBTY8~1.JPG")) returned 1
	[0083.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg", lpFilePart=0x0) returned 0x7e
	[0083.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0083.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0083.786] GetFileType (hFile=0x234) returned 0x1
	[0083.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0083.786] GetFileType (hFile=0x234) returned 0x1
	[0083.786] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x9a9
	[0083.786] ReadFile (in: hFile=0x234, lpBuffer=0x27cab2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27cab2c*, lpNumberOfBytesRead=0x26eb64*=0x9a9, lpOverlapped=0x0) returned 1
	[0084.097] CloseHandle (hObject=0x234) returned 1
	[0084.097] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.098] GetFileType (hFile=0x234) returned 0x1
	[0084.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.098] GetFileType (hFile=0x234) returned 0x1
	[0084.099] WriteFile (in: hFile=0x234, lpBuffer=0x27cd318*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27cd318*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.102] CloseHandle (hObject=0x234) returned 1
	[0084.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.102] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg")) returned 1
	[0084.105] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVACL[1].jpg", cAlternateFileName="BBBVAC~1.JPG")) returned 1
	[0084.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.108] GetFileType (hFile=0x234) returned 0x1
	[0084.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.108] GetFileType (hFile=0x234) returned 0x1
	[0084.108] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1b08
	[0084.109] ReadFile (in: hFile=0x234, lpBuffer=0x27cebe4, nNumberOfBytesToRead=0x1b08, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27cebe4*, lpNumberOfBytesRead=0x26eb64*=0x1b08, lpOverlapped=0x0) returned 1
	[0084.113] CloseHandle (hObject=0x234) returned 1
	[0084.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.114] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.114] GetFileType (hFile=0x234) returned 0x1
	[0084.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.114] GetFileType (hFile=0x234) returned 0x1
	[0084.115] WriteFile (in: hFile=0x234, lpBuffer=0x27d1ed8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27d1ed8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.118] CloseHandle (hObject=0x234) returned 1
	[0084.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.118] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg")) returned 1
	[0084.121] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e29b2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e29b2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e29b2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c41, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVGyR[1].jpg", cAlternateFileName="BBBVGY~1.JPG")) returned 1
	[0084.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.122] GetFileType (hFile=0x234) returned 0x1
	[0084.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.122] GetFileType (hFile=0x234) returned 0x1
	[0084.123] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1c41
	[0084.123] ReadFile (in: hFile=0x234, lpBuffer=0x27d37a4, nNumberOfBytesToRead=0x1c41, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27d37a4*, lpNumberOfBytesRead=0x26eb64*=0x1c41, lpOverlapped=0x0) returned 1
	[0084.128] CloseHandle (hObject=0x234) returned 1
	[0084.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.129] GetFileType (hFile=0x234) returned 0x1
	[0084.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.129] GetFileType (hFile=0x234) returned 0x1
	[0084.130] WriteFile (in: hFile=0x234, lpBuffer=0x27d6bd4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27d6bd4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.133] CloseHandle (hObject=0x234) returned 1
	[0084.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.133] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg")) returned 1
	[0084.173] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVMtX[1].jpg", cAlternateFileName="BBBVMT~1.JPG")) returned 1
	[0084.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.193] GetFileType (hFile=0x234) returned 0x1
	[0084.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.194] GetFileType (hFile=0x234) returned 0x1
	[0084.194] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x950
	[0084.194] ReadFile (in: hFile=0x234, lpBuffer=0x27d8dfc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27d8dfc*, lpNumberOfBytesRead=0x26eb64*=0x950, lpOverlapped=0x0) returned 1
	[0084.199] CloseHandle (hObject=0x234) returned 1
	[0084.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.200] GetFileType (hFile=0x234) returned 0x1
	[0084.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.200] GetFileType (hFile=0x234) returned 0x1
	[0084.201] WriteFile (in: hFile=0x234, lpBuffer=0x27db5e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27db5e8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.204] CloseHandle (hObject=0x234) returned 1
	[0084.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.204] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg")) returned 1
	[0084.208] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVYsu[1].jpg", cAlternateFileName="BBBVYS~1.JPG")) returned 1
	[0084.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.210] GetFileType (hFile=0x234) returned 0x1
	[0084.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.210] GetFileType (hFile=0x234) returned 0x1
	[0084.211] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1bba
	[0084.211] ReadFile (in: hFile=0x234, lpBuffer=0x27dceb4, nNumberOfBytesToRead=0x1bba, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27dceb4*, lpNumberOfBytesRead=0x26eb64*=0x1bba, lpOverlapped=0x0) returned 1
	[0084.216] CloseHandle (hObject=0x234) returned 1
	[0084.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.217] GetFileType (hFile=0x234) returned 0x1
	[0084.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.218] GetFileType (hFile=0x234) returned 0x1
	[0084.218] WriteFile (in: hFile=0x234, lpBuffer=0x27e025c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27e025c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.221] CloseHandle (hObject=0x234) returned 1
	[0084.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.221] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg")) returned 1
	[0084.225] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5154fff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5154fff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51576150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x76a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBWLtW[1].jpg", cAlternateFileName="BBBWLT~1.JPG")) returned 1
	[0084.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.226] GetFileType (hFile=0x234) returned 0x1
	[0084.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.226] GetFileType (hFile=0x234) returned 0x1
	[0084.226] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x76a
	[0084.239] ReadFile (in: hFile=0x234, lpBuffer=0x25e2db4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25e2db4*, lpNumberOfBytesRead=0x26eb64*=0x76a, lpOverlapped=0x0) returned 1
	[0084.243] CloseHandle (hObject=0x234) returned 1
	[0084.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.245] GetFileType (hFile=0x234) returned 0x1
	[0084.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.245] GetFileType (hFile=0x234) returned 0x1
	[0084.246] WriteFile (in: hFile=0x234, lpBuffer=0x25e561c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25e561c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.249] CloseHandle (hObject=0x234) returned 1
	[0084.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.250] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg")) returned 1
	[0084.253] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBX3xB[1].jpg", cAlternateFileName="BBBX3X~1.JPG")) returned 1
	[0084.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.255] GetFileType (hFile=0x234) returned 0x1
	[0084.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.256] GetFileType (hFile=0x234) returned 0x1
	[0084.256] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x95f
	[0084.256] ReadFile (in: hFile=0x234, lpBuffer=0x25e7854, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25e7854*, lpNumberOfBytesRead=0x26eb64*=0x95f, lpOverlapped=0x0) returned 1
	[0084.261] CloseHandle (hObject=0x234) returned 1
	[0084.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.262] GetFileType (hFile=0x234) returned 0x1
	[0084.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.262] GetFileType (hFile=0x234) returned 0x1
	[0084.262] WriteFile (in: hFile=0x234, lpBuffer=0x25ea040*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25ea040*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.266] CloseHandle (hObject=0x234) returned 1
	[0084.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.266] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg")) returned 1
	[0084.269] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533112f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533112f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533112f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBY98e[1].jpg", cAlternateFileName="BBBY98~1.JPG")) returned 1
	[0084.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.275] GetFileType (hFile=0x234) returned 0x1
	[0084.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.275] GetFileType (hFile=0x234) returned 0x1
	[0084.275] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x241e
	[0084.276] ReadFile (in: hFile=0x234, lpBuffer=0x25eb90c, nNumberOfBytesToRead=0x241e, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25eb90c*, lpNumberOfBytesRead=0x26eb64*=0x241e, lpOverlapped=0x0) returned 1
	[0084.280] CloseHandle (hObject=0x234) returned 1
	[0084.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.281] GetFileType (hFile=0x234) returned 0x1
	[0084.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.282] GetFileType (hFile=0x234) returned 0x1
	[0084.282] WriteFile (in: hFile=0x234, lpBuffer=0x25ef518*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25ef518*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.285] CloseHandle (hObject=0x234) returned 1
	[0084.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.286] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg")) returned 1
	[0084.289] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBZYVP[1].jpg", cAlternateFileName="BBBZYV~1.JPG")) returned 1
	[0084.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.291] GetFileType (hFile=0x234) returned 0x1
	[0084.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.291] GetFileType (hFile=0x234) returned 0x1
	[0084.291] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x938
	[0084.291] ReadFile (in: hFile=0x234, lpBuffer=0x25f1728, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25f1728*, lpNumberOfBytesRead=0x26eb64*=0x938, lpOverlapped=0x0) returned 1
	[0084.299] CloseHandle (hObject=0x234) returned 1
	[0084.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.300] GetFileType (hFile=0x234) returned 0x1
	[0084.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.301] GetFileType (hFile=0x234) returned 0x1
	[0084.301] WriteFile (in: hFile=0x234, lpBuffer=0x25f3f14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25f3f14*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.304] CloseHandle (hObject=0x234) returned 1
	[0084.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.305] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg")) returned 1
	[0084.308] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 1
	[0084.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.309] GetFileType (hFile=0x234) returned 0x1
	[0084.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.309] GetFileType (hFile=0x234) returned 0x1
	[0084.309] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x192a
	[0084.310] ReadFile (in: hFile=0x234, lpBuffer=0x25f57e0, nNumberOfBytesToRead=0x192a, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25f57e0*, lpNumberOfBytesRead=0x26eb64*=0x192a, lpOverlapped=0x0) returned 1
	[0084.316] CloseHandle (hObject=0x234) returned 1
	[0084.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.317] GetFileType (hFile=0x234) returned 0x1
	[0084.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.317] GetFileType (hFile=0x234) returned 0x1
	[0084.318] WriteFile (in: hFile=0x234, lpBuffer=0x25f88f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25f88f8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.321] CloseHandle (hObject=0x234) returned 1
	[0084.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.321] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg")) returned 1
	[0084.325] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC04ok[1].jpg", cAlternateFileName="BBC04O~2.JPG")) returned 1
	[0084.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.326] GetFileType (hFile=0x234) returned 0x1
	[0084.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.326] GetFileType (hFile=0x234) returned 0x1
	[0084.327] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x23fb
	[0084.327] ReadFile (in: hFile=0x234, lpBuffer=0x25fa1c4, nNumberOfBytesToRead=0x23fb, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25fa1c4*, lpNumberOfBytesRead=0x26eb64*=0x23fb, lpOverlapped=0x0) returned 1
	[0084.332] CloseHandle (hObject=0x234) returned 1
	[0084.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.333] GetFileType (hFile=0x234) returned 0x1
	[0084.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.333] GetFileType (hFile=0x234) returned 0x1
	[0084.334] WriteFile (in: hFile=0x234, lpBuffer=0x25fddac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25fddac*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.337] CloseHandle (hObject=0x234) returned 1
	[0084.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.337] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg")) returned 1
	[0084.340] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539e9230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a99, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC04we[1].jpg", cAlternateFileName="BBC04W~1.JPG")) returned 1
	[0084.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.342] GetFileType (hFile=0x234) returned 0x1
	[0084.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.342] GetFileType (hFile=0x234) returned 0x1
	[0084.342] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2a99
	[0084.343] ReadFile (in: hFile=0x234, lpBuffer=0x25ff678, nNumberOfBytesToRead=0x2a99, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25ff678*, lpNumberOfBytesRead=0x26eb64*=0x2a99, lpOverlapped=0x0) returned 1
	[0084.347] CloseHandle (hObject=0x234) returned 1
	[0084.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.348] GetFileType (hFile=0x234) returned 0x1
	[0084.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.349] GetFileType (hFile=0x234) returned 0x1
	[0084.349] WriteFile (in: hFile=0x234, lpBuffer=0x2603900*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2603900*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.353] CloseHandle (hObject=0x234) returned 1
	[0084.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.353] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg")) returned 1
	[0084.357] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e02430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e02430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC05rl[1].jpg", cAlternateFileName="BBC05R~1.JPG")) returned 1
	[0084.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.358] GetFileType (hFile=0x234) returned 0x1
	[0084.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.358] GetFileType (hFile=0x234) returned 0x1
	[0084.358] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3200
	[0084.358] ReadFile (in: hFile=0x234, lpBuffer=0x26051cc, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26051cc*, lpNumberOfBytesRead=0x26eb64*=0x3200, lpOverlapped=0x0) returned 1
	[0084.368] CloseHandle (hObject=0x234) returned 1
	[0084.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.370] GetFileType (hFile=0x234) returned 0x1
	[0084.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.370] GetFileType (hFile=0x234) returned 0x1
	[0084.371] WriteFile (in: hFile=0x234, lpBuffer=0x2609bb8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2609bb8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.375] CloseHandle (hObject=0x234) returned 1
	[0084.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.375] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg")) returned 1
	[0084.379] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC05rl[2].jpg", cAlternateFileName="BBC05R~2.JPG")) returned 1
	[0084.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg", lpFilePart=0x0) returned 0x7e
	[0084.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.382] GetFileType (hFile=0x234) returned 0x1
	[0084.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.382] GetFileType (hFile=0x234) returned 0x1
	[0084.382] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7e1
	[0084.383] ReadFile (in: hFile=0x234, lpBuffer=0x260bc74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x260bc74*, lpNumberOfBytesRead=0x26eb64*=0x7e1, lpOverlapped=0x0) returned 1
	[0084.388] CloseHandle (hObject=0x234) returned 1
	[0084.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.389] GetFileType (hFile=0x234) returned 0x1
	[0084.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.389] GetFileType (hFile=0x234) returned 0x1
	[0084.390] WriteFile (in: hFile=0x234, lpBuffer=0x260e460*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x260e460*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.395] CloseHandle (hObject=0x234) returned 1
	[0084.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg", lpFilePart=0x0) returned 0x7e
	[0084.396] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg")) returned 1
	[0084.400] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0ATj[1].jpg", cAlternateFileName="BBC0AT~1.JPG")) returned 1
	[0084.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.403] GetFileType (hFile=0x234) returned 0x1
	[0084.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.403] GetFileType (hFile=0x234) returned 0x1
	[0084.403] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1b4e
	[0084.403] ReadFile (in: hFile=0x234, lpBuffer=0x260fd2c, nNumberOfBytesToRead=0x1b4e, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x260fd2c*, lpNumberOfBytesRead=0x26eb64*=0x1b4e, lpOverlapped=0x0) returned 1
	[0084.408] CloseHandle (hObject=0x234) returned 1
	[0084.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.409] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.409] GetFileType (hFile=0x234) returned 0x1
	[0084.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.410] GetFileType (hFile=0x234) returned 0x1
	[0084.410] WriteFile (in: hFile=0x234, lpBuffer=0x2613068*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2613068*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.414] CloseHandle (hObject=0x234) returned 1
	[0084.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.414] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg")) returned 1
	[0084.675] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x751, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0D8i[1].jpg", cAlternateFileName="BBC0D8~1.JPG")) returned 1
	[0084.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.676] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.676] GetFileType (hFile=0x234) returned 0x1
	[0084.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.677] GetFileType (hFile=0x234) returned 0x1
	[0084.677] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x751
	[0084.677] ReadFile (in: hFile=0x234, lpBuffer=0x2615094, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2615094*, lpNumberOfBytesRead=0x26eb64*=0x751, lpOverlapped=0x0) returned 1
	[0084.681] CloseHandle (hObject=0x234) returned 1
	[0084.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.683] GetFileType (hFile=0x234) returned 0x1
	[0084.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.683] GetFileType (hFile=0x234) returned 0x1
	[0084.683] WriteFile (in: hFile=0x234, lpBuffer=0x2617880*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2617880*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.686] CloseHandle (hObject=0x234) returned 1
	[0084.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.687] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg")) returned 1
	[0084.690] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 1
	[0084.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.691] GetFileType (hFile=0x234) returned 0x1
	[0084.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.692] GetFileType (hFile=0x234) returned 0x1
	[0084.692] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x200e
	[0084.692] ReadFile (in: hFile=0x234, lpBuffer=0x261914c, nNumberOfBytesToRead=0x200e, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x261914c*, lpNumberOfBytesRead=0x26eb64*=0x200e, lpOverlapped=0x0) returned 1
	[0084.697] CloseHandle (hObject=0x234) returned 1
	[0084.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.698] GetFileType (hFile=0x234) returned 0x1
	[0084.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.698] GetFileType (hFile=0x234) returned 0x1
	[0084.699] WriteFile (in: hFile=0x234, lpBuffer=0x261c948*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x261c948*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.702] CloseHandle (hObject=0x234) returned 1
	[0084.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.702] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg")) returned 1
	[0084.705] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0w1b[1].jpg", cAlternateFileName="BBC0W1~1.JPG")) returned 1
	[0084.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.708] GetFileType (hFile=0x234) returned 0x1
	[0084.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.708] GetFileType (hFile=0x234) returned 0x1
	[0084.708] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1dcb
	[0084.708] ReadFile (in: hFile=0x234, lpBuffer=0x261e214, nNumberOfBytesToRead=0x1dcb, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x261e214*, lpNumberOfBytesRead=0x26eb64*=0x1dcb, lpOverlapped=0x0) returned 1
	[0084.713] CloseHandle (hObject=0x234) returned 1
	[0084.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.714] GetFileType (hFile=0x234) returned 0x1
	[0084.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.714] GetFileType (hFile=0x234) returned 0x1
	[0084.714] WriteFile (in: hFile=0x234, lpBuffer=0x26217cc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26217cc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.717] CloseHandle (hObject=0x234) returned 1
	[0084.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.718] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg")) returned 1
	[0084.721] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0xLt[1].jpg", cAlternateFileName="BBC0XL~1.JPG")) returned 1
	[0084.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.723] GetFileType (hFile=0x234) returned 0x1
	[0084.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.723] GetFileType (hFile=0x234) returned 0x1
	[0084.723] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x23ba
	[0084.723] ReadFile (in: hFile=0x234, lpBuffer=0x2623098, nNumberOfBytesToRead=0x23ba, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2623098*, lpNumberOfBytesRead=0x26eb64*=0x23ba, lpOverlapped=0x0) returned 1
	[0084.729] CloseHandle (hObject=0x234) returned 1
	[0084.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.730] GetFileType (hFile=0x234) returned 0x1
	[0084.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.730] GetFileType (hFile=0x234) returned 0x1
	[0084.730] WriteFile (in: hFile=0x234, lpBuffer=0x2626c40*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2626c40*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.733] CloseHandle (hObject=0x234) returned 1
	[0084.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.734] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg")) returned 1
	[0084.737] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDWA22[1].jpg", cAlternateFileName="BBDWA2~1.JPG")) returned 1
	[0084.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.738] GetFileType (hFile=0x234) returned 0x1
	[0084.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.739] GetFileType (hFile=0x234) returned 0x1
	[0084.739] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xb58
	[0084.739] ReadFile (in: hFile=0x234, lpBuffer=0x2629070, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2629070*, lpNumberOfBytesRead=0x26eb64*=0xb58, lpOverlapped=0x0) returned 1
	[0084.745] CloseHandle (hObject=0x234) returned 1
	[0084.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.746] GetFileType (hFile=0x234) returned 0x1
	[0084.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.747] GetFileType (hFile=0x234) returned 0x1
	[0084.747] WriteFile (in: hFile=0x234, lpBuffer=0x262b85c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x262b85c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.751] CloseHandle (hObject=0x234) returned 1
	[0084.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.752] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg")) returned 1
	[0084.755] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE7d3b[1].jpg", cAlternateFileName="BBE7D3~1.JPG")) returned 1
	[0084.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.758] GetFileType (hFile=0x234) returned 0x1
	[0084.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.759] GetFileType (hFile=0x234) returned 0x1
	[0084.759] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x91d
	[0084.759] ReadFile (in: hFile=0x234, lpBuffer=0x262da54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x262da54*, lpNumberOfBytesRead=0x26eb64*=0x91d, lpOverlapped=0x0) returned 1
	[0084.764] CloseHandle (hObject=0x234) returned 1
	[0084.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.765] GetFileType (hFile=0x234) returned 0x1
	[0084.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.765] GetFileType (hFile=0x234) returned 0x1
	[0084.766] WriteFile (in: hFile=0x234, lpBuffer=0x2630240*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2630240*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.768] CloseHandle (hObject=0x234) returned 1
	[0084.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.769] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg")) returned 1
	[0084.772] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45583010, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45583010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455a9170, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2850, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE85ld[1].jpg", cAlternateFileName="BBE85L~1.JPG")) returned 1
	[0084.772] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.773] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.773] GetFileType (hFile=0x234) returned 0x1
	[0084.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.773] GetFileType (hFile=0x234) returned 0x1
	[0084.774] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2850
	[0084.774] ReadFile (in: hFile=0x234, lpBuffer=0x2631b0c, nNumberOfBytesToRead=0x2850, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2631b0c*, lpNumberOfBytesRead=0x26eb64*=0x2850, lpOverlapped=0x0) returned 1
	[0084.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.781] GetFileType (hFile=0x234) returned 0x1
	[0084.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.781] GetFileType (hFile=0x234) returned 0x1
	[0084.782] WriteFile (in: hFile=0x234, lpBuffer=0x2635b48*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2635b48*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.786] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg")) returned 1
	[0084.790] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x16ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdckp[1].jpg", cAlternateFileName="BBEDCK~1.JPG")) returned 1
	[0084.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.791] GetFileType (hFile=0x234) returned 0x1
	[0084.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.791] GetFileType (hFile=0x234) returned 0x1
	[0084.792] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x16ca
	[0084.792] ReadFile (in: hFile=0x234, lpBuffer=0x2637414, nNumberOfBytesToRead=0x16ca, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2637414*, lpNumberOfBytesRead=0x26eb64*=0x16ca, lpOverlapped=0x0) returned 1
	[0084.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.797] GetFileType (hFile=0x234) returned 0x1
	[0084.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.797] GetFileType (hFile=0x234) returned 0x1
	[0084.798] WriteFile (in: hFile=0x234, lpBuffer=0x263a2cc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x263a2cc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.801] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg")) returned 1
	[0084.804] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdMci[1].jpg", cAlternateFileName="BBEDMC~1.JPG")) returned 1
	[0084.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.815] GetFileType (hFile=0x234) returned 0x1
	[0084.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.816] GetFileType (hFile=0x234) returned 0x1
	[0084.816] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xafe
	[0084.816] ReadFile (in: hFile=0x234, lpBuffer=0x263c6a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x263c6a4*, lpNumberOfBytesRead=0x26eb64*=0xafe, lpOverlapped=0x0) returned 1
	[0084.824] CloseHandle (hObject=0x234) returned 1
	[0084.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.825] GetFileType (hFile=0x234) returned 0x1
	[0084.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.825] GetFileType (hFile=0x234) returned 0x1
	[0084.826] WriteFile (in: hFile=0x234, lpBuffer=0x263ee90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x263ee90*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.830] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg")) returned 1
	[0084.833] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdSLV[1].jpg", cAlternateFileName="BBEDSL~1.JPG")) returned 1
	[0084.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.834] GetFileType (hFile=0x234) returned 0x1
	[0084.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.834] GetFileType (hFile=0x234) returned 0x1
	[0084.834] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2a48
	[0084.835] ReadFile (in: hFile=0x234, lpBuffer=0x264075c, nNumberOfBytesToRead=0x2a48, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x264075c*, lpNumberOfBytesRead=0x26eb64*=0x2a48, lpOverlapped=0x0) returned 1
	[0084.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.841] GetFileType (hFile=0x234) returned 0x1
	[0084.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.842] GetFileType (hFile=0x234) returned 0x1
	[0084.842] WriteFile (in: hFile=0x234, lpBuffer=0x2644990*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2644990*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.845] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg")) returned 1
	[0084.849] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEe2Pd[1].jpg", cAlternateFileName="BBEE2P~1.JPG")) returned 1
	[0084.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.852] GetFileType (hFile=0x234) returned 0x1
	[0084.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.852] GetFileType (hFile=0x234) returned 0x1
	[0084.852] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x87f
	[0084.852] ReadFile (in: hFile=0x234, lpBuffer=0x2646ae8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2646ae8*, lpNumberOfBytesRead=0x26eb64*=0x87f, lpOverlapped=0x0) returned 1
	[0084.857] CloseHandle (hObject=0x234) returned 1
	[0084.857] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.858] GetFileType (hFile=0x234) returned 0x1
	[0084.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.858] GetFileType (hFile=0x234) returned 0x1
	[0084.859] WriteFile (in: hFile=0x234, lpBuffer=0x26492d4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26492d4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.870] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg")) returned 1
	[0084.873] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3faf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEe4Oo[1].png", cAlternateFileName="BBEE4O~1.PNG")) returned 1
	[0084.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png", lpFilePart=0x0) returned 0x7e
	[0084.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.897] GetFileType (hFile=0x234) returned 0x1
	[0084.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.897] GetFileType (hFile=0x234) returned 0x1
	[0084.897] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3faf
	[0084.897] ReadFile (in: hFile=0x234, lpBuffer=0x264aba0, nNumberOfBytesToRead=0x3faf, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x264aba0*, lpNumberOfBytesRead=0x26eb64*=0x3faf, lpOverlapped=0x0) returned 1
	[0084.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0084.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.904] GetFileType (hFile=0x234) returned 0x1
	[0084.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.904] GetFileType (hFile=0x234) returned 0x1
	[0084.905] WriteFile (in: hFile=0x234, lpBuffer=0x265033c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x265033c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png", lpFilePart=0x0) returned 0x7e
	[0084.908] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png")) returned 1
	[0084.912] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEe6Ew[1].jpg", cAlternateFileName="BBEE6E~1.JPG")) returned 1
	[0084.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.917] GetFileType (hFile=0x234) returned 0x1
	[0084.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.917] GetFileType (hFile=0x234) returned 0x1
	[0084.918] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xaa9
	[0084.918] ReadFile (in: hFile=0x234, lpBuffer=0x26526c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26526c0*, lpNumberOfBytesRead=0x26eb64*=0xaa9, lpOverlapped=0x0) returned 1
	[0084.922] CloseHandle (hObject=0x234) returned 1
	[0084.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.923] GetFileType (hFile=0x234) returned 0x1
	[0084.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.924] GetFileType (hFile=0x234) returned 0x1
	[0084.924] WriteFile (in: hFile=0x234, lpBuffer=0x2654eac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2654eac*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.927] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.927] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg")) returned 1
	[0084.931] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeFp3[1].jpg", cAlternateFileName="BBEEFP~1.JPG")) returned 1
	[0084.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.932] GetFileType (hFile=0x234) returned 0x1
	[0084.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.933] GetFileType (hFile=0x234) returned 0x1
	[0084.933] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1d26
	[0084.933] ReadFile (in: hFile=0x234, lpBuffer=0x2656778, nNumberOfBytesToRead=0x1d26, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2656778*, lpNumberOfBytesRead=0x26eb64*=0x1d26, lpOverlapped=0x0) returned 1
	[0084.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.938] GetFileType (hFile=0x234) returned 0x1
	[0084.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.939] GetFileType (hFile=0x234) returned 0x1
	[0084.939] WriteFile (in: hFile=0x234, lpBuffer=0x2659c8c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2659c8c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.942] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg")) returned 1
	[0084.945] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe3bfdf0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe3bfdf0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe3bfdf0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeGwU[1].jpg", cAlternateFileName="BBEEGW~1.JPG")) returned 1
	[0084.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.946] GetFileType (hFile=0x234) returned 0x1
	[0084.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.946] GetFileType (hFile=0x234) returned 0x1
	[0084.946] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x780
	[0084.946] ReadFile (in: hFile=0x234, lpBuffer=0x265bce4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x265bce4*, lpNumberOfBytesRead=0x26eb64*=0x780, lpOverlapped=0x0) returned 1
	[0084.952] CloseHandle (hObject=0x234) returned 1
	[0084.952] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.953] GetFileType (hFile=0x234) returned 0x1
	[0084.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.953] GetFileType (hFile=0x234) returned 0x1
	[0084.953] WriteFile (in: hFile=0x234, lpBuffer=0x265e4d0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x265e4d0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.957] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg")) returned 1
	[0084.960] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7be, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeUg0[1].jpg", cAlternateFileName="BBEEUG~1.JPG")) returned 1
	[0084.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.961] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.961] GetFileType (hFile=0x234) returned 0x1
	[0084.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.962] GetFileType (hFile=0x234) returned 0x1
	[0084.962] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7be
	[0084.962] ReadFile (in: hFile=0x234, lpBuffer=0x2660568, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2660568*, lpNumberOfBytesRead=0x26eb64*=0x7be, lpOverlapped=0x0) returned 1
	[0084.966] CloseHandle (hObject=0x234) returned 1
	[0084.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.968] GetFileType (hFile=0x234) returned 0x1
	[0084.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.968] GetFileType (hFile=0x234) returned 0x1
	[0084.968] WriteFile (in: hFile=0x234, lpBuffer=0x2662d54*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2662d54*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.971] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg")) returned 1
	[0084.974] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeZnr[1].jpg", cAlternateFileName="BBEEZN~1.JPG")) returned 1
	[0084.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.975] GetFileType (hFile=0x234) returned 0x1
	[0084.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.975] GetFileType (hFile=0x234) returned 0x1
	[0084.976] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3a2a
	[0084.977] ReadFile (in: hFile=0x234, lpBuffer=0x2664620, nNumberOfBytesToRead=0x3a2a, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2664620*, lpNumberOfBytesRead=0x26eb64*=0x3a2a, lpOverlapped=0x0) returned 1
	[0084.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.982] GetFileType (hFile=0x234) returned 0x1
	[0084.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.982] GetFileType (hFile=0x234) returned 0x1
	[0084.983] WriteFile (in: hFile=0x234, lpBuffer=0x2669838*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2669838*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0084.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.986] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg")) returned 1
	[0084.989] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEf5Lq[1].jpg", cAlternateFileName="BBEF5L~1.JPG")) returned 1
	[0084.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg", lpFilePart=0x0) returned 0x7e
	[0084.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0084.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.990] GetFileType (hFile=0x234) returned 0x1
	[0084.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0084.990] GetFileType (hFile=0x234) returned 0x1
	[0084.990] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2f76
	[0084.991] ReadFile (in: hFile=0x234, lpBuffer=0x266b104, nNumberOfBytesToRead=0x2f76, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x266b104*, lpNumberOfBytesRead=0x26eb64*=0x2f76, lpOverlapped=0x0) returned 1
	[0084.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0084.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0084.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0084.996] GetFileType (hFile=0x234) returned 0x1
	[0084.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0084.996] GetFileType (hFile=0x234) returned 0x1
	[0084.997] WriteFile (in: hFile=0x234, lpBuffer=0x266f868*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x266f868*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.000] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg")) returned 1
	[0085.004] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 1
	[0085.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.007] GetFileType (hFile=0x234) returned 0x1
	[0085.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.007] GetFileType (hFile=0x234) returned 0x1
	[0085.007] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x786
	[0085.007] ReadFile (in: hFile=0x234, lpBuffer=0x26718c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26718c8*, lpNumberOfBytesRead=0x26eb64*=0x786, lpOverlapped=0x0) returned 1
	[0085.012] CloseHandle (hObject=0x234) returned 1
	[0085.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.013] GetFileType (hFile=0x234) returned 0x1
	[0085.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.013] GetFileType (hFile=0x234) returned 0x1
	[0085.014] WriteFile (in: hFile=0x234, lpBuffer=0x26740b4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26740b4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.017] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg")) returned 1
	[0085.020] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfzSd[1].jpg", cAlternateFileName="BBEFZS~1.JPG")) returned 1
	[0085.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.023] GetFileType (hFile=0x234) returned 0x1
	[0085.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.023] GetFileType (hFile=0x234) returned 0x1
	[0085.024] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xa07
	[0085.024] ReadFile (in: hFile=0x234, lpBuffer=0x2676394, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2676394*, lpNumberOfBytesRead=0x26eb64*=0xa07, lpOverlapped=0x0) returned 1
	[0085.028] CloseHandle (hObject=0x234) returned 1
	[0085.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.029] GetFileType (hFile=0x234) returned 0x1
	[0085.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.030] GetFileType (hFile=0x234) returned 0x1
	[0085.030] WriteFile (in: hFile=0x234, lpBuffer=0x2678b80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2678b80*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.033] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg")) returned 1
	[0085.036] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgCuQ[1].jpg", cAlternateFileName="BBEGCU~1.JPG")) returned 1
	[0085.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.039] GetFileType (hFile=0x234) returned 0x1
	[0085.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.040] GetFileType (hFile=0x234) returned 0x1
	[0085.040] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1998
	[0085.040] ReadFile (in: hFile=0x234, lpBuffer=0x267a44c, nNumberOfBytesToRead=0x1998, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x267a44c*, lpNumberOfBytesRead=0x26eb64*=0x1998, lpOverlapped=0x0) returned 1
	[0085.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.045] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.046] GetFileType (hFile=0x234) returned 0x1
	[0085.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.046] GetFileType (hFile=0x234) returned 0x1
	[0085.046] WriteFile (in: hFile=0x234, lpBuffer=0x267d5d0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x267d5d0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.049] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg")) returned 1
	[0085.053] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a65, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgHzB[1].jpg", cAlternateFileName="BBEGHZ~1.JPG")) returned 1
	[0085.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.054] GetFileType (hFile=0x234) returned 0x1
	[0085.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.054] GetFileType (hFile=0x234) returned 0x1
	[0085.054] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1a65
	[0085.055] ReadFile (in: hFile=0x234, lpBuffer=0x267ee9c, nNumberOfBytesToRead=0x1a65, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x267ee9c*, lpNumberOfBytesRead=0x26eb64*=0x1a65, lpOverlapped=0x0) returned 1
	[0085.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.061] GetFileType (hFile=0x234) returned 0x1
	[0085.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.061] GetFileType (hFile=0x234) returned 0x1
	[0085.062] WriteFile (in: hFile=0x234, lpBuffer=0x26820f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26820f0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.065] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg")) returned 1
	[0085.068] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdeb0f30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5a45, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgIl2[1].jpg", cAlternateFileName="BBEGIL~1.JPG")) returned 1
	[0085.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.070] GetFileType (hFile=0x234) returned 0x1
	[0085.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.070] GetFileType (hFile=0x234) returned 0x1
	[0085.070] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x5a45
	[0085.070] ReadFile (in: hFile=0x234, lpBuffer=0x26839bc, nNumberOfBytesToRead=0x5a45, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26839bc*, lpNumberOfBytesRead=0x26eb64*=0x5a45, lpOverlapped=0x0) returned 1
	[0085.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.077] GetFileType (hFile=0x234) returned 0x1
	[0085.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.077] GetFileType (hFile=0x234) returned 0x1
	[0085.078] WriteFile (in: hFile=0x234, lpBuffer=0x268abf0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x268abf0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.081] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg")) returned 1
	[0085.084] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x388f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgIl2[2].jpg", cAlternateFileName="BBEGIL~2.JPG")) returned 1
	[0085.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg", lpFilePart=0x0) returned 0x7e
	[0085.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.086] GetFileType (hFile=0x234) returned 0x1
	[0085.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.086] GetFileType (hFile=0x234) returned 0x1
	[0085.086] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x388f
	[0085.086] ReadFile (in: hFile=0x234, lpBuffer=0x268c4bc, nNumberOfBytesToRead=0x388f, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x268c4bc*, lpNumberOfBytesRead=0x26eb64*=0x388f, lpOverlapped=0x0) returned 1
	[0085.091] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.092] GetFileType (hFile=0x234) returned 0x1
	[0085.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.092] GetFileType (hFile=0x234) returned 0x1
	[0085.093] WriteFile (in: hFile=0x234, lpBuffer=0x2691538*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2691538*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.097] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg", lpFilePart=0x0) returned 0x7e
	[0085.097] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg")) returned 1
	[0085.100] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1e97, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgIyL[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 1
	[0085.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.102] GetFileType (hFile=0x234) returned 0x1
	[0085.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.103] GetFileType (hFile=0x234) returned 0x1
	[0085.103] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1e97
	[0085.103] ReadFile (in: hFile=0x234, lpBuffer=0x2692e04, nNumberOfBytesToRead=0x1e97, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2692e04*, lpNumberOfBytesRead=0x26eb64*=0x1e97, lpOverlapped=0x0) returned 1
	[0085.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.108] GetFileType (hFile=0x234) returned 0x1
	[0085.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.109] GetFileType (hFile=0x234) returned 0x1
	[0085.109] WriteFile (in: hFile=0x234, lpBuffer=0x2696488*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2696488*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.113] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg")) returned 1
	[0085.116] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgkY6[1].jpg", cAlternateFileName="BBEGKY~1.JPG")) returned 1
	[0085.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.138] GetFileType (hFile=0x234) returned 0x1
	[0085.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.138] GetFileType (hFile=0x234) returned 0x1
	[0085.138] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x23bf
	[0085.138] ReadFile (in: hFile=0x234, lpBuffer=0x2697d54, nNumberOfBytesToRead=0x23bf, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2697d54*, lpNumberOfBytesRead=0x26eb64*=0x23bf, lpOverlapped=0x0) returned 1
	[0085.143] CloseHandle (hObject=0x234) returned 1
	[0085.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.145] GetFileType (hFile=0x234) returned 0x1
	[0085.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.145] GetFileType (hFile=0x234) returned 0x1
	[0085.145] WriteFile (in: hFile=0x234, lpBuffer=0x269b900*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x269b900*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.149] CloseHandle (hObject=0x234) returned 1
	[0085.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.149] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg")) returned 1
	[0085.152] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8df, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgLzV[1].jpg", cAlternateFileName="BBEGLZ~1.JPG")) returned 1
	[0085.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.154] GetFileType (hFile=0x234) returned 0x1
	[0085.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.154] GetFileType (hFile=0x234) returned 0x1
	[0085.154] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x8df
	[0085.154] ReadFile (in: hFile=0x234, lpBuffer=0x269dab8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x269dab8*, lpNumberOfBytesRead=0x26eb64*=0x8df, lpOverlapped=0x0) returned 1
	[0085.159] CloseHandle (hObject=0x234) returned 1
	[0085.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.160] GetFileType (hFile=0x234) returned 0x1
	[0085.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.161] GetFileType (hFile=0x234) returned 0x1
	[0085.161] WriteFile (in: hFile=0x234, lpBuffer=0x26a02a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26a02a4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.164] CloseHandle (hObject=0x234) returned 1
	[0085.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.164] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg")) returned 1
	[0085.168] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgUri[1].jpg", cAlternateFileName="BBEGUR~1.JPG")) returned 1
	[0085.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.170] GetFileType (hFile=0x234) returned 0x1
	[0085.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.170] GetFileType (hFile=0x234) returned 0x1
	[0085.170] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2b8d
	[0085.171] ReadFile (in: hFile=0x234, lpBuffer=0x26a1b70, nNumberOfBytesToRead=0x2b8d, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26a1b70*, lpNumberOfBytesRead=0x26eb64*=0x2b8d, lpOverlapped=0x0) returned 1
	[0085.175] CloseHandle (hObject=0x234) returned 1
	[0085.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.177] GetFileType (hFile=0x234) returned 0x1
	[0085.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.177] GetFileType (hFile=0x234) returned 0x1
	[0085.177] WriteFile (in: hFile=0x234, lpBuffer=0x26a5eec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26a5eec*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.181] CloseHandle (hObject=0x234) returned 1
	[0085.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.181] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg")) returned 1
	[0085.185] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgXBv[1].jpg", cAlternateFileName="BBEGXB~1.JPG")) returned 1
	[0085.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.186] GetFileType (hFile=0x234) returned 0x1
	[0085.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.187] GetFileType (hFile=0x234) returned 0x1
	[0085.187] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x201f
	[0085.187] ReadFile (in: hFile=0x234, lpBuffer=0x26a77b8, nNumberOfBytesToRead=0x201f, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26a77b8*, lpNumberOfBytesRead=0x26eb64*=0x201f, lpOverlapped=0x0) returned 1
	[0085.192] CloseHandle (hObject=0x234) returned 1
	[0085.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.193] GetFileType (hFile=0x234) returned 0x1
	[0085.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.193] GetFileType (hFile=0x234) returned 0x1
	[0085.194] WriteFile (in: hFile=0x234, lpBuffer=0x26aafc4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26aafc4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.197] CloseHandle (hObject=0x234) returned 1
	[0085.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.198] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg")) returned 1
	[0085.202] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgZME[1].jpg", cAlternateFileName="BBEGZM~1.JPG")) returned 1
	[0085.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.215] GetFileType (hFile=0x234) returned 0x1
	[0085.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.215] GetFileType (hFile=0x234) returned 0x1
	[0085.215] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x6e9
	[0085.216] ReadFile (in: hFile=0x234, lpBuffer=0x26acf88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26acf88*, lpNumberOfBytesRead=0x26eb64*=0x6e9, lpOverlapped=0x0) returned 1
	[0085.220] CloseHandle (hObject=0x234) returned 1
	[0085.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.222] GetFileType (hFile=0x234) returned 0x1
	[0085.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.222] GetFileType (hFile=0x234) returned 0x1
	[0085.222] WriteFile (in: hFile=0x234, lpBuffer=0x26af774*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26af774*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.225] CloseHandle (hObject=0x234) returned 1
	[0085.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.226] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg")) returned 1
	[0085.230] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBghfVy[1].png", cAlternateFileName="BBGHFV~1.PNG")) returned 1
	[0085.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png", lpFilePart=0x0) returned 0x7e
	[0085.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.231] GetFileType (hFile=0x234) returned 0x1
	[0085.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.231] GetFileType (hFile=0x234) returned 0x1
	[0085.231] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1dc
	[0085.231] ReadFile (in: hFile=0x234, lpBuffer=0x26b1228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26b1228*, lpNumberOfBytesRead=0x26eb64*=0x1dc, lpOverlapped=0x0) returned 1
	[0085.237] CloseHandle (hObject=0x234) returned 1
	[0085.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0085.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.238] GetFileType (hFile=0x234) returned 0x1
	[0085.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.239] GetFileType (hFile=0x234) returned 0x1
	[0085.239] WriteFile (in: hFile=0x234, lpBuffer=0x26b3a14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26b3a14*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.242] CloseHandle (hObject=0x234) returned 1
	[0085.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png", lpFilePart=0x0) returned 0x7e
	[0085.242] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png")) returned 1
	[0085.245] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBkwUr[1].png", cAlternateFileName="BBKWUR~1.PNG")) returned 1
	[0085.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png", lpFilePart=0x0) returned 0x7d
	[0085.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.246] GetFileType (hFile=0x234) returned 0x1
	[0085.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.247] GetFileType (hFile=0x234) returned 0x1
	[0085.247] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1af
	[0085.247] ReadFile (in: hFile=0x234, lpBuffer=0x26b5484, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26b5484*, lpNumberOfBytesRead=0x26eb64*=0x1af, lpOverlapped=0x0) returned 1
	[0085.252] CloseHandle (hObject=0x234) returned 1
	[0085.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png.KEKW", lpFilePart=0x0) returned 0x82
	[0085.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.253] GetFileType (hFile=0x234) returned 0x1
	[0085.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.253] GetFileType (hFile=0x234) returned 0x1
	[0085.254] WriteFile (in: hFile=0x234, lpBuffer=0x26b7c70*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26b7c70*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.258] CloseHandle (hObject=0x234) returned 1
	[0085.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png", lpFilePart=0x0) returned 0x7d
	[0085.258] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png")) returned 1
	[0085.261] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBlBV0U[1].png", cAlternateFileName="BBLBV0~1.PNG")) returned 1
	[0085.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png", lpFilePart=0x0) returned 0x7e
	[0085.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.263] GetFileType (hFile=0x234) returned 0x1
	[0085.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.263] GetFileType (hFile=0x234) returned 0x1
	[0085.263] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x23b
	[0085.264] ReadFile (in: hFile=0x234, lpBuffer=0x26b9780, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26b9780*, lpNumberOfBytesRead=0x26eb64*=0x23b, lpOverlapped=0x0) returned 1
	[0085.268] CloseHandle (hObject=0x234) returned 1
	[0085.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0085.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.270] GetFileType (hFile=0x234) returned 0x1
	[0085.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.270] GetFileType (hFile=0x234) returned 0x1
	[0085.270] WriteFile (in: hFile=0x234, lpBuffer=0x26bbf6c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26bbf6c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.276] CloseHandle (hObject=0x234) returned 1
	[0085.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png", lpFilePart=0x0) returned 0x7e
	[0085.276] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png")) returned 1
	[0085.280] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3376, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBzhWWE[1].jpg", cAlternateFileName="BBZHWW~1.JPG")) returned 1
	[0085.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.281] GetFileType (hFile=0x234) returned 0x1
	[0085.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.281] GetFileType (hFile=0x234) returned 0x1
	[0085.281] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3376
	[0085.282] ReadFile (in: hFile=0x234, lpBuffer=0x26bd838, nNumberOfBytesToRead=0x3376, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26bd838*, lpNumberOfBytesRead=0x26eb64*=0x3376, lpOverlapped=0x0) returned 1
	[0085.287] CloseHandle (hObject=0x234) returned 1
	[0085.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0085.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.287] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.288] GetFileType (hFile=0x234) returned 0x1
	[0085.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.288] GetFileType (hFile=0x234) returned 0x1
	[0085.289] WriteFile (in: hFile=0x234, lpBuffer=0x26c239c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26c239c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.294] CloseHandle (hObject=0x234) returned 1
	[0085.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg", lpFilePart=0x0) returned 0x7e
	[0085.295] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg")) returned 1
	[0085.298] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60baae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60baae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c433c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13c06, dwReserved0=0x0, dwReserved1=0x0, cFileName="benefits-2[1].jpg", cAlternateFileName="BENEFI~2.JPG")) returned 1
	[0085.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg", lpFilePart=0x0) returned 0x81
	[0085.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.301] GetFileType (hFile=0x234) returned 0x1
	[0085.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.301] GetFileType (hFile=0x234) returned 0x1
	[0085.301] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x13c06
	[0085.301] ReadFile (in: hFile=0x234, lpBuffer=0x26c3c90, nNumberOfBytesToRead=0x13c06, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26c3c90*, lpNumberOfBytesRead=0x26eb64*=0x13c06, lpOverlapped=0x0) returned 1
	[0085.307] CloseHandle (hObject=0x234) returned 1
	[0085.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.KEKW", lpFilePart=0x0) returned 0x86
	[0085.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.309] GetFileType (hFile=0x234) returned 0x1
	[0085.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.309] GetFileType (hFile=0x234) returned 0x1
	[0085.310] WriteFile (in: hFile=0x234, lpBuffer=0x26d909c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26d909c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.313] CloseHandle (hObject=0x234) returned 1
	[0085.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg", lpFilePart=0x0) returned 0x81
	[0085.313] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg")) returned 1
	[0085.317] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b84ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b84ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c1d260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="benefits-4[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 1
	[0085.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", lpFilePart=0x0) returned 0x81
	[0085.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.318] GetFileType (hFile=0x234) returned 0x1
	[0085.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.318] GetFileType (hFile=0x234) returned 0x1
	[0085.318] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x144cd
	[0085.319] ReadFile (in: hFile=0x234, lpBuffer=0x26da994, nNumberOfBytesToRead=0x144cd, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26da994*, lpNumberOfBytesRead=0x26eb64*=0x144cd, lpOverlapped=0x0) returned 1
	[0085.325] CloseHandle (hObject=0x234) returned 1
	[0085.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.KEKW", lpFilePart=0x0) returned 0x86
	[0085.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.327] GetFileType (hFile=0x234) returned 0x1
	[0085.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.327] GetFileType (hFile=0x234) returned 0x1
	[0085.327] WriteFile (in: hFile=0x234, lpBuffer=0x26f0668*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26f0668*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.330] CloseHandle (hObject=0x234) returned 1
	[0085.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", lpFilePart=0x0) returned 0x81
	[0085.331] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg")) returned 1
	[0085.336] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4dbc10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4dbc10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4dbc10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6f15, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap[1].js", cAlternateFileName="BOOTST~1.JS")) returned 1
	[0085.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", lpFilePart=0x0) returned 0x7f
	[0085.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.338] GetFileType (hFile=0x234) returned 0x1
	[0085.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.339] GetFileType (hFile=0x234) returned 0x1
	[0085.339] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x6f15
	[0085.339] ReadFile (in: hFile=0x234, lpBuffer=0x26f1f3c, nNumberOfBytesToRead=0x6f15, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26f1f3c*, lpNumberOfBytesRead=0x26eb64*=0x6f15, lpOverlapped=0x0) returned 1
	[0085.345] CloseHandle (hObject=0x234) returned 1
	[0085.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js.KEKW", lpFilePart=0x0) returned 0x84
	[0085.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.346] GetFileType (hFile=0x234) returned 0x1
	[0085.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.346] GetFileType (hFile=0x234) returned 0x1
	[0085.347] WriteFile (in: hFile=0x234, lpBuffer=0x26fa64c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26fa64c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.350] CloseHandle (hObject=0x234) returned 1
	[0085.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js", lpFilePart=0x0) returned 0x7f
	[0085.351] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bootstrap[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bootstrap[1].js")) returned 1
	[0085.355] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x583e0320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x583e0320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x583e0320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="browser[1].htm", cAlternateFileName="BROWSE~1.HTM")) returned 1
	[0085.356] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b2b1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bs-jsdep[1].css", cAlternateFileName="BS-JSD~1.CSS")) returned 1
	[0085.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", lpFilePart=0x0) returned 0x7f
	[0085.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.368] GetFileType (hFile=0x234) returned 0x1
	[0085.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.368] GetFileType (hFile=0x234) returned 0x1
	[0085.369] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x4dd8
	[0085.369] ReadFile (in: hFile=0x234, lpBuffer=0x26fc540, nNumberOfBytesToRead=0x4dd8, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26fc540*, lpNumberOfBytesRead=0x26eb64*=0x4dd8, lpOverlapped=0x0) returned 1
	[0085.375] CloseHandle (hObject=0x234) returned 1
	[0085.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css.KEKW", lpFilePart=0x0) returned 0x84
	[0085.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.377] GetFileType (hFile=0x234) returned 0x1
	[0085.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.377] GetFileType (hFile=0x234) returned 0x1
	[0085.378] WriteFile (in: hFile=0x234, lpBuffer=0x2702b10*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2702b10*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.380] CloseHandle (hObject=0x234) returned 1
	[0085.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css", lpFilePart=0x0) returned 0x7f
	[0085.381] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\bs-jsdep[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bs-jsdep[1].css")) returned 1
	[0085.385] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61341460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61341460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x613675c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1
	[0085.385] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1
	[0085.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", lpFilePart=0x0) returned 0x7e
	[0085.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.387] GetFileType (hFile=0x234) returned 0x1
	[0085.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.387] GetFileType (hFile=0x234) returned 0x1
	[0085.387] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2b
	[0085.388] ReadFile (in: hFile=0x234, lpBuffer=0x2704a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2704a78*, lpNumberOfBytesRead=0x26eb64*=0x2b, lpOverlapped=0x0) returned 1
	[0085.393] CloseHandle (hObject=0x234) returned 1
	[0085.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif.KEKW", lpFilePart=0x0) returned 0x83
	[0085.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.394] GetFileType (hFile=0x234) returned 0x1
	[0085.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.394] GetFileType (hFile=0x234) returned 0x1
	[0085.395] WriteFile (in: hFile=0x234, lpBuffer=0x2707264*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2707264*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.399] CloseHandle (hObject=0x234) returned 1
	[0085.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif", lpFilePart=0x0) returned 0x7e
	[0085.399] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif")) returned 1
	[0085.403] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29349, dwReserved0=0x0, dwReserved1=0x0, cFileName="core[1].css", cAlternateFileName="CORE_1~1.CSS")) returned 1
	[0085.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css", lpFilePart=0x0) returned 0x7b
	[0085.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.405] GetFileType (hFile=0x234) returned 0x1
	[0085.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.406] GetFileType (hFile=0x234) returned 0x1
	[0085.406] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x29349
	[0085.408] ReadFile (in: hFile=0x234, lpBuffer=0x3718fd0, nNumberOfBytesToRead=0x29349, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x3718fd0*, lpNumberOfBytesRead=0x26eb64*=0x29349, lpOverlapped=0x0) returned 1
	[0085.453] CloseHandle (hObject=0x234) returned 1
	[0085.453] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css.KEKW", lpFilePart=0x0) returned 0x80
	[0085.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.455] GetFileType (hFile=0x234) returned 0x1
	[0085.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.455] GetFileType (hFile=0x234) returned 0x1
	[0085.456] WriteFile (in: hFile=0x234, lpBuffer=0x270a2cc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x270a2cc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.459] CloseHandle (hObject=0x234) returned 1
	[0085.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css", lpFilePart=0x0) returned 0x7b
	[0085.459] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\core[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\core[1].css")) returned 1
	[0085.466] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0085.466] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54ca7f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ca7f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54ca7f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DevCMDL2.2.18[1].eot", cAlternateFileName="DEVCMD~1.EOT")) returned 1
	[0085.467] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5120a1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5120a1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5120a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="e151e5[1].gif", cAlternateFileName="E151E5~1.GIF")) returned 1
	[0085.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif", lpFilePart=0x0) returned 0x7d
	[0085.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.468] GetFileType (hFile=0x234) returned 0x1
	[0085.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.469] GetFileType (hFile=0x234) returned 0x1
	[0085.469] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2b
	[0085.469] ReadFile (in: hFile=0x234, lpBuffer=0x270c808, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x270c808*, lpNumberOfBytesRead=0x26eb64*=0x2b, lpOverlapped=0x0) returned 1
	[0085.475] CloseHandle (hObject=0x234) returned 1
	[0085.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif.KEKW", lpFilePart=0x0) returned 0x82
	[0085.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.477] GetFileType (hFile=0x234) returned 0x1
	[0085.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.478] GetFileType (hFile=0x234) returned 0x1
	[0085.478] WriteFile (in: hFile=0x234, lpBuffer=0x270eff4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x270eff4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif", lpFilePart=0x0) returned 0x7d
	[0085.484] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif")) returned 1
	[0085.488] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5101afd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5101afd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5101afd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x0, dwReserved1=0x0, cFileName="e4-190963-91cdfbc1[1].txt", cAlternateFileName="E4-190~1.TXT")) returned 1
	[0085.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x89
	[0085.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.489] GetFileType (hFile=0x234) returned 0x1
	[0085.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.490] GetFileType (hFile=0x234) returned 0x1
	[0085.490] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x24e29
	[0085.493] ReadFile (in: hFile=0x234, lpBuffer=0x3742338, nNumberOfBytesToRead=0x24e29, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x3742338*, lpNumberOfBytesRead=0x26eb64*=0x24e29, lpOverlapped=0x0) returned 1
	[0085.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.KEKW", lpFilePart=0x0) returned 0x8e
	[0085.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.505] GetFileType (hFile=0x234) returned 0x1
	[0085.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.506] GetFileType (hFile=0x234) returned 0x1
	[0085.506] WriteFile (in: hFile=0x234, lpBuffer=0x271218c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x271218c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x89
	[0085.510] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt")) returned 1
	[0085.515] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b5eb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b5eb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f89200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula_text[1].htm", cAlternateFileName="EULA_T~1.HTM")) returned 1
	[0085.516] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="f[1].txt", cAlternateFileName="F_1_~1.TXT")) returned 1
	[0085.516] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", lpFilePart=0x0) returned 0x78
	[0085.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.519] GetFileType (hFile=0x234) returned 0x1
	[0085.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.519] GetFileType (hFile=0x234) returned 0x1
	[0085.520] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x34ce
	[0085.520] ReadFile (in: hFile=0x234, lpBuffer=0x2714040, nNumberOfBytesToRead=0x34ce, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2714040*, lpNumberOfBytesRead=0x26eb64*=0x34ce, lpOverlapped=0x0) returned 1
	[0085.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.KEKW", lpFilePart=0x0) returned 0x7d
	[0085.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.529] GetFileType (hFile=0x234) returned 0x1
	[0085.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.530] GetFileType (hFile=0x234) returned 0x1
	[0085.530] WriteFile (in: hFile=0x234, lpBuffer=0x2718cd8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2718cd8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", lpFilePart=0x0) returned 0x78
	[0085.534] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt")) returned 1
	[0085.539] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1254, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1
	[0085.539] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ef0c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ef0c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f16de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="google_plus_16dp[1].png", cAlternateFileName="GOOGLE~1.PNG")) returned 1
	[0085.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", lpFilePart=0x0) returned 0x87
	[0085.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.541] GetFileType (hFile=0x234) returned 0x1
	[0085.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.541] GetFileType (hFile=0x234) returned 0x1
	[0085.541] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x6a6
	[0085.542] ReadFile (in: hFile=0x234, lpBuffer=0x271ba44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x271ba44*, lpNumberOfBytesRead=0x26eb64*=0x6a6, lpOverlapped=0x0) returned 1
	[0085.546] CloseHandle (hObject=0x234) returned 1
	[0085.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.KEKW", lpFilePart=0x0) returned 0x8c
	[0085.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.551] GetFileType (hFile=0x234) returned 0x1
	[0085.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.552] GetFileType (hFile=0x234) returned 0x1
	[0085.552] WriteFile (in: hFile=0x234, lpBuffer=0x271e26c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x271e26c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", lpFilePart=0x0) returned 0x87
	[0085.556] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png")) returned 1
	[0085.560] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de2e5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5de2e5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5de54720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="index[1].htm", cAlternateFileName="INDEX_~1.HTM")) returned 1
	[0085.560] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa1af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54fa1af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54fa1af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="print[1].txt", cAlternateFileName="PRINT_~1.TXT")) returned 1
	[0085.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", lpFilePart=0x0) returned 0x7c
	[0085.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.561] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.561] GetFileType (hFile=0x234) returned 0x1
	[0085.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.562] GetFileType (hFile=0x234) returned 0x1
	[0085.562] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xa2
	[0085.562] ReadFile (in: hFile=0x234, lpBuffer=0x27201e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27201e0*, lpNumberOfBytesRead=0x26eb64*=0xa2, lpOverlapped=0x0) returned 1
	[0085.566] CloseHandle (hObject=0x234) returned 1
	[0085.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.KEKW", lpFilePart=0x0) returned 0x81
	[0085.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.567] GetFileType (hFile=0x234) returned 0x1
	[0085.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.568] GetFileType (hFile=0x234) returned 0x1
	[0085.568] WriteFile (in: hFile=0x234, lpBuffer=0x27229c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27229c0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", lpFilePart=0x0) returned 0x7c
	[0085.571] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt")) returned 1
	[0085.574] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44f697b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44f697b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44f8f910, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x15429, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard[1]", cAlternateFileName="STANDA~1")) returned 1
	[0085.575] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 1
	[0085.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", lpFilePart=0x0) returned 0x7f
	[0085.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.576] GetFileType (hFile=0x234) returned 0x1
	[0085.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.576] GetFileType (hFile=0x234) returned 0x1
	[0085.576] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x67
	[0085.576] ReadFile (in: hFile=0x234, lpBuffer=0x2724910, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2724910*, lpNumberOfBytesRead=0x26eb64*=0x67, lpOverlapped=0x0) returned 1
	[0085.581] CloseHandle (hObject=0x234) returned 1
	[0085.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.KEKW", lpFilePart=0x0) returned 0x84
	[0085.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.583] GetFileType (hFile=0x234) returned 0x1
	[0085.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.583] GetFileType (hFile=0x234) returned 0x1
	[0085.583] WriteFile (in: hFile=0x234, lpBuffer=0x2727108*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2727108*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", lpFilePart=0x0) returned 0x7f
	[0085.587] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png")) returned 1
	[0085.591] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x548efd10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x548efd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x548efd10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="uhf-main.var.min[1].js", cAlternateFileName="UHF-MA~1.JS")) returned 1
	[0085.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", lpFilePart=0x0) returned 0x86
	[0085.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.592] GetFileType (hFile=0x234) returned 0x1
	[0085.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.592] GetFileType (hFile=0x234) returned 0x1
	[0085.592] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x102ea
	[0085.592] ReadFile (in: hFile=0x234, lpBuffer=0x2728a74, nNumberOfBytesToRead=0x102ea, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2728a74*, lpNumberOfBytesRead=0x26eb64*=0x102ea, lpOverlapped=0x0) returned 1
	[0085.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js.KEKW", lpFilePart=0x0) returned 0x8b
	[0085.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.600] GetFileType (hFile=0x234) returned 0x1
	[0085.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.600] GetFileType (hFile=0x234) returned 0x1
	[0085.601] WriteFile (in: hFile=0x234, lpBuffer=0x273a57c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x273a57c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js", lpFilePart=0x0) returned 0x86
	[0085.604] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\uhf-main.var.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\uhf-main.var.min[1].js")) returned 1
	[0085.620] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2dd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1
	[0085.620] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d29, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2[2]", cAlternateFileName="V2_2_~1")) returned 1
	[0085.621] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe751ef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe751ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe751ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2[3]", cAlternateFileName="V2_3_~1")) returned 1
	[0085.621] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 1
	[0085.621] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0085.622] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0085.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0085.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0085.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Decrypt.txt", lpFilePart=0x0) returned 0x7b
	[0085.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0085.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0085.624] GetFileType (hFile=0x230) returned 0x1
	[0085.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0085.624] GetFileType (hFile=0x230) returned 0x1
	[0085.624] WriteFile (in: hFile=0x230, lpBuffer=0x273e4c0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x273e4c0*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0085.627] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0085.628] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IKQEEPZR", cAlternateFileName="")) returned 1
	[0085.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0085.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR", lpFilePart=0x0) returned 0x6f
	[0085.629] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpFilePart=0x0) returned 0x70
	[0085.629] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0085.636] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.641] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45027e90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa756, dwReserved0=0x0, dwReserved1=0x0, cFileName="19619569[1].gif", cAlternateFileName="196195~1.GIF")) returned 1
	[0085.642] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54962130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54962130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x549ae3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x461fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="7962161087[1].js", cAlternateFileName="796216~1.JS")) returned 1
	[0085.643] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA3DGHW[1].png", cAlternateFileName="AA3DGH~1.PNG")) returned 1
	[0085.643] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA3e1pt[2].png", cAlternateFileName="AA3E1P~2.PNG")) returned 1
	[0085.644] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA42ckd[1].png", cAlternateFileName="AA42CK~1.PNG")) returned 1
	[0085.645] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA42eYr[1].png", cAlternateFileName="AA42EY~1.PNG")) returned 1
	[0085.645] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA61ILp[2].png", cAlternateFileName="AA61IL~2.PNG")) returned 1
	[0085.646] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA6SNZ6[1].png", cAlternateFileName="AA6SNZ~1.PNG")) returned 1
	[0085.647] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAbyinC[1].png", cAlternateFileName="AABYIN~1.PNG")) returned 1
	[0085.648] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAicW5W[1].jpg", cAlternateFileName="AAICW5~1.JPG")) returned 1
	[0085.648] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538925d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538925d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAj0doQ[1].jpg", cAlternateFileName="AAJ0DO~1.JPG")) returned 1
	[0085.649] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAkqhIf[1].png", cAlternateFileName="AAKQHI~1.PNG")) returned 1
	[0085.649] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAmo09p[1].jpg", cAlternateFileName="AAMO09~1.JPG")) returned 1
	[0085.650] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAmUyV2[1].png", cAlternateFileName="AAMUYV~1.PNG")) returned 1
	[0085.650] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAn7gKR[1].png", cAlternateFileName="AAN7GK~1.PNG")) returned 1
	[0085.651] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61be2420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61be2420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61be2420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x650, dwReserved0=0x0, dwReserved1=0x0, cFileName="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1
	[0085.652] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2a0770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2a0770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x0, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1
	[0085.653] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adfserve[1]", cAlternateFileName="ADFSER~1")) returned 1
	[0085.653] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11835, dwReserved0=0x0, dwReserved1=0x0, cFileName="ast[2].js", cAlternateFileName="AST_2_~1.JS")) returned 1
	[0085.654] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53d7b330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53d7b330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53d7b330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1
	[0085.654] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5108d3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5108d3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="b2fd15[1].eot", cAlternateFileName="B2FD15~1.EOT")) returned 1
	[0085.655] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB5zDwX[1].png", cAlternateFileName="BB5ZDW~1.PNG")) returned 1
	[0085.656] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBaK3Nm[1].png", cAlternateFileName="BBAK3N~1.PNG")) returned 1
	[0085.656] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBLcCz[1].jpg", cAlternateFileName="BBBLCC~1.JPG")) returned 1
	[0085.657] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBLdzQ[1].jpg", cAlternateFileName="BBBLDZ~1.JPG")) returned 1
	[0085.657] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 1
	[0085.658] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO1qB[1].jpg", cAlternateFileName="BBBO1Q~1.JPG")) returned 1
	[0085.659] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOIAt[1].jpg", cAlternateFileName="BBBOIA~1.JPG")) returned 1
	[0085.659] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOmuh[1].jpg", cAlternateFileName="BBBOMU~1.JPG")) returned 1
	[0085.660] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPK5J[1].jpg", cAlternateFileName="BBBPK5~1.JPG")) returned 1
	[0085.660] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPMvJ[1].jpg", cAlternateFileName="BBBPMV~1.JPG")) returned 1
	[0085.664] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53a0f390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBUL3E[1].jpg", cAlternateFileName="BBBUL3~1.JPG")) returned 1
	[0085.665] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBUqkT[1].jpg", cAlternateFileName="BBBUQK~1.JPG")) returned 1
	[0085.665] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBUqkT[2].jpg", cAlternateFileName="BBBUQK~2.JPG")) returned 1
	[0085.666] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBX3z0[1].jpg", cAlternateFileName="BBBX3Z~1.JPG")) returned 1
	[0085.667] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBYEW1[1].jpg", cAlternateFileName="BBBYEW~1.JPG")) returned 1
	[0085.667] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 1
	[0085.668] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBZ20W[1].jpg", cAlternateFileName="BBBZ20~1.JPG")) returned 1
	[0085.668] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53950cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53950cb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBzaxY[1].jpg", cAlternateFileName="BBBZAX~1.JPG")) returned 1
	[0085.669] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBZzuz[1].jpg", cAlternateFileName="BBBZZU~1.JPG")) returned 1
	[0085.669] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 1
	[0085.670] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 1
	[0085.671] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53657130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53657130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC06ZQ[1].jpg", cAlternateFileName="BBC06Z~1.JPG")) returned 1
	[0085.672] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 1
	[0085.672] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0BiZ[1].jpg", cAlternateFileName="BBC0BI~1.JPG")) returned 1
	[0085.673] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0FXU[1].jpg", cAlternateFileName="BBC0FX~1.JPG")) returned 1
	[0085.674] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0FXU[2].jpg", cAlternateFileName="BBC0FX~2.JPG")) returned 1
	[0085.674] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0mkg[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 1
	[0085.675] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0mkg[2].jpg", cAlternateFileName="BBC0MK~2.JPG")) returned 1
	[0085.676] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5127c5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5127c5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5127c5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0oQi[1].jpg", cAlternateFileName="BBC0OQ~1.JPG")) returned 1
	[0085.676] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 1
	[0085.677] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBCM2U2[1].jpg", cAlternateFileName="BBCM2U~1.JPG")) returned 1
	[0085.677] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDGTbx[1].jpg", cAlternateFileName="BBDGTB~1.JPG")) returned 1
	[0085.678] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDk44m[1].png", cAlternateFileName="BBDK44~1.PNG")) returned 1
	[0085.679] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDWXoC[1].jpg", cAlternateFileName="BBDWXO~1.JPG")) returned 1
	[0085.680] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE3NcH[1].jpg", cAlternateFileName="BBE3NC~1.JPG")) returned 1
	[0085.681] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE7GLE[1].png", cAlternateFileName="BBE7GL~1.PNG")) returned 1
	[0085.681] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ade190, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ade190, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE8aLO[1].jpg", cAlternateFileName="BBE8AL~1.JPG")) returned 1
	[0085.682] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEd5bF[1].jpg", cAlternateFileName="BBED5B~1.JPG")) returned 1
	[0085.682] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdDNm[1].jpg", cAlternateFileName="BBEDDN~1.JPG")) returned 1
	[0085.683] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdpyr[1].jpg", cAlternateFileName="BBEDPY~1.JPG")) returned 1
	[0085.684] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdQdv[1].jpg", cAlternateFileName="BBEDQD~1.JPG")) returned 1
	[0085.684] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEe62t[1].jpg", cAlternateFileName="BBEE62~1.JPG")) returned 1
	[0085.689] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEedPR[1].jpg", cAlternateFileName="BBEEDP~1.JPG")) returned 1
	[0085.690] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe34d9d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe34d9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeTpB[1].jpg", cAlternateFileName="BBEETP~1.JPG")) returned 1
	[0085.691] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 1
	[0085.692] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeU5U[1].jpg", cAlternateFileName="BBEEU5~1.JPG")) returned 1
	[0085.692] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEf306[1].jpg", cAlternateFileName="BBEF30~1.JPG")) returned 1
	[0085.693] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEf54R[1].jpg", cAlternateFileName="BBEF54~1.JPG")) returned 1
	[0085.693] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfBbH[1].jpg", cAlternateFileName="BBEFBB~1.JPG")) returned 1
	[0085.694] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfBq0[1].jpg", cAlternateFileName="BBEFBQ~1.JPG")) returned 1
	[0085.695] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfBrz[1].jpg", cAlternateFileName="BBEFBR~1.JPG")) returned 1
	[0085.695] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfXl6[1].jpg", cAlternateFileName="BBEFXL~1.JPG")) returned 1
	[0085.696] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbded7090, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbded7090, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbded7090, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgEH3[1].jpg", cAlternateFileName="BBEGEH~1.JPG")) returned 1
	[0085.697] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 1
	[0085.697] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgTxB[1].jpg", cAlternateFileName="BBEGTX~1.JPG")) returned 1
	[0085.698] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBo1lFJ[2].png", cAlternateFileName="BBO1LF~2.PNG")) returned 1
	[0085.698] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x455f5430, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x455f5430, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455f5430, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBs47TE[1].png", cAlternateFileName="BBS47T~1.PNG")) returned 1
	[0085.699] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBu9sWQ[1].jpg", cAlternateFileName="BBU9SW~1.JPG")) returned 1
	[0085.700] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BByazif[2].jpg", cAlternateFileName="BBYAZI~2.JPG")) returned 1
	[0085.700] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="bs-components[1].css", cAlternateFileName="BS-COM~1.CSS")) returned 1
	[0085.701] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30be, dwReserved0=0x0, dwReserved1=0x0, cFileName="bs-util[1].css", cAlternateFileName="BS-UTI~1.CSS")) returned 1
	[0085.702] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd97bf10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbd97bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd9a2070, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="c7-bdbd0d-91cdfbc1[1].txt", cAlternateFileName="C7-BDB~1.TXT")) returned 1
	[0085.702] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x614e4380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x614e4380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x614e4380, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x211dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1
	[0085.703] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63c04d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c04d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63c04d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x653e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cb=gapi[2].loaded_0", cAlternateFileName="CB_GAP~2.LOA")) returned 1
	[0085.703] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x584c4b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x584c4b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58510e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a03f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.min[1].css", cAlternateFileName="CHROME~1.CSS")) returned 1
	[0085.704] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c69520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c69520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c69520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_throbber_fast_16[1].gif", cAlternateFileName="CHROME~1.GIF")) returned 1
	[0085.705] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55333bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55333bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1
	[0085.705] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8f4e10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8f4e10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8f4e10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1
	[0085.706] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0085.706] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d9a020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d9a020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60de62e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula-mac[1].jpg", cAlternateFileName="EULA-M~1.JPG")) returned 1
	[0085.707] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa84a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ga[1].js", cAlternateFileName="GA_1_~1.JS")) returned 1
	[0085.708] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe1f6d70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~1")) returned 1
	[0085.710] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x659c6020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x659c6020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65c99a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleInstaller_de[1].application", cAlternateFileName="GOOGLE~1.APP")) returned 1
	[0085.710] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf03f170, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf03f170, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf0652d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1
	[0085.711] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2544b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2544b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2544b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1
	[0085.712] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54feddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54feddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x550601d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7a43, dwReserved0=0x0, dwReserved1=0x0, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1
	[0085.712] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d1a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a114, dwReserved0=0x0, dwReserved1=0x0, cFileName="MemMDL2.2.17[1].eot", cAlternateFileName="MEMMDL~1.EOT")) returned 1
	[0085.712] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605b7740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605b7740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605b7740, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="modernizr[1].js", cAlternateFileName="MODERN~1.JS")) returned 1
	[0085.713] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNIdSync[1].js", cAlternateFileName="MSNIDS~1.JS")) returned 1
	[0085.713] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1
	[0085.714] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="player[1].js", cAlternateFileName="PLAYER~1.JS")) returned 1
	[0085.714] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5f44, dwReserved0=0x0, dwReserved1=0x0, cFileName="player[2].js", cAlternateFileName="PLAYER~2.JS")) returned 1
	[0085.714] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfb41730, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfb41730, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfb41730, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 1
	[0085.715] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x692027e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x692027e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69232580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x0, dwReserved1=0x0, cFileName="thankyou[1].htm", cAlternateFileName="THANKY~1.HTM")) returned 1
	[0085.715] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x0, dwReserved1=0x0, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 1
	[0085.715] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x0, dwReserved1=0x0, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 0
	[0085.716] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0085.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0085.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0085.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0085.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR", lpFilePart=0x0) returned 0x6f
	[0085.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\", lpFilePart=0x0) returned 0x70
	[0085.719] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0085.723] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0085.723] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45027e90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa756, dwReserved0=0x0, dwReserved1=0x0, cFileName="19619569[1].gif", cAlternateFileName="196195~1.GIF")) returned 1
	[0085.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif", lpFilePart=0x0) returned 0x7f
	[0085.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.725] GetFileType (hFile=0x234) returned 0x1
	[0085.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.725] GetFileType (hFile=0x234) returned 0x1
	[0085.726] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xa756
	[0085.726] ReadFile (in: hFile=0x234, lpBuffer=0x2752b58, nNumberOfBytesToRead=0xa756, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2752b58*, lpNumberOfBytesRead=0x26eb64*=0xa756, lpOverlapped=0x0) returned 1
	[0085.731] CloseHandle (hObject=0x234) returned 1
	[0085.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif.KEKW", lpFilePart=0x0) returned 0x84
	[0085.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.733] GetFileType (hFile=0x234) returned 0x1
	[0085.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.733] GetFileType (hFile=0x234) returned 0x1
	[0085.733] WriteFile (in: hFile=0x234, lpBuffer=0x275eaa8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x275eaa8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.736] CloseHandle (hObject=0x234) returned 1
	[0085.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif", lpFilePart=0x0) returned 0x7f
	[0085.737] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif")) returned 1
	[0085.742] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54962130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54962130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x549ae3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x461fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="7962161087[1].js", cAlternateFileName="796216~1.JS")) returned 1
	[0085.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js", lpFilePart=0x0) returned 0x80
	[0085.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.743] GetFileType (hFile=0x234) returned 0x1
	[0085.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.743] GetFileType (hFile=0x234) returned 0x1
	[0085.743] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x461fe
	[0085.746] ReadFile (in: hFile=0x234, lpBuffer=0x3767180, nNumberOfBytesToRead=0x461fe, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x3767180*, lpNumberOfBytesRead=0x26eb64*=0x461fe, lpOverlapped=0x0) returned 1
	[0085.769] CloseHandle (hObject=0x234) returned 1
	[0085.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js.KEKW", lpFilePart=0x0) returned 0x85
	[0085.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.771] GetFileType (hFile=0x234) returned 0x1
	[0085.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.771] GetFileType (hFile=0x234) returned 0x1
	[0085.771] WriteFile (in: hFile=0x234, lpBuffer=0x2761b80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2761b80*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.775] CloseHandle (hObject=0x234) returned 1
	[0085.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js", lpFilePart=0x0) returned 0x80
	[0085.775] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\7962161087[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\7962161087[1].js")) returned 1
	[0085.786] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA3DGHW[1].png", cAlternateFileName="AA3DGH~1.PNG")) returned 1
	[0085.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png", lpFilePart=0x0) returned 0x7e
	[0085.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.788] GetFileType (hFile=0x234) returned 0x1
	[0085.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.788] GetFileType (hFile=0x234) returned 0x1
	[0085.788] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x14d
	[0085.788] ReadFile (in: hFile=0x234, lpBuffer=0x27635ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27635ac*, lpNumberOfBytesRead=0x26eb64*=0x14d, lpOverlapped=0x0) returned 1
	[0085.793] CloseHandle (hObject=0x234) returned 1
	[0085.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0085.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0085.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.795] GetFileType (hFile=0x234) returned 0x1
	[0085.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0085.795] GetFileType (hFile=0x234) returned 0x1
	[0085.796] WriteFile (in: hFile=0x234, lpBuffer=0x2765d98*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2765d98*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0085.799] CloseHandle (hObject=0x234) returned 1
	[0085.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png", lpFilePart=0x0) returned 0x7e
	[0085.799] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png")) returned 1
	[0085.803] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA3e1pt[2].png", cAlternateFileName="AA3E1P~2.PNG")) returned 1
	[0085.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", lpFilePart=0x0) returned 0x7e
	[0085.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0085.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0085.817] GetFileType (hFile=0x234) returned 0x1
	[0085.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0085.818] GetFileType (hFile=0x234) returned 0x1
	[0085.818] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x197
	[0085.818] ReadFile (in: hFile=0x234, lpBuffer=0x2767808, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2767808*, lpNumberOfBytesRead=0x26eb64*=0x197, lpOverlapped=0x0) returned 1
	[0086.033] CloseHandle (hObject=0x234) returned 1
	[0086.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.035] GetFileType (hFile=0x234) returned 0x1
	[0086.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.035] GetFileType (hFile=0x234) returned 0x1
	[0086.036] WriteFile (in: hFile=0x234, lpBuffer=0x2769ff4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2769ff4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.042] CloseHandle (hObject=0x234) returned 1
	[0086.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", lpFilePart=0x0) returned 0x7e
	[0086.042] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png")) returned 1
	[0086.046] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA42ckd[1].png", cAlternateFileName="AA42CK~1.PNG")) returned 1
	[0086.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", lpFilePart=0x0) returned 0x7e
	[0086.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.047] GetFileType (hFile=0x234) returned 0x1
	[0086.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.047] GetFileType (hFile=0x234) returned 0x1
	[0086.047] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2c2
	[0086.048] ReadFile (in: hFile=0x234, lpBuffer=0x276bb90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x276bb90*, lpNumberOfBytesRead=0x26eb64*=0x2c2, lpOverlapped=0x0) returned 1
	[0086.052] CloseHandle (hObject=0x234) returned 1
	[0086.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.053] GetFileType (hFile=0x234) returned 0x1
	[0086.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.053] GetFileType (hFile=0x234) returned 0x1
	[0086.054] WriteFile (in: hFile=0x234, lpBuffer=0x276e37c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x276e37c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.057] CloseHandle (hObject=0x234) returned 1
	[0086.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", lpFilePart=0x0) returned 0x7e
	[0086.057] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png")) returned 1
	[0086.060] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA42eYr[1].png", cAlternateFileName="AA42EY~1.PNG")) returned 1
	[0086.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", lpFilePart=0x0) returned 0x7e
	[0086.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.062] GetFileType (hFile=0x234) returned 0x1
	[0086.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.062] GetFileType (hFile=0x234) returned 0x1
	[0086.062] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2c2
	[0086.062] ReadFile (in: hFile=0x234, lpBuffer=0x276ff18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x276ff18*, lpNumberOfBytesRead=0x26eb64*=0x2c2, lpOverlapped=0x0) returned 1
	[0086.067] CloseHandle (hObject=0x234) returned 1
	[0086.067] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.068] GetFileType (hFile=0x234) returned 0x1
	[0086.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.068] GetFileType (hFile=0x234) returned 0x1
	[0086.069] WriteFile (in: hFile=0x234, lpBuffer=0x2772704*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2772704*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.072] CloseHandle (hObject=0x234) returned 1
	[0086.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", lpFilePart=0x0) returned 0x7e
	[0086.072] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png")) returned 1
	[0086.075] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA61ILp[2].png", cAlternateFileName="AA61IL~2.PNG")) returned 1
	[0086.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", lpFilePart=0x0) returned 0x7e
	[0086.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.078] GetFileType (hFile=0x234) returned 0x1
	[0086.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.079] GetFileType (hFile=0x234) returned 0x1
	[0086.079] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x204
	[0086.079] ReadFile (in: hFile=0x234, lpBuffer=0x27741e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27741e0*, lpNumberOfBytesRead=0x26eb64*=0x204, lpOverlapped=0x0) returned 1
	[0086.086] CloseHandle (hObject=0x234) returned 1
	[0086.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.087] GetFileType (hFile=0x234) returned 0x1
	[0086.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.088] GetFileType (hFile=0x234) returned 0x1
	[0086.088] WriteFile (in: hFile=0x234, lpBuffer=0x27769cc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27769cc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.091] CloseHandle (hObject=0x234) returned 1
	[0086.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", lpFilePart=0x0) returned 0x7e
	[0086.092] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png")) returned 1
	[0086.095] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA6SNZ6[1].png", cAlternateFileName="AA6SNZ~1.PNG")) returned 1
	[0086.095] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", lpFilePart=0x0) returned 0x7e
	[0086.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.096] GetFileType (hFile=0x234) returned 0x1
	[0086.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.096] GetFileType (hFile=0x234) returned 0x1
	[0086.096] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2ed
	[0086.097] ReadFile (in: hFile=0x234, lpBuffer=0x2778594, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2778594*, lpNumberOfBytesRead=0x26eb64*=0x2ed, lpOverlapped=0x0) returned 1
	[0086.101] CloseHandle (hObject=0x234) returned 1
	[0086.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.102] GetFileType (hFile=0x234) returned 0x1
	[0086.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.102] GetFileType (hFile=0x234) returned 0x1
	[0086.103] WriteFile (in: hFile=0x234, lpBuffer=0x277ad80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x277ad80*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.105] CloseHandle (hObject=0x234) returned 1
	[0086.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", lpFilePart=0x0) returned 0x7e
	[0086.106] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png")) returned 1
	[0086.109] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAbyinC[1].png", cAlternateFileName="AABYIN~1.PNG")) returned 1
	[0086.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", lpFilePart=0x0) returned 0x7e
	[0086.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.110] GetFileType (hFile=0x234) returned 0x1
	[0086.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.110] GetFileType (hFile=0x234) returned 0x1
	[0086.111] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2fc
	[0086.111] ReadFile (in: hFile=0x234, lpBuffer=0x277c954, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x277c954*, lpNumberOfBytesRead=0x26eb64*=0x2fc, lpOverlapped=0x0) returned 1
	[0086.116] CloseHandle (hObject=0x234) returned 1
	[0086.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.117] GetFileType (hFile=0x234) returned 0x1
	[0086.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.117] GetFileType (hFile=0x234) returned 0x1
	[0086.117] WriteFile (in: hFile=0x234, lpBuffer=0x277f140*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x277f140*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", lpFilePart=0x0) returned 0x7e
	[0086.124] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png")) returned 1
	[0086.127] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAicW5W[1].jpg", cAlternateFileName="AAICW5~1.JPG")) returned 1
	[0086.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.128] GetFileType (hFile=0x234) returned 0x1
	[0086.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.128] GetFileType (hFile=0x234) returned 0x1
	[0086.129] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x340b
	[0086.129] ReadFile (in: hFile=0x234, lpBuffer=0x2780a0c, nNumberOfBytesToRead=0x340b, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2780a0c*, lpNumberOfBytesRead=0x26eb64*=0x340b, lpOverlapped=0x0) returned 1
	[0086.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.137] GetFileType (hFile=0x234) returned 0x1
	[0086.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.137] GetFileType (hFile=0x234) returned 0x1
	[0086.138] WriteFile (in: hFile=0x234, lpBuffer=0x2785604*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2785604*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.141] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg")) returned 1
	[0086.144] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538925d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538925d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAj0doQ[1].jpg", cAlternateFileName="AAJ0DO~1.JPG")) returned 1
	[0086.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.145] GetFileType (hFile=0x234) returned 0x1
	[0086.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.145] GetFileType (hFile=0x234) returned 0x1
	[0086.145] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x19a4
	[0086.146] ReadFile (in: hFile=0x234, lpBuffer=0x2786ed0, nNumberOfBytesToRead=0x19a4, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2786ed0*, lpNumberOfBytesRead=0x26eb64*=0x19a4, lpOverlapped=0x0) returned 1
	[0086.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.151] GetFileType (hFile=0x234) returned 0x1
	[0086.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.152] GetFileType (hFile=0x234) returned 0x1
	[0086.152] WriteFile (in: hFile=0x234, lpBuffer=0x278a060*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x278a060*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.157] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg")) returned 1
	[0086.161] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAkqhIf[1].png", cAlternateFileName="AAKQHI~1.PNG")) returned 1
	[0086.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", lpFilePart=0x0) returned 0x7e
	[0086.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.162] GetFileType (hFile=0x234) returned 0x1
	[0086.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.162] GetFileType (hFile=0x234) returned 0x1
	[0086.163] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x35c
	[0086.163] ReadFile (in: hFile=0x234, lpBuffer=0x278bc94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x278bc94*, lpNumberOfBytesRead=0x26eb64*=0x35c, lpOverlapped=0x0) returned 1
	[0086.168] CloseHandle (hObject=0x234) returned 1
	[0086.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.169] GetFileType (hFile=0x234) returned 0x1
	[0086.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.169] GetFileType (hFile=0x234) returned 0x1
	[0086.170] WriteFile (in: hFile=0x234, lpBuffer=0x278e480*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x278e480*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", lpFilePart=0x0) returned 0x7e
	[0086.173] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png")) returned 1
	[0086.176] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAmo09p[1].jpg", cAlternateFileName="AAMO09~1.JPG")) returned 1
	[0086.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.179] GetFileType (hFile=0x234) returned 0x1
	[0086.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.179] GetFileType (hFile=0x234) returned 0x1
	[0086.179] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x278e
	[0086.179] ReadFile (in: hFile=0x234, lpBuffer=0x278fd4c, nNumberOfBytesToRead=0x278e, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x278fd4c*, lpNumberOfBytesRead=0x26eb64*=0x278e, lpOverlapped=0x0) returned 1
	[0086.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.187] GetFileType (hFile=0x234) returned 0x1
	[0086.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.187] GetFileType (hFile=0x234) returned 0x1
	[0086.188] WriteFile (in: hFile=0x234, lpBuffer=0x2793cc8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2793cc8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.191] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg")) returned 1
	[0086.194] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAmUyV2[1].png", cAlternateFileName="AAMUYV~1.PNG")) returned 1
	[0086.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", lpFilePart=0x0) returned 0x7e
	[0086.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.195] GetFileType (hFile=0x234) returned 0x1
	[0086.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.195] GetFileType (hFile=0x234) returned 0x1
	[0086.196] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x19a
	[0086.196] ReadFile (in: hFile=0x234, lpBuffer=0x279573c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x279573c*, lpNumberOfBytesRead=0x26eb64*=0x19a, lpOverlapped=0x0) returned 1
	[0086.200] CloseHandle (hObject=0x234) returned 1
	[0086.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.201] GetFileType (hFile=0x234) returned 0x1
	[0086.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.201] GetFileType (hFile=0x234) returned 0x1
	[0086.202] WriteFile (in: hFile=0x234, lpBuffer=0x2797f28*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2797f28*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", lpFilePart=0x0) returned 0x7e
	[0086.205] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png")) returned 1
	[0086.209] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAn7gKR[1].png", cAlternateFileName="AAN7GK~1.PNG")) returned 1
	[0086.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", lpFilePart=0x0) returned 0x7e
	[0086.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.210] GetFileType (hFile=0x234) returned 0x1
	[0086.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.210] GetFileType (hFile=0x234) returned 0x1
	[0086.211] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xfe
	[0086.211] ReadFile (in: hFile=0x234, lpBuffer=0x2799900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2799900*, lpNumberOfBytesRead=0x26eb64*=0xfe, lpOverlapped=0x0) returned 1
	[0086.215] CloseHandle (hObject=0x234) returned 1
	[0086.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.216] GetFileType (hFile=0x234) returned 0x1
	[0086.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.216] GetFileType (hFile=0x234) returned 0x1
	[0086.217] WriteFile (in: hFile=0x234, lpBuffer=0x279c0ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x279c0ec*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", lpFilePart=0x0) returned 0x7e
	[0086.220] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png")) returned 1
	[0086.223] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61be2420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61be2420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61be2420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x650, dwReserved0=0x0, dwReserved1=0x0, cFileName="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1
	[0086.224] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2a0770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2a0770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x0, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1
	[0086.224] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adfserve[1]", cAlternateFileName="ADFSER~1")) returned 1
	[0086.225] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11835, dwReserved0=0x0, dwReserved1=0x0, cFileName="ast[2].js", cAlternateFileName="AST_2_~1.JS")) returned 1
	[0086.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", lpFilePart=0x0) returned 0x79
	[0086.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.227] GetFileType (hFile=0x234) returned 0x1
	[0086.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.227] GetFileType (hFile=0x234) returned 0x1
	[0086.227] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x11835
	[0086.228] ReadFile (in: hFile=0x234, lpBuffer=0x279ee94, nNumberOfBytesToRead=0x11835, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x279ee94*, lpNumberOfBytesRead=0x26eb64*=0x11835, lpOverlapped=0x0) returned 1
	[0086.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js.KEKW", lpFilePart=0x0) returned 0x7e
	[0086.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.234] GetFileType (hFile=0x234) returned 0x1
	[0086.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.234] GetFileType (hFile=0x234) returned 0x1
	[0086.235] WriteFile (in: hFile=0x234, lpBuffer=0x27b1ea0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27b1ea0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js", lpFilePart=0x0) returned 0x79
	[0086.238] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ast[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ast[2].js")) returned 1
	[0086.243] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53d7b330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53d7b330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53d7b330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1
	[0086.243] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5108d3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5108d3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="b2fd15[1].eot", cAlternateFileName="B2FD15~1.EOT")) returned 1
	[0086.244] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB5zDwX[1].png", cAlternateFileName="BB5ZDW~1.PNG")) returned 1
	[0086.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png", lpFilePart=0x0) returned 0x7e
	[0086.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.245] GetFileType (hFile=0x234) returned 0x1
	[0086.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.245] GetFileType (hFile=0x234) returned 0x1
	[0086.245] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2c0
	[0086.246] ReadFile (in: hFile=0x234, lpBuffer=0x27b469c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27b469c*, lpNumberOfBytesRead=0x26eb64*=0x2c0, lpOverlapped=0x0) returned 1
	[0086.250] CloseHandle (hObject=0x234) returned 1
	[0086.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.251] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.252] GetFileType (hFile=0x234) returned 0x1
	[0086.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.252] GetFileType (hFile=0x234) returned 0x1
	[0086.252] WriteFile (in: hFile=0x234, lpBuffer=0x27b6e88*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27b6e88*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png", lpFilePart=0x0) returned 0x7e
	[0086.255] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png")) returned 1
	[0086.259] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBaK3Nm[1].png", cAlternateFileName="BBAK3N~1.PNG")) returned 1
	[0086.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", lpFilePart=0x0) returned 0x7e
	[0086.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.260] GetFileType (hFile=0x234) returned 0x1
	[0086.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.260] GetFileType (hFile=0x234) returned 0x1
	[0086.260] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x227
	[0086.261] ReadFile (in: hFile=0x234, lpBuffer=0x27b8988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27b8988*, lpNumberOfBytesRead=0x26eb64*=0x227, lpOverlapped=0x0) returned 1
	[0086.265] CloseHandle (hObject=0x234) returned 1
	[0086.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.266] GetFileType (hFile=0x234) returned 0x1
	[0086.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.266] GetFileType (hFile=0x234) returned 0x1
	[0086.267] WriteFile (in: hFile=0x234, lpBuffer=0x27bb174*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27bb174*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", lpFilePart=0x0) returned 0x7e
	[0086.270] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png")) returned 1
	[0086.274] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBLcCz[1].jpg", cAlternateFileName="BBBLCC~1.JPG")) returned 1
	[0086.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.276] GetFileType (hFile=0x234) returned 0x1
	[0086.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.276] GetFileType (hFile=0x234) returned 0x1
	[0086.276] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2143
	[0086.276] ReadFile (in: hFile=0x234, lpBuffer=0x27bca40, nNumberOfBytesToRead=0x2143, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27bca40*, lpNumberOfBytesRead=0x26eb64*=0x2143, lpOverlapped=0x0) returned 1
	[0086.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.281] GetFileType (hFile=0x234) returned 0x1
	[0086.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.282] GetFileType (hFile=0x234) returned 0x1
	[0086.282] WriteFile (in: hFile=0x234, lpBuffer=0x27c0370*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27c0370*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.285] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg")) returned 1
	[0086.289] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBLdzQ[1].jpg", cAlternateFileName="BBBLDZ~1.JPG")) returned 1
	[0086.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.291] GetFileType (hFile=0x234) returned 0x1
	[0086.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.291] GetFileType (hFile=0x234) returned 0x1
	[0086.291] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x912
	[0086.291] ReadFile (in: hFile=0x234, lpBuffer=0x27c255c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27c255c*, lpNumberOfBytesRead=0x26eb64*=0x912, lpOverlapped=0x0) returned 1
	[0086.295] CloseHandle (hObject=0x234) returned 1
	[0086.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.296] GetFileType (hFile=0x234) returned 0x1
	[0086.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.297] GetFileType (hFile=0x234) returned 0x1
	[0086.297] WriteFile (in: hFile=0x234, lpBuffer=0x27c4d48*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27c4d48*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.300] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg")) returned 1
	[0086.304] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 1
	[0086.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.305] GetFileType (hFile=0x234) returned 0x1
	[0086.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.305] GetFileType (hFile=0x234) returned 0x1
	[0086.305] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x6e8
	[0086.305] ReadFile (in: hFile=0x234, lpBuffer=0x27c6d08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27c6d08*, lpNumberOfBytesRead=0x26eb64*=0x6e8, lpOverlapped=0x0) returned 1
	[0086.310] CloseHandle (hObject=0x234) returned 1
	[0086.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.311] GetFileType (hFile=0x234) returned 0x1
	[0086.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.311] GetFileType (hFile=0x234) returned 0x1
	[0086.311] WriteFile (in: hFile=0x234, lpBuffer=0x27c94f4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27c94f4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.314] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg")) returned 1
	[0086.319] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO1qB[1].jpg", cAlternateFileName="BBBO1Q~1.JPG")) returned 1
	[0086.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.320] GetFileType (hFile=0x234) returned 0x1
	[0086.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.320] GetFileType (hFile=0x234) returned 0x1
	[0086.320] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x36d2
	[0086.320] ReadFile (in: hFile=0x234, lpBuffer=0x27cadc0, nNumberOfBytesToRead=0x36d2, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27cadc0*, lpNumberOfBytesRead=0x26eb64*=0x36d2, lpOverlapped=0x0) returned 1
	[0086.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.326] GetFileType (hFile=0x234) returned 0x1
	[0086.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.326] GetFileType (hFile=0x234) returned 0x1
	[0086.327] WriteFile (in: hFile=0x234, lpBuffer=0x27cfc80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27cfc80*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.330] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg")) returned 1
	[0086.334] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOIAt[1].jpg", cAlternateFileName="BBBOIA~1.JPG")) returned 1
	[0086.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.335] GetFileType (hFile=0x234) returned 0x1
	[0086.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.335] GetFileType (hFile=0x234) returned 0x1
	[0086.335] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x75e
	[0086.335] ReadFile (in: hFile=0x234, lpBuffer=0x27d1cb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27d1cb8*, lpNumberOfBytesRead=0x26eb64*=0x75e, lpOverlapped=0x0) returned 1
	[0086.340] CloseHandle (hObject=0x234) returned 1
	[0086.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.341] GetFileType (hFile=0x234) returned 0x1
	[0086.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.341] GetFileType (hFile=0x234) returned 0x1
	[0086.342] WriteFile (in: hFile=0x234, lpBuffer=0x27d44a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27d44a4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.348] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg")) returned 1
	[0086.351] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOmuh[1].jpg", cAlternateFileName="BBBOMU~1.JPG")) returned 1
	[0086.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.352] GetFileType (hFile=0x234) returned 0x1
	[0086.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.353] GetFileType (hFile=0x234) returned 0x1
	[0086.353] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x6dc
	[0086.353] ReadFile (in: hFile=0x234, lpBuffer=0x27d6458, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27d6458*, lpNumberOfBytesRead=0x26eb64*=0x6dc, lpOverlapped=0x0) returned 1
	[0086.357] CloseHandle (hObject=0x234) returned 1
	[0086.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.358] GetFileType (hFile=0x234) returned 0x1
	[0086.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.359] GetFileType (hFile=0x234) returned 0x1
	[0086.359] WriteFile (in: hFile=0x234, lpBuffer=0x27d8c44*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27d8c44*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.362] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg")) returned 1
	[0086.368] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPK5J[1].jpg", cAlternateFileName="BBBPK5~1.JPG")) returned 1
	[0086.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.369] GetFileType (hFile=0x234) returned 0x1
	[0086.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.369] GetFileType (hFile=0x234) returned 0x1
	[0086.369] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x9be
	[0086.369] ReadFile (in: hFile=0x234, lpBuffer=0x27daedc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27daedc*, lpNumberOfBytesRead=0x26eb64*=0x9be, lpOverlapped=0x0) returned 1
	[0086.374] CloseHandle (hObject=0x234) returned 1
	[0086.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.375] GetFileType (hFile=0x234) returned 0x1
	[0086.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.375] GetFileType (hFile=0x234) returned 0x1
	[0086.376] WriteFile (in: hFile=0x234, lpBuffer=0x27dd6c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27dd6c8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.379] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg")) returned 1
	[0086.382] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBPMvJ[1].jpg", cAlternateFileName="BBBPMV~1.JPG")) returned 1
	[0086.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.384] GetFileType (hFile=0x234) returned 0x1
	[0086.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.384] GetFileType (hFile=0x234) returned 0x1
	[0086.384] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1694
	[0086.385] ReadFile (in: hFile=0x234, lpBuffer=0x27def94, nNumberOfBytesToRead=0x1694, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27def94*, lpNumberOfBytesRead=0x26eb64*=0x1694, lpOverlapped=0x0) returned 1
	[0086.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.390] GetFileType (hFile=0x234) returned 0x1
	[0086.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.390] GetFileType (hFile=0x234) returned 0x1
	[0086.391] WriteFile (in: hFile=0x234, lpBuffer=0x27e1e14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27e1e14*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.394] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg")) returned 1
	[0086.397] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53a0f390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBUL3E[1].jpg", cAlternateFileName="BBBUL3~1.JPG")) returned 1
	[0086.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.405] GetFileType (hFile=0x234) returned 0x1
	[0086.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.405] GetFileType (hFile=0x234) returned 0x1
	[0086.405] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x85d
	[0086.405] ReadFile (in: hFile=0x234, lpBuffer=0x25e46d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25e46d4*, lpNumberOfBytesRead=0x26eb64*=0x85d, lpOverlapped=0x0) returned 1
	[0086.409] CloseHandle (hObject=0x234) returned 1
	[0086.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.435] GetFileType (hFile=0x234) returned 0x1
	[0086.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.435] GetFileType (hFile=0x234) returned 0x1
	[0086.436] WriteFile (in: hFile=0x234, lpBuffer=0x25e6f3c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25e6f3c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.439] CloseHandle (hObject=0x234) returned 1
	[0086.440] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.440] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg")) returned 1
	[0086.443] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBUqkT[1].jpg", cAlternateFileName="BBBUQK~1.JPG")) returned 1
	[0086.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.444] GetFileType (hFile=0x234) returned 0x1
	[0086.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.445] GetFileType (hFile=0x234) returned 0x1
	[0086.445] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x878
	[0086.445] ReadFile (in: hFile=0x234, lpBuffer=0x25e908c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25e908c*, lpNumberOfBytesRead=0x26eb64*=0x878, lpOverlapped=0x0) returned 1
	[0086.450] CloseHandle (hObject=0x234) returned 1
	[0086.450] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.451] GetFileType (hFile=0x234) returned 0x1
	[0086.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.451] GetFileType (hFile=0x234) returned 0x1
	[0086.452] WriteFile (in: hFile=0x234, lpBuffer=0x25eb878*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25eb878*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.455] CloseHandle (hObject=0x234) returned 1
	[0086.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.455] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg")) returned 1
	[0086.459] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBUqkT[2].jpg", cAlternateFileName="BBBUQK~2.JPG")) returned 1
	[0086.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", lpFilePart=0x0) returned 0x7e
	[0086.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.460] GetFileType (hFile=0x234) returned 0x1
	[0086.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.460] GetFileType (hFile=0x234) returned 0x1
	[0086.460] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x878
	[0086.461] ReadFile (in: hFile=0x234, lpBuffer=0x25ed9c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25ed9c8*, lpNumberOfBytesRead=0x26eb64*=0x878, lpOverlapped=0x0) returned 1
	[0086.465] CloseHandle (hObject=0x234) returned 1
	[0086.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.466] GetFileType (hFile=0x234) returned 0x1
	[0086.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.467] GetFileType (hFile=0x234) returned 0x1
	[0086.467] WriteFile (in: hFile=0x234, lpBuffer=0x25f01b4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25f01b4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.471] CloseHandle (hObject=0x234) returned 1
	[0086.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", lpFilePart=0x0) returned 0x7e
	[0086.471] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg")) returned 1
	[0086.479] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBX3z0[1].jpg", cAlternateFileName="BBBX3Z~1.JPG")) returned 1
	[0086.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.483] GetFileType (hFile=0x234) returned 0x1
	[0086.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.483] GetFileType (hFile=0x234) returned 0x1
	[0086.483] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x77f
	[0086.483] ReadFile (in: hFile=0x234, lpBuffer=0x25f220c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25f220c*, lpNumberOfBytesRead=0x26eb64*=0x77f, lpOverlapped=0x0) returned 1
	[0086.488] CloseHandle (hObject=0x234) returned 1
	[0086.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.489] GetFileType (hFile=0x234) returned 0x1
	[0086.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.489] GetFileType (hFile=0x234) returned 0x1
	[0086.490] WriteFile (in: hFile=0x234, lpBuffer=0x25f49f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25f49f8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.492] CloseHandle (hObject=0x234) returned 1
	[0086.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.493] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg")) returned 1
	[0086.496] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBYEW1[1].jpg", cAlternateFileName="BBBYEW~1.JPG")) returned 1
	[0086.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.497] GetFileType (hFile=0x234) returned 0x1
	[0086.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.497] GetFileType (hFile=0x234) returned 0x1
	[0086.498] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x22b3
	[0086.498] ReadFile (in: hFile=0x234, lpBuffer=0x25f62c4, nNumberOfBytesToRead=0x22b3, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25f62c4*, lpNumberOfBytesRead=0x26eb64*=0x22b3, lpOverlapped=0x0) returned 1
	[0086.502] CloseHandle (hObject=0x234) returned 1
	[0086.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.504] GetFileType (hFile=0x234) returned 0x1
	[0086.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.504] GetFileType (hFile=0x234) returned 0x1
	[0086.504] WriteFile (in: hFile=0x234, lpBuffer=0x25f9d64*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25f9d64*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.507] CloseHandle (hObject=0x234) returned 1
	[0086.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.507] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg")) returned 1
	[0086.511] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 1
	[0086.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.512] GetFileType (hFile=0x234) returned 0x1
	[0086.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.512] GetFileType (hFile=0x234) returned 0x1
	[0086.512] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x19cf
	[0086.513] ReadFile (in: hFile=0x234, lpBuffer=0x25fb630, nNumberOfBytesToRead=0x19cf, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25fb630*, lpNumberOfBytesRead=0x26eb64*=0x19cf, lpOverlapped=0x0) returned 1
	[0086.518] CloseHandle (hObject=0x234) returned 1
	[0086.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.520] GetFileType (hFile=0x234) returned 0x1
	[0086.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.520] GetFileType (hFile=0x234) returned 0x1
	[0086.521] WriteFile (in: hFile=0x234, lpBuffer=0x25fe7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25fe7ec*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.524] CloseHandle (hObject=0x234) returned 1
	[0086.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.525] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg")) returned 1
	[0086.528] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBZ20W[1].jpg", cAlternateFileName="BBBZ20~1.JPG")) returned 1
	[0086.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.530] GetFileType (hFile=0x234) returned 0x1
	[0086.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.531] GetFileType (hFile=0x234) returned 0x1
	[0086.531] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2ca1
	[0086.531] ReadFile (in: hFile=0x234, lpBuffer=0x26000b8, nNumberOfBytesToRead=0x2ca1, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26000b8*, lpNumberOfBytesRead=0x26eb64*=0x2ca1, lpOverlapped=0x0) returned 1
	[0086.536] CloseHandle (hObject=0x234) returned 1
	[0086.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.537] GetFileType (hFile=0x234) returned 0x1
	[0086.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.537] GetFileType (hFile=0x234) returned 0x1
	[0086.537] WriteFile (in: hFile=0x234, lpBuffer=0x2604548*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2604548*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.540] CloseHandle (hObject=0x234) returned 1
	[0086.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.541] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg")) returned 1
	[0086.544] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53950cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53950cb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBzaxY[1].jpg", cAlternateFileName="BBBZAX~1.JPG")) returned 1
	[0086.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.546] GetFileType (hFile=0x234) returned 0x1
	[0086.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.546] GetFileType (hFile=0x234) returned 0x1
	[0086.546] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1f37
	[0086.546] ReadFile (in: hFile=0x234, lpBuffer=0x2605e14, nNumberOfBytesToRead=0x1f37, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2605e14*, lpNumberOfBytesRead=0x26eb64*=0x1f37, lpOverlapped=0x0) returned 1
	[0086.550] CloseHandle (hObject=0x234) returned 1
	[0086.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.553] GetFileType (hFile=0x234) returned 0x1
	[0086.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.553] GetFileType (hFile=0x234) returned 0x1
	[0086.553] WriteFile (in: hFile=0x234, lpBuffer=0x2609538*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2609538*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.556] CloseHandle (hObject=0x234) returned 1
	[0086.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.557] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg")) returned 1
	[0086.560] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBZzuz[1].jpg", cAlternateFileName="BBBZZU~1.JPG")) returned 1
	[0086.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.561] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.561] GetFileType (hFile=0x234) returned 0x1
	[0086.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.561] GetFileType (hFile=0x234) returned 0x1
	[0086.561] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2131
	[0086.562] ReadFile (in: hFile=0x234, lpBuffer=0x260ae04, nNumberOfBytesToRead=0x2131, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x260ae04*, lpNumberOfBytesRead=0x26eb64*=0x2131, lpOverlapped=0x0) returned 1
	[0086.566] CloseHandle (hObject=0x234) returned 1
	[0086.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.572] GetFileType (hFile=0x234) returned 0x1
	[0086.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.573] GetFileType (hFile=0x234) returned 0x1
	[0086.573] WriteFile (in: hFile=0x234, lpBuffer=0x260e724*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x260e724*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.577] CloseHandle (hObject=0x234) returned 1
	[0086.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.578] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg")) returned 1
	[0086.582] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 1
	[0086.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.584] GetFileType (hFile=0x234) returned 0x1
	[0086.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.585] GetFileType (hFile=0x234) returned 0x1
	[0086.585] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x370a
	[0086.585] ReadFile (in: hFile=0x234, lpBuffer=0x260fff0, nNumberOfBytesToRead=0x370a, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x260fff0*, lpNumberOfBytesRead=0x26eb64*=0x370a, lpOverlapped=0x0) returned 1
	[0086.594] CloseHandle (hObject=0x234) returned 1
	[0086.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.595] GetFileType (hFile=0x234) returned 0x1
	[0086.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.596] GetFileType (hFile=0x234) returned 0x1
	[0086.596] WriteFile (in: hFile=0x234, lpBuffer=0x2614ee8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2614ee8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.599] CloseHandle (hObject=0x234) returned 1
	[0086.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.599] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg")) returned 1
	[0086.603] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 1
	[0086.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.604] GetFileType (hFile=0x234) returned 0x1
	[0086.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.604] GetFileType (hFile=0x234) returned 0x1
	[0086.604] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x22a0
	[0086.605] ReadFile (in: hFile=0x234, lpBuffer=0x26167b4, nNumberOfBytesToRead=0x22a0, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26167b4*, lpNumberOfBytesRead=0x26eb64*=0x22a0, lpOverlapped=0x0) returned 1
	[0086.609] CloseHandle (hObject=0x234) returned 1
	[0086.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.610] GetFileType (hFile=0x234) returned 0x1
	[0086.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.610] GetFileType (hFile=0x234) returned 0x1
	[0086.611] WriteFile (in: hFile=0x234, lpBuffer=0x261a240*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x261a240*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.620] CloseHandle (hObject=0x234) returned 1
	[0086.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.620] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg")) returned 1
	[0086.623] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53657130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53657130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC06ZQ[1].jpg", cAlternateFileName="BBC06Z~1.JPG")) returned 1
	[0086.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.625] GetFileType (hFile=0x234) returned 0x1
	[0086.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.625] GetFileType (hFile=0x234) returned 0x1
	[0086.625] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2036
	[0086.625] ReadFile (in: hFile=0x234, lpBuffer=0x261bb0c, nNumberOfBytesToRead=0x2036, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x261bb0c*, lpNumberOfBytesRead=0x26eb64*=0x2036, lpOverlapped=0x0) returned 1
	[0086.630] CloseHandle (hObject=0x234) returned 1
	[0086.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.631] GetFileType (hFile=0x234) returned 0x1
	[0086.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.632] GetFileType (hFile=0x234) returned 0x1
	[0086.632] WriteFile (in: hFile=0x234, lpBuffer=0x261f330*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x261f330*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.636] CloseHandle (hObject=0x234) returned 1
	[0086.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.636] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg")) returned 1
	[0086.639] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 1
	[0086.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.640] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.641] GetFileType (hFile=0x234) returned 0x1
	[0086.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.641] GetFileType (hFile=0x234) returned 0x1
	[0086.641] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x13fd
	[0086.642] ReadFile (in: hFile=0x234, lpBuffer=0x2620bfc, nNumberOfBytesToRead=0x13fd, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2620bfc*, lpNumberOfBytesRead=0x26eb64*=0x13fd, lpOverlapped=0x0) returned 1
	[0086.646] CloseHandle (hObject=0x234) returned 1
	[0086.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.648] GetFileType (hFile=0x234) returned 0x1
	[0086.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.648] GetFileType (hFile=0x234) returned 0x1
	[0086.649] WriteFile (in: hFile=0x234, lpBuffer=0x26237e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26237e8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.652] CloseHandle (hObject=0x234) returned 1
	[0086.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.652] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg")) returned 1
	[0086.656] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0BiZ[1].jpg", cAlternateFileName="BBC0BI~1.JPG")) returned 1
	[0086.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.657] GetFileType (hFile=0x234) returned 0x1
	[0086.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.657] GetFileType (hFile=0x234) returned 0x1
	[0086.657] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x884
	[0086.658] ReadFile (in: hFile=0x234, lpBuffer=0x2625944, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2625944*, lpNumberOfBytesRead=0x26eb64*=0x884, lpOverlapped=0x0) returned 1
	[0086.664] CloseHandle (hObject=0x234) returned 1
	[0086.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.664] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.665] GetFileType (hFile=0x234) returned 0x1
	[0086.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.665] GetFileType (hFile=0x234) returned 0x1
	[0086.666] WriteFile (in: hFile=0x234, lpBuffer=0x2628130*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2628130*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.669] CloseHandle (hObject=0x234) returned 1
	[0086.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.669] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg")) returned 1
	[0086.672] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0FXU[1].jpg", cAlternateFileName="BBC0FX~1.JPG")) returned 1
	[0086.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.673] GetFileType (hFile=0x234) returned 0x1
	[0086.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.674] GetFileType (hFile=0x234) returned 0x1
	[0086.674] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x34d8
	[0086.674] ReadFile (in: hFile=0x234, lpBuffer=0x26299fc, nNumberOfBytesToRead=0x34d8, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26299fc*, lpNumberOfBytesRead=0x26eb64*=0x34d8, lpOverlapped=0x0) returned 1
	[0086.680] CloseHandle (hObject=0x234) returned 1
	[0086.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.681] GetFileType (hFile=0x234) returned 0x1
	[0086.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.681] GetFileType (hFile=0x234) returned 0x1
	[0086.681] WriteFile (in: hFile=0x234, lpBuffer=0x262e6c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x262e6c0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.684] CloseHandle (hObject=0x234) returned 1
	[0086.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.685] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg")) returned 1
	[0086.688] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0FXU[2].jpg", cAlternateFileName="BBC0FX~2.JPG")) returned 1
	[0086.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", lpFilePart=0x0) returned 0x7e
	[0086.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.689] GetFileType (hFile=0x234) returned 0x1
	[0086.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.690] GetFileType (hFile=0x234) returned 0x1
	[0086.690] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2fd1
	[0086.690] ReadFile (in: hFile=0x234, lpBuffer=0x262ff8c, nNumberOfBytesToRead=0x2fd1, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x262ff8c*, lpNumberOfBytesRead=0x26eb64*=0x2fd1, lpOverlapped=0x0) returned 1
	[0086.695] CloseHandle (hObject=0x234) returned 1
	[0086.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.697] GetFileType (hFile=0x234) returned 0x1
	[0086.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.698] GetFileType (hFile=0x234) returned 0x1
	[0086.698] WriteFile (in: hFile=0x234, lpBuffer=0x263474c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x263474c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", lpFilePart=0x0) returned 0x7e
	[0086.704] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg")) returned 1
	[0086.709] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0mkg[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 1
	[0086.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.709] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.710] GetFileType (hFile=0x234) returned 0x1
	[0086.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.710] GetFileType (hFile=0x234) returned 0x1
	[0086.710] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x29c3
	[0086.711] ReadFile (in: hFile=0x234, lpBuffer=0x2636018, nNumberOfBytesToRead=0x29c3, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2636018*, lpNumberOfBytesRead=0x26eb64*=0x29c3, lpOverlapped=0x0) returned 1
	[0086.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.716] GetFileType (hFile=0x234) returned 0x1
	[0086.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.717] GetFileType (hFile=0x234) returned 0x1
	[0086.717] WriteFile (in: hFile=0x234, lpBuffer=0x263a1c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x263a1c8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.721] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg")) returned 1
	[0086.724] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0mkg[2].jpg", cAlternateFileName="BBC0MK~2.JPG")) returned 1
	[0086.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", lpFilePart=0x0) returned 0x7e
	[0086.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.725] GetFileType (hFile=0x234) returned 0x1
	[0086.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.725] GetFileType (hFile=0x234) returned 0x1
	[0086.725] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xa7b
	[0086.726] ReadFile (in: hFile=0x234, lpBuffer=0x263c51c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x263c51c*, lpNumberOfBytesRead=0x26eb64*=0xa7b, lpOverlapped=0x0) returned 1
	[0086.730] CloseHandle (hObject=0x234) returned 1
	[0086.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.731] GetFileType (hFile=0x234) returned 0x1
	[0086.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.732] GetFileType (hFile=0x234) returned 0x1
	[0086.732] WriteFile (in: hFile=0x234, lpBuffer=0x263ed08*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x263ed08*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", lpFilePart=0x0) returned 0x7e
	[0086.735] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg")) returned 1
	[0086.768] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5127c5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5127c5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5127c5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0oQi[1].jpg", cAlternateFileName="BBC0OQ~1.JPG")) returned 1
	[0086.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.770] GetFileType (hFile=0x234) returned 0x1
	[0086.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.771] GetFileType (hFile=0x234) returned 0x1
	[0086.771] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x17af
	[0086.771] ReadFile (in: hFile=0x234, lpBuffer=0x26405d4, nNumberOfBytesToRead=0x17af, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26405d4*, lpNumberOfBytesRead=0x26eb64*=0x17af, lpOverlapped=0x0) returned 1
	[0086.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.783] GetFileType (hFile=0x234) returned 0x1
	[0086.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.783] GetFileType (hFile=0x234) returned 0x1
	[0086.784] WriteFile (in: hFile=0x234, lpBuffer=0x2643570*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2643570*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.788] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg")) returned 1
	[0086.791] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 1
	[0086.792] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.792] GetFileType (hFile=0x234) returned 0x1
	[0086.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.793] GetFileType (hFile=0x234) returned 0x1
	[0086.793] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xaf3
	[0086.793] ReadFile (in: hFile=0x234, lpBuffer=0x264593c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x264593c*, lpNumberOfBytesRead=0x26eb64*=0xaf3, lpOverlapped=0x0) returned 1
	[0086.798] CloseHandle (hObject=0x234) returned 1
	[0086.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.799] GetFileType (hFile=0x234) returned 0x1
	[0086.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.800] GetFileType (hFile=0x234) returned 0x1
	[0086.800] WriteFile (in: hFile=0x234, lpBuffer=0x2648128*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2648128*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.814] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg")) returned 1
	[0086.819] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBCM2U2[1].jpg", cAlternateFileName="BBCM2U~1.JPG")) returned 1
	[0086.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.820] GetFileType (hFile=0x234) returned 0x1
	[0086.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.821] GetFileType (hFile=0x234) returned 0x1
	[0086.821] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x350a
	[0086.821] ReadFile (in: hFile=0x234, lpBuffer=0x26499f4, nNumberOfBytesToRead=0x350a, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26499f4*, lpNumberOfBytesRead=0x26eb64*=0x350a, lpOverlapped=0x0) returned 1
	[0086.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.827] GetFileType (hFile=0x234) returned 0x1
	[0086.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.827] GetFileType (hFile=0x234) returned 0x1
	[0086.828] WriteFile (in: hFile=0x234, lpBuffer=0x264e6ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x264e6ec*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.831] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg")) returned 1
	[0086.835] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDGTbx[1].jpg", cAlternateFileName="BBDGTB~1.JPG")) returned 1
	[0086.835] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.836] GetFileType (hFile=0x234) returned 0x1
	[0086.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.836] GetFileType (hFile=0x234) returned 0x1
	[0086.837] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x68c
	[0086.837] ReadFile (in: hFile=0x234, lpBuffer=0x2650650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2650650*, lpNumberOfBytesRead=0x26eb64*=0x68c, lpOverlapped=0x0) returned 1
	[0086.841] CloseHandle (hObject=0x234) returned 1
	[0086.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.843] GetFileType (hFile=0x234) returned 0x1
	[0086.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.843] GetFileType (hFile=0x234) returned 0x1
	[0086.843] WriteFile (in: hFile=0x234, lpBuffer=0x2652e3c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2652e3c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.847] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg")) returned 1
	[0086.851] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDk44m[1].png", cAlternateFileName="BBDK44~1.PNG")) returned 1
	[0086.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", lpFilePart=0x0) returned 0x7e
	[0086.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.852] GetFileType (hFile=0x234) returned 0x1
	[0086.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.852] GetFileType (hFile=0x234) returned 0x1
	[0086.852] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x284
	[0086.853] ReadFile (in: hFile=0x234, lpBuffer=0x2654998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2654998*, lpNumberOfBytesRead=0x26eb64*=0x284, lpOverlapped=0x0) returned 1
	[0086.860] CloseHandle (hObject=0x234) returned 1
	[0086.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.862] GetFileType (hFile=0x234) returned 0x1
	[0086.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.862] GetFileType (hFile=0x234) returned 0x1
	[0086.863] WriteFile (in: hFile=0x234, lpBuffer=0x2657184*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2657184*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", lpFilePart=0x0) returned 0x7e
	[0086.868] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png")) returned 1
	[0086.874] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBDWXoC[1].jpg", cAlternateFileName="BBDWXO~1.JPG")) returned 1
	[0086.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.875] GetFileType (hFile=0x234) returned 0x1
	[0086.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.875] GetFileType (hFile=0x234) returned 0x1
	[0086.875] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2d04
	[0086.875] ReadFile (in: hFile=0x234, lpBuffer=0x2658a50, nNumberOfBytesToRead=0x2d04, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2658a50*, lpNumberOfBytesRead=0x26eb64*=0x2d04, lpOverlapped=0x0) returned 1
	[0086.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.881] GetFileType (hFile=0x234) returned 0x1
	[0086.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.882] GetFileType (hFile=0x234) returned 0x1
	[0086.882] WriteFile (in: hFile=0x234, lpBuffer=0x265cf40*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x265cf40*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.885] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg")) returned 1
	[0086.889] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE3NcH[1].jpg", cAlternateFileName="BBE3NC~1.JPG")) returned 1
	[0086.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.890] GetFileType (hFile=0x234) returned 0x1
	[0086.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.890] GetFileType (hFile=0x234) returned 0x1
	[0086.890] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x863
	[0086.891] ReadFile (in: hFile=0x234, lpBuffer=0x265f07c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x265f07c*, lpNumberOfBytesRead=0x26eb64*=0x863, lpOverlapped=0x0) returned 1
	[0086.896] CloseHandle (hObject=0x234) returned 1
	[0086.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.897] GetFileType (hFile=0x234) returned 0x1
	[0086.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.897] GetFileType (hFile=0x234) returned 0x1
	[0086.897] WriteFile (in: hFile=0x234, lpBuffer=0x2661868*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2661868*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.901] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg")) returned 1
	[0086.904] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE7GLE[1].png", cAlternateFileName="BBE7GL~1.PNG")) returned 1
	[0086.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", lpFilePart=0x0) returned 0x7e
	[0086.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.905] GetFileType (hFile=0x234) returned 0x1
	[0086.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.905] GetFileType (hFile=0x234) returned 0x1
	[0086.905] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2b5
	[0086.906] ReadFile (in: hFile=0x234, lpBuffer=0x26633f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26633f8*, lpNumberOfBytesRead=0x26eb64*=0x2b5, lpOverlapped=0x0) returned 1
	[0086.912] CloseHandle (hObject=0x234) returned 1
	[0086.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0086.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.914] GetFileType (hFile=0x234) returned 0x1
	[0086.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.914] GetFileType (hFile=0x234) returned 0x1
	[0086.915] WriteFile (in: hFile=0x234, lpBuffer=0x2665be4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2665be4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", lpFilePart=0x0) returned 0x7e
	[0086.918] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png")) returned 1
	[0086.922] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ade190, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ade190, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE8aLO[1].jpg", cAlternateFileName="BBE8AL~1.JPG")) returned 1
	[0086.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.923] GetFileType (hFile=0x234) returned 0x1
	[0086.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.923] GetFileType (hFile=0x234) returned 0x1
	[0086.923] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1c9b
	[0086.923] ReadFile (in: hFile=0x234, lpBuffer=0x26674b0, nNumberOfBytesToRead=0x1c9b, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26674b0*, lpNumberOfBytesRead=0x26eb64*=0x1c9b, lpOverlapped=0x0) returned 1
	[0086.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.930] GetFileType (hFile=0x234) returned 0x1
	[0086.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.930] GetFileType (hFile=0x234) returned 0x1
	[0086.931] WriteFile (in: hFile=0x234, lpBuffer=0x266a938*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x266a938*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.934] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg")) returned 1
	[0086.937] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEd5bF[1].jpg", cAlternateFileName="BBED5B~1.JPG")) returned 1
	[0086.938] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.939] GetFileType (hFile=0x234) returned 0x1
	[0086.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.939] GetFileType (hFile=0x234) returned 0x1
	[0086.939] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x702
	[0086.939] ReadFile (in: hFile=0x234, lpBuffer=0x266c914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x266c914*, lpNumberOfBytesRead=0x26eb64*=0x702, lpOverlapped=0x0) returned 1
	[0086.944] CloseHandle (hObject=0x234) returned 1
	[0086.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.945] GetFileType (hFile=0x234) returned 0x1
	[0086.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.946] GetFileType (hFile=0x234) returned 0x1
	[0086.946] WriteFile (in: hFile=0x234, lpBuffer=0x266f100*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x266f100*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.950] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg")) returned 1
	[0086.953] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdDNm[1].jpg", cAlternateFileName="BBEDDN~1.JPG")) returned 1
	[0086.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.955] GetFileType (hFile=0x234) returned 0x1
	[0086.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.956] GetFileType (hFile=0x234) returned 0x1
	[0086.956] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xaca8
	[0086.956] ReadFile (in: hFile=0x234, lpBuffer=0x26709cc, nNumberOfBytesToRead=0xaca8, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26709cc*, lpNumberOfBytesRead=0x26eb64*=0xaca8, lpOverlapped=0x0) returned 1
	[0086.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.963] GetFileType (hFile=0x234) returned 0x1
	[0086.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.963] GetFileType (hFile=0x234) returned 0x1
	[0086.964] WriteFile (in: hFile=0x234, lpBuffer=0x267ce60*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x267ce60*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.967] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg")) returned 1
	[0086.971] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdpyr[1].jpg", cAlternateFileName="BBEDPY~1.JPG")) returned 1
	[0086.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.973] GetFileType (hFile=0x234) returned 0x1
	[0086.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.974] GetFileType (hFile=0x234) returned 0x1
	[0086.974] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x755
	[0086.974] ReadFile (in: hFile=0x234, lpBuffer=0x267ee90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x267ee90*, lpNumberOfBytesRead=0x26eb64*=0x755, lpOverlapped=0x0) returned 1
	[0086.980] CloseHandle (hObject=0x234) returned 1
	[0086.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.981] GetFileType (hFile=0x234) returned 0x1
	[0086.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.981] GetFileType (hFile=0x234) returned 0x1
	[0086.982] WriteFile (in: hFile=0x234, lpBuffer=0x268167c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x268167c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.985] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg")) returned 1
	[0086.988] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdQdv[1].jpg", cAlternateFileName="BBEDQD~1.JPG")) returned 1
	[0086.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0086.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.989] GetFileType (hFile=0x234) returned 0x1
	[0086.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0086.990] GetFileType (hFile=0x234) returned 0x1
	[0086.990] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1c72
	[0086.990] ReadFile (in: hFile=0x234, lpBuffer=0x2682f48, nNumberOfBytesToRead=0x1c72, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2682f48*, lpNumberOfBytesRead=0x26eb64*=0x1c72, lpOverlapped=0x0) returned 1
	[0086.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0086.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0086.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0086.995] GetFileType (hFile=0x234) returned 0x1
	[0086.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0086.995] GetFileType (hFile=0x234) returned 0x1
	[0086.996] WriteFile (in: hFile=0x234, lpBuffer=0x26863a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26863a8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0086.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", lpFilePart=0x0) returned 0x7e
	[0086.999] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg")) returned 1
	[0087.002] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEe62t[1].jpg", cAlternateFileName="BBEE62~1.JPG")) returned 1
	[0087.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.004] GetFileType (hFile=0x234) returned 0x1
	[0087.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.004] GetFileType (hFile=0x234) returned 0x1
	[0087.004] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xa23
	[0087.004] ReadFile (in: hFile=0x234, lpBuffer=0x26886a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26886a4*, lpNumberOfBytesRead=0x26eb64*=0xa23, lpOverlapped=0x0) returned 1
	[0087.009] CloseHandle (hObject=0x234) returned 1
	[0087.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.010] GetFileType (hFile=0x234) returned 0x1
	[0087.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.010] GetFileType (hFile=0x234) returned 0x1
	[0087.010] WriteFile (in: hFile=0x234, lpBuffer=0x268ae90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x268ae90*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.014] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg")) returned 1
	[0087.016] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEedPR[1].jpg", cAlternateFileName="BBEEDP~1.JPG")) returned 1
	[0087.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.018] GetFileType (hFile=0x234) returned 0x1
	[0087.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.018] GetFileType (hFile=0x234) returned 0x1
	[0087.018] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1ca7
	[0087.018] ReadFile (in: hFile=0x234, lpBuffer=0x268c75c, nNumberOfBytesToRead=0x1ca7, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x268c75c*, lpNumberOfBytesRead=0x26eb64*=0x1ca7, lpOverlapped=0x0) returned 1
	[0087.024] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.025] GetFileType (hFile=0x234) returned 0x1
	[0087.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.025] GetFileType (hFile=0x234) returned 0x1
	[0087.026] WriteFile (in: hFile=0x234, lpBuffer=0x268fbf0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x268fbf0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.029] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg")) returned 1
	[0087.032] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe34d9d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe34d9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeTpB[1].jpg", cAlternateFileName="BBEETP~1.JPG")) returned 1
	[0087.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.033] GetFileType (hFile=0x234) returned 0x1
	[0087.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.033] GetFileType (hFile=0x234) returned 0x1
	[0087.033] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x9ef
	[0087.034] ReadFile (in: hFile=0x234, lpBuffer=0x2691eb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2691eb8*, lpNumberOfBytesRead=0x26eb64*=0x9ef, lpOverlapped=0x0) returned 1
	[0087.038] CloseHandle (hObject=0x234) returned 1
	[0087.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.039] GetFileType (hFile=0x234) returned 0x1
	[0087.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.039] GetFileType (hFile=0x234) returned 0x1
	[0087.040] WriteFile (in: hFile=0x234, lpBuffer=0x26946a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26946a4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.043] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.043] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg")) returned 1
	[0087.046] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 1
	[0087.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.048] GetFileType (hFile=0x234) returned 0x1
	[0087.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.049] GetFileType (hFile=0x234) returned 0x1
	[0087.049] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x952
	[0087.049] ReadFile (in: hFile=0x234, lpBuffer=0x26968d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26968d0*, lpNumberOfBytesRead=0x26eb64*=0x952, lpOverlapped=0x0) returned 1
	[0087.070] CloseHandle (hObject=0x234) returned 1
	[0087.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.072] GetFileType (hFile=0x234) returned 0x1
	[0087.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.072] GetFileType (hFile=0x234) returned 0x1
	[0087.073] WriteFile (in: hFile=0x234, lpBuffer=0x26990bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26990bc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.076] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg")) returned 1
	[0087.080] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeU5U[1].jpg", cAlternateFileName="BBEEU5~1.JPG")) returned 1
	[0087.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.081] GetFileType (hFile=0x234) returned 0x1
	[0087.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.081] GetFileType (hFile=0x234) returned 0x1
	[0087.081] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7a9
	[0087.081] ReadFile (in: hFile=0x234, lpBuffer=0x269b140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x269b140*, lpNumberOfBytesRead=0x26eb64*=0x7a9, lpOverlapped=0x0) returned 1
	[0087.087] CloseHandle (hObject=0x234) returned 1
	[0087.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.088] GetFileType (hFile=0x234) returned 0x1
	[0087.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.089] GetFileType (hFile=0x234) returned 0x1
	[0087.089] WriteFile (in: hFile=0x234, lpBuffer=0x269d92c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x269d92c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.092] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg")) returned 1
	[0087.096] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEf306[1].jpg", cAlternateFileName="BBEF30~1.JPG")) returned 1
	[0087.096] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.097] GetFileType (hFile=0x234) returned 0x1
	[0087.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.097] GetFileType (hFile=0x234) returned 0x1
	[0087.097] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x86f
	[0087.098] ReadFile (in: hFile=0x234, lpBuffer=0x269fa74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x269fa74*, lpNumberOfBytesRead=0x26eb64*=0x86f, lpOverlapped=0x0) returned 1
	[0087.103] CloseHandle (hObject=0x234) returned 1
	[0087.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.104] GetFileType (hFile=0x234) returned 0x1
	[0087.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.104] GetFileType (hFile=0x234) returned 0x1
	[0087.105] WriteFile (in: hFile=0x234, lpBuffer=0x26a2260*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26a2260*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.108] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg")) returned 1
	[0087.111] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEf54R[1].jpg", cAlternateFileName="BBEF54~1.JPG")) returned 1
	[0087.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.113] GetFileType (hFile=0x234) returned 0x1
	[0087.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.113] GetFileType (hFile=0x234) returned 0x1
	[0087.113] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x828
	[0087.113] ReadFile (in: hFile=0x234, lpBuffer=0x26a4360, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26a4360*, lpNumberOfBytesRead=0x26eb64*=0x828, lpOverlapped=0x0) returned 1
	[0087.119] CloseHandle (hObject=0x234) returned 1
	[0087.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.120] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.121] GetFileType (hFile=0x234) returned 0x1
	[0087.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.121] GetFileType (hFile=0x234) returned 0x1
	[0087.121] WriteFile (in: hFile=0x234, lpBuffer=0x26a6b4c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26a6b4c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.126] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg")) returned 1
	[0087.130] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfBbH[1].jpg", cAlternateFileName="BBEFBB~1.JPG")) returned 1
	[0087.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.131] GetFileType (hFile=0x234) returned 0x1
	[0087.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.131] GetFileType (hFile=0x234) returned 0x1
	[0087.132] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3860
	[0087.132] ReadFile (in: hFile=0x234, lpBuffer=0x26a8418, nNumberOfBytesToRead=0x3860, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26a8418*, lpNumberOfBytesRead=0x26eb64*=0x3860, lpOverlapped=0x0) returned 1
	[0087.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.138] GetFileType (hFile=0x234) returned 0x1
	[0087.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.138] GetFileType (hFile=0x234) returned 0x1
	[0087.138] WriteFile (in: hFile=0x234, lpBuffer=0x26ad464*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26ad464*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.141] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg")) returned 1
	[0087.145] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfBq0[1].jpg", cAlternateFileName="BBEFBQ~1.JPG")) returned 1
	[0087.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.147] GetFileType (hFile=0x234) returned 0x1
	[0087.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.147] GetFileType (hFile=0x234) returned 0x1
	[0087.147] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x19a5
	[0087.147] ReadFile (in: hFile=0x234, lpBuffer=0x26aed30, nNumberOfBytesToRead=0x19a5, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26aed30*, lpNumberOfBytesRead=0x26eb64*=0x19a5, lpOverlapped=0x0) returned 1
	[0087.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.152] GetFileType (hFile=0x234) returned 0x1
	[0087.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.153] GetFileType (hFile=0x234) returned 0x1
	[0087.153] WriteFile (in: hFile=0x234, lpBuffer=0x26b1ec4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26b1ec4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.156] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg")) returned 1
	[0087.160] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfBrz[1].jpg", cAlternateFileName="BBEFBR~1.JPG")) returned 1
	[0087.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.161] GetFileType (hFile=0x234) returned 0x1
	[0087.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.161] GetFileType (hFile=0x234) returned 0x1
	[0087.162] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2619
	[0087.162] ReadFile (in: hFile=0x234, lpBuffer=0x26b3790, nNumberOfBytesToRead=0x2619, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26b3790*, lpNumberOfBytesRead=0x26eb64*=0x2619, lpOverlapped=0x0) returned 1
	[0087.167] CloseHandle (hObject=0x234) returned 1
	[0087.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.168] GetFileType (hFile=0x234) returned 0x1
	[0087.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.169] GetFileType (hFile=0x234) returned 0x1
	[0087.169] WriteFile (in: hFile=0x234, lpBuffer=0x26b7598*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26b7598*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.172] CloseHandle (hObject=0x234) returned 1
	[0087.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.172] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg")) returned 1
	[0087.177] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfXl6[1].jpg", cAlternateFileName="BBEFXL~1.JPG")) returned 1
	[0087.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.178] GetFileType (hFile=0x234) returned 0x1
	[0087.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.178] GetFileType (hFile=0x234) returned 0x1
	[0087.178] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1f84
	[0087.178] ReadFile (in: hFile=0x234, lpBuffer=0x26b8e64, nNumberOfBytesToRead=0x1f84, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26b8e64*, lpNumberOfBytesRead=0x26eb64*=0x1f84, lpOverlapped=0x0) returned 1
	[0087.182] CloseHandle (hObject=0x234) returned 1
	[0087.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.184] GetFileType (hFile=0x234) returned 0x1
	[0087.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.184] GetFileType (hFile=0x234) returned 0x1
	[0087.184] WriteFile (in: hFile=0x234, lpBuffer=0x26bc5d4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26bc5d4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.187] CloseHandle (hObject=0x234) returned 1
	[0087.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.188] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg")) returned 1
	[0087.191] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbded7090, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbded7090, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbded7090, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgEH3[1].jpg", cAlternateFileName="BBEGEH~1.JPG")) returned 1
	[0087.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.192] GetFileType (hFile=0x234) returned 0x1
	[0087.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.192] GetFileType (hFile=0x234) returned 0x1
	[0087.192] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1c7e
	[0087.193] ReadFile (in: hFile=0x234, lpBuffer=0x26bdea0, nNumberOfBytesToRead=0x1c7e, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26bdea0*, lpNumberOfBytesRead=0x26eb64*=0x1c7e, lpOverlapped=0x0) returned 1
	[0087.197] CloseHandle (hObject=0x234) returned 1
	[0087.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.198] GetFileType (hFile=0x234) returned 0x1
	[0087.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.198] GetFileType (hFile=0x234) returned 0x1
	[0087.199] WriteFile (in: hFile=0x234, lpBuffer=0x26c130c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26c130c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.202] CloseHandle (hObject=0x234) returned 1
	[0087.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.202] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg")) returned 1
	[0087.206] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 1
	[0087.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.208] GetFileType (hFile=0x234) returned 0x1
	[0087.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.208] GetFileType (hFile=0x234) returned 0x1
	[0087.208] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x8f9
	[0087.208] ReadFile (in: hFile=0x234, lpBuffer=0x26c34e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26c34e0*, lpNumberOfBytesRead=0x26eb64*=0x8f9, lpOverlapped=0x0) returned 1
	[0087.213] CloseHandle (hObject=0x234) returned 1
	[0087.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.214] GetFileType (hFile=0x234) returned 0x1
	[0087.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.215] GetFileType (hFile=0x234) returned 0x1
	[0087.215] WriteFile (in: hFile=0x234, lpBuffer=0x26c5ccc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26c5ccc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.218] CloseHandle (hObject=0x234) returned 1
	[0087.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.218] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg")) returned 1
	[0087.221] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgTxB[1].jpg", cAlternateFileName="BBEGTX~1.JPG")) returned 1
	[0087.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.223] GetFileType (hFile=0x234) returned 0x1
	[0087.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.223] GetFileType (hFile=0x234) returned 0x1
	[0087.223] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x9b7
	[0087.223] ReadFile (in: hFile=0x234, lpBuffer=0x26c7f5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26c7f5c*, lpNumberOfBytesRead=0x26eb64*=0x9b7, lpOverlapped=0x0) returned 1
	[0087.228] CloseHandle (hObject=0x234) returned 1
	[0087.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.229] GetFileType (hFile=0x234) returned 0x1
	[0087.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.229] GetFileType (hFile=0x234) returned 0x1
	[0087.230] WriteFile (in: hFile=0x234, lpBuffer=0x26ca748*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26ca748*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.233] CloseHandle (hObject=0x234) returned 1
	[0087.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.233] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg")) returned 1
	[0087.236] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBo1lFJ[2].png", cAlternateFileName="BBO1LF~2.PNG")) returned 1
	[0087.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png", lpFilePart=0x0) returned 0x7e
	[0087.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.238] GetFileType (hFile=0x234) returned 0x1
	[0087.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.238] GetFileType (hFile=0x234) returned 0x1
	[0087.238] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x36e
	[0087.238] ReadFile (in: hFile=0x234, lpBuffer=0x26cc390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26cc390*, lpNumberOfBytesRead=0x26eb64*=0x36e, lpOverlapped=0x0) returned 1
	[0087.243] CloseHandle (hObject=0x234) returned 1
	[0087.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png.KEKW", lpFilePart=0x0) returned 0x83
	[0087.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.245] GetFileType (hFile=0x234) returned 0x1
	[0087.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.245] GetFileType (hFile=0x234) returned 0x1
	[0087.245] WriteFile (in: hFile=0x234, lpBuffer=0x26ceb7c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26ceb7c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.248] CloseHandle (hObject=0x234) returned 1
	[0087.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png", lpFilePart=0x0) returned 0x7e
	[0087.248] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png")) returned 1
	[0087.251] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x455f5430, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x455f5430, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455f5430, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBs47TE[1].png", cAlternateFileName="BBS47T~1.PNG")) returned 1
	[0087.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png", lpFilePart=0x0) returned 0x7e
	[0087.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.253] GetFileType (hFile=0x234) returned 0x1
	[0087.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.253] GetFileType (hFile=0x234) returned 0x1
	[0087.253] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x23f
	[0087.254] ReadFile (in: hFile=0x234, lpBuffer=0x26d0694, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26d0694*, lpNumberOfBytesRead=0x26eb64*=0x23f, lpOverlapped=0x0) returned 1
	[0087.258] CloseHandle (hObject=0x234) returned 1
	[0087.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0087.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.259] GetFileType (hFile=0x234) returned 0x1
	[0087.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.259] GetFileType (hFile=0x234) returned 0x1
	[0087.260] WriteFile (in: hFile=0x234, lpBuffer=0x26d2e80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26d2e80*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.263] CloseHandle (hObject=0x234) returned 1
	[0087.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png", lpFilePart=0x0) returned 0x7e
	[0087.264] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png")) returned 1
	[0087.267] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBu9sWQ[1].jpg", cAlternateFileName="BBU9SW~1.JPG")) returned 1
	[0087.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.268] GetFileType (hFile=0x234) returned 0x1
	[0087.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.268] GetFileType (hFile=0x234) returned 0x1
	[0087.268] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2cb0
	[0087.269] ReadFile (in: hFile=0x234, lpBuffer=0x26d474c, nNumberOfBytesToRead=0x2cb0, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26d474c*, lpNumberOfBytesRead=0x26eb64*=0x2cb0, lpOverlapped=0x0) returned 1
	[0087.274] CloseHandle (hObject=0x234) returned 1
	[0087.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.275] GetFileType (hFile=0x234) returned 0x1
	[0087.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.276] GetFileType (hFile=0x234) returned 0x1
	[0087.276] WriteFile (in: hFile=0x234, lpBuffer=0x26d8be8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26d8be8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.279] CloseHandle (hObject=0x234) returned 1
	[0087.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0087.279] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg")) returned 1
	[0087.282] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BByazif[2].jpg", cAlternateFileName="BBYAZI~2.JPG")) returned 1
	[0087.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg", lpFilePart=0x0) returned 0x7e
	[0087.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.284] GetFileType (hFile=0x234) returned 0x1
	[0087.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.284] GetFileType (hFile=0x234) returned 0x1
	[0087.284] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x228c
	[0087.284] ReadFile (in: hFile=0x234, lpBuffer=0x26da4b4, nNumberOfBytesToRead=0x228c, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26da4b4*, lpNumberOfBytesRead=0x26eb64*=0x228c, lpOverlapped=0x0) returned 1
	[0087.291] CloseHandle (hObject=0x234) returned 1
	[0087.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0087.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.291] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.292] GetFileType (hFile=0x234) returned 0x1
	[0087.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.292] GetFileType (hFile=0x234) returned 0x1
	[0087.293] WriteFile (in: hFile=0x234, lpBuffer=0x26ddf2c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26ddf2c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.296] CloseHandle (hObject=0x234) returned 1
	[0087.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg", lpFilePart=0x0) returned 0x7e
	[0087.296] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg")) returned 1
	[0087.299] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="bs-components[1].css", cAlternateFileName="BS-COM~1.CSS")) returned 1
	[0087.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css", lpFilePart=0x0) returned 0x84
	[0087.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.300] GetFileType (hFile=0x234) returned 0x1
	[0087.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.301] GetFileType (hFile=0x234) returned 0x1
	[0087.301] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xaf13
	[0087.301] ReadFile (in: hFile=0x234, lpBuffer=0x26df858, nNumberOfBytesToRead=0xaf13, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26df858*, lpNumberOfBytesRead=0x26eb64*=0xaf13, lpOverlapped=0x0) returned 1
	[0087.306] CloseHandle (hObject=0x234) returned 1
	[0087.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css.KEKW", lpFilePart=0x0) returned 0x89
	[0087.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.307] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.307] GetFileType (hFile=0x234) returned 0x1
	[0087.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.308] GetFileType (hFile=0x234) returned 0x1
	[0087.308] WriteFile (in: hFile=0x234, lpBuffer=0x26ebf7c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26ebf7c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.311] CloseHandle (hObject=0x234) returned 1
	[0087.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css", lpFilePart=0x0) returned 0x84
	[0087.312] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-components[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-components[1].css")) returned 1
	[0087.316] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30be, dwReserved0=0x0, dwReserved1=0x0, cFileName="bs-util[1].css", cAlternateFileName="BS-UTI~1.CSS")) returned 1
	[0087.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css", lpFilePart=0x0) returned 0x7e
	[0087.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.318] GetFileType (hFile=0x234) returned 0x1
	[0087.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.318] GetFileType (hFile=0x234) returned 0x1
	[0087.318] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x30be
	[0087.318] ReadFile (in: hFile=0x234, lpBuffer=0x26ed854, nNumberOfBytesToRead=0x30be, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26ed854*, lpNumberOfBytesRead=0x26eb64*=0x30be, lpOverlapped=0x0) returned 1
	[0087.323] CloseHandle (hObject=0x234) returned 1
	[0087.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css.KEKW", lpFilePart=0x0) returned 0x83
	[0087.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.324] GetFileType (hFile=0x234) returned 0x1
	[0087.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.324] GetFileType (hFile=0x234) returned 0x1
	[0087.325] WriteFile (in: hFile=0x234, lpBuffer=0x26f2100*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26f2100*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.328] CloseHandle (hObject=0x234) returned 1
	[0087.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css", lpFilePart=0x0) returned 0x7e
	[0087.328] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\bs-util[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bs-util[1].css")) returned 1
	[0087.332] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd97bf10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbd97bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd9a2070, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="c7-bdbd0d-91cdfbc1[1].txt", cAlternateFileName="C7-BDB~1.TXT")) returned 1
	[0087.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x89
	[0087.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.333] GetFileType (hFile=0x234) returned 0x1
	[0087.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.334] GetFileType (hFile=0x234) returned 0x1
	[0087.334] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x254f1
	[0087.335] ReadFile (in: hFile=0x234, lpBuffer=0x37ad3a0, nNumberOfBytesToRead=0x254f1, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x37ad3a0*, lpNumberOfBytesRead=0x26eb64*=0x254f1, lpOverlapped=0x0) returned 1
	[0087.348] CloseHandle (hObject=0x234) returned 1
	[0087.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt.KEKW", lpFilePart=0x0) returned 0x8e
	[0087.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.349] GetFileType (hFile=0x234) returned 0x1
	[0087.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.349] GetFileType (hFile=0x234) returned 0x1
	[0087.350] WriteFile (in: hFile=0x234, lpBuffer=0x26f529c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26f529c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.353] CloseHandle (hObject=0x234) returned 1
	[0087.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt", lpFilePart=0x0) returned 0x89
	[0087.353] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt")) returned 1
	[0087.359] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x614e4380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x614e4380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x614e4380, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x211dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1
	[0087.360] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63c04d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c04d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63c04d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x653e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cb=gapi[2].loaded_0", cAlternateFileName="CB_GAP~2.LOA")) returned 1
	[0087.360] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x584c4b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x584c4b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58510e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a03f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.min[1].css", cAlternateFileName="CHROME~1.CSS")) returned 1
	[0087.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css", lpFilePart=0x0) returned 0x81
	[0087.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.362] GetFileType (hFile=0x234) returned 0x1
	[0087.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.364] GetFileType (hFile=0x234) returned 0x1
	[0087.364] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2a03f
	[0087.365] ReadFile (in: hFile=0x234, lpBuffer=0x37d28b0, nNumberOfBytesToRead=0x2a03f, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x37d28b0*, lpNumberOfBytesRead=0x26eb64*=0x2a03f, lpOverlapped=0x0) returned 1
	[0087.379] CloseHandle (hObject=0x234) returned 1
	[0087.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css.KEKW", lpFilePart=0x0) returned 0x86
	[0087.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.381] GetFileType (hFile=0x234) returned 0x1
	[0087.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.381] GetFileType (hFile=0x234) returned 0x1
	[0087.382] WriteFile (in: hFile=0x234, lpBuffer=0x26f9074*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26f9074*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.385] CloseHandle (hObject=0x234) returned 1
	[0087.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css", lpFilePart=0x0) returned 0x81
	[0087.385] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome.min[1].css")) returned 1
	[0087.391] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c69520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c69520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c69520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_throbber_fast_16[1].gif", cAlternateFileName="CHROME~1.GIF")) returned 1
	[0087.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif", lpFilePart=0x0) returned 0x8e
	[0087.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.393] GetFileType (hFile=0x234) returned 0x1
	[0087.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.393] GetFileType (hFile=0x234) returned 0x1
	[0087.393] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x60c
	[0087.394] ReadFile (in: hFile=0x234, lpBuffer=0x26fb05c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26fb05c*, lpNumberOfBytesRead=0x26eb64*=0x60c, lpOverlapped=0x0) returned 1
	[0087.399] CloseHandle (hObject=0x234) returned 1
	[0087.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif.KEKW", lpFilePart=0x0) returned 0x93
	[0087.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.400] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.401] GetFileType (hFile=0x234) returned 0x1
	[0087.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.401] GetFileType (hFile=0x234) returned 0x1
	[0087.402] WriteFile (in: hFile=0x234, lpBuffer=0x26fd8a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26fd8a8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.405] CloseHandle (hObject=0x234) returned 1
	[0087.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif", lpFilePart=0x0) returned 0x8e
	[0087.409] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif")) returned 1
	[0087.430] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55333bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55333bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1
	[0087.431] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif", lpFilePart=0x0) returned 0x7e
	[0087.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.432] GetFileType (hFile=0x234) returned 0x1
	[0087.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.432] GetFileType (hFile=0x234) returned 0x1
	[0087.432] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2b
	[0087.433] ReadFile (in: hFile=0x234, lpBuffer=0x26ff1cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26ff1cc*, lpNumberOfBytesRead=0x26eb64*=0x2b, lpOverlapped=0x0) returned 1
	[0087.440] CloseHandle (hObject=0x234) returned 1
	[0087.441] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif.KEKW", lpFilePart=0x0) returned 0x83
	[0087.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.442] GetFileType (hFile=0x234) returned 0x1
	[0087.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.443] GetFileType (hFile=0x234) returned 0x1
	[0087.443] WriteFile (in: hFile=0x234, lpBuffer=0x27019b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27019b8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.446] CloseHandle (hObject=0x234) returned 1
	[0087.446] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif", lpFilePart=0x0) returned 0x7e
	[0087.446] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif")) returned 1
	[0087.450] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8f4e10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8f4e10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8f4e10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1
	[0087.450] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js", lpFilePart=0x0) returned 0x82
	[0087.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.453] GetFileType (hFile=0x234) returned 0x1
	[0087.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.453] GetFileType (hFile=0x234) returned 0x1
	[0087.453] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7b1
	[0087.453] ReadFile (in: hFile=0x234, lpBuffer=0x2703a84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2703a84*, lpNumberOfBytesRead=0x26eb64*=0x7b1, lpOverlapped=0x0) returned 1
	[0087.459] CloseHandle (hObject=0x234) returned 1
	[0087.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js.KEKW", lpFilePart=0x0) returned 0x87
	[0087.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.460] GetFileType (hFile=0x234) returned 0x1
	[0087.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.461] GetFileType (hFile=0x234) returned 0x1
	[0087.461] WriteFile (in: hFile=0x234, lpBuffer=0x2706288*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2706288*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js", lpFilePart=0x0) returned 0x82
	[0087.468] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\containertag[1].js")) returned 1
	[0087.471] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0087.472] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d9a020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d9a020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60de62e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula-mac[1].jpg", cAlternateFileName="EULA-M~1.JPG")) returned 1
	[0087.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg", lpFilePart=0x0) returned 0x7f
	[0087.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.473] GetFileType (hFile=0x234) returned 0x1
	[0087.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.473] GetFileType (hFile=0x234) returned 0x1
	[0087.474] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x48ba
	[0087.474] ReadFile (in: hFile=0x234, lpBuffer=0x2708134, nNumberOfBytesToRead=0x48ba, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2708134*, lpNumberOfBytesRead=0x26eb64*=0x48ba, lpOverlapped=0x0) returned 1
	[0087.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.KEKW", lpFilePart=0x0) returned 0x84
	[0087.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.483] GetFileType (hFile=0x234) returned 0x1
	[0087.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.483] GetFileType (hFile=0x234) returned 0x1
	[0087.483] WriteFile (in: hFile=0x234, lpBuffer=0x270e1e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x270e1e8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg", lpFilePart=0x0) returned 0x7f
	[0087.487] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg")) returned 1
	[0087.490] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa84a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ga[1].js", cAlternateFileName="GA_1_~1.JS")) returned 1
	[0087.491] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js", lpFilePart=0x0) returned 0x78
	[0087.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.493] GetFileType (hFile=0x234) returned 0x1
	[0087.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.493] GetFileType (hFile=0x234) returned 0x1
	[0087.493] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xa84a
	[0087.494] ReadFile (in: hFile=0x234, lpBuffer=0x270fa54, nNumberOfBytesToRead=0xa84a, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x270fa54*, lpNumberOfBytesRead=0x26eb64*=0xa84a, lpOverlapped=0x0) returned 1
	[0087.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js.KEKW", lpFilePart=0x0) returned 0x7d
	[0087.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.500] GetFileType (hFile=0x234) returned 0x1
	[0087.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.500] GetFileType (hFile=0x234) returned 0x1
	[0087.501] WriteFile (in: hFile=0x234, lpBuffer=0x271ba68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x271ba68*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js", lpFilePart=0x0) returned 0x78
	[0087.504] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\ga[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ga[1].js")) returned 1
	[0087.508] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe1f6d70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~1")) returned 1
	[0087.509] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x659c6020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x659c6020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65c99a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleInstaller_de[1].application", cAlternateFileName="GOOGLE~1.APP")) returned 1
	[0087.509] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf03f170, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf03f170, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf0652d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1
	[0087.510] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2544b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2544b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2544b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1
	[0087.510] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54feddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54feddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x550601d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7a43, dwReserved0=0x0, dwReserved1=0x0, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1
	[0087.511] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d1a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a114, dwReserved0=0x0, dwReserved1=0x0, cFileName="MemMDL2.2.17[1].eot", cAlternateFileName="MEMMDL~1.EOT")) returned 1
	[0087.512] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605b7740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605b7740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605b7740, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="modernizr[1].js", cAlternateFileName="MODERN~1.JS")) returned 1
	[0087.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js", lpFilePart=0x0) returned 0x7f
	[0087.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.514] GetFileType (hFile=0x234) returned 0x1
	[0087.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.515] GetFileType (hFile=0x234) returned 0x1
	[0087.515] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x46c9
	[0087.515] ReadFile (in: hFile=0x234, lpBuffer=0x271ff9c, nNumberOfBytesToRead=0x46c9, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x271ff9c*, lpNumberOfBytesRead=0x26eb64*=0x46c9, lpOverlapped=0x0) returned 1
	[0087.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js.KEKW", lpFilePart=0x0) returned 0x84
	[0087.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.522] GetFileType (hFile=0x234) returned 0x1
	[0087.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.522] GetFileType (hFile=0x234) returned 0x1
	[0087.523] WriteFile (in: hFile=0x234, lpBuffer=0x2725e60*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2725e60*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js", lpFilePart=0x0) returned 0x7f
	[0087.526] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\modernizr[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\modernizr[1].js")) returned 1
	[0087.529] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNIdSync[1].js", cAlternateFileName="MSNIDS~1.JS")) returned 1
	[0087.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js", lpFilePart=0x0) returned 0x7f
	[0087.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.531] GetFileType (hFile=0x234) returned 0x1
	[0087.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.531] GetFileType (hFile=0x234) returned 0x1
	[0087.531] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xec5
	[0087.531] ReadFile (in: hFile=0x234, lpBuffer=0x2728604, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2728604*, lpNumberOfBytesRead=0x26eb64*=0xec5, lpOverlapped=0x0) returned 1
	[0087.535] CloseHandle (hObject=0x234) returned 1
	[0087.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js.KEKW", lpFilePart=0x0) returned 0x84
	[0087.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.537] GetFileType (hFile=0x234) returned 0x1
	[0087.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.537] GetFileType (hFile=0x234) returned 0x1
	[0087.538] WriteFile (in: hFile=0x234, lpBuffer=0x272adfc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x272adfc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js", lpFilePart=0x0) returned 0x7f
	[0087.541] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MSNIdSync[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\msnidsync[1].js")) returned 1
	[0087.544] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1
	[0087.545] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="player[1].js", cAlternateFileName="PLAYER~1.JS")) returned 1
	[0087.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js", lpFilePart=0x0) returned 0x7c
	[0087.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.546] GetFileType (hFile=0x234) returned 0x1
	[0087.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.546] GetFileType (hFile=0x234) returned 0x1
	[0087.547] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x6b6d
	[0087.547] ReadFile (in: hFile=0x234, lpBuffer=0x272cca0, nNumberOfBytesToRead=0x6b6d, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x272cca0*, lpNumberOfBytesRead=0x26eb64*=0x6b6d, lpOverlapped=0x0) returned 1
	[0087.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js.KEKW", lpFilePart=0x0) returned 0x81
	[0087.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.553] GetFileType (hFile=0x234) returned 0x1
	[0087.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.554] GetFileType (hFile=0x234) returned 0x1
	[0087.554] WriteFile (in: hFile=0x234, lpBuffer=0x2734ff0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2734ff0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js", lpFilePart=0x0) returned 0x7c
	[0087.557] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[1].js")) returned 1
	[0087.561] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5f44, dwReserved0=0x0, dwReserved1=0x0, cFileName="player[2].js", cAlternateFileName="PLAYER~2.JS")) returned 1
	[0087.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js", lpFilePart=0x0) returned 0x7c
	[0087.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.562] GetFileType (hFile=0x234) returned 0x1
	[0087.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.562] GetFileType (hFile=0x234) returned 0x1
	[0087.562] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x5f44
	[0087.563] ReadFile (in: hFile=0x234, lpBuffer=0x2736898, nNumberOfBytesToRead=0x5f44, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2736898*, lpNumberOfBytesRead=0x26eb64*=0x5f44, lpOverlapped=0x0) returned 1
	[0087.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js.KEKW", lpFilePart=0x0) returned 0x81
	[0087.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.569] GetFileType (hFile=0x234) returned 0x1
	[0087.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.569] GetFileType (hFile=0x234) returned 0x1
	[0087.569] WriteFile (in: hFile=0x234, lpBuffer=0x273dfbc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x273dfbc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js", lpFilePart=0x0) returned 0x7c
	[0087.573] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\player[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\player[2].js")) returned 1
	[0087.576] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfb41730, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfb41730, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfb41730, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 1
	[0087.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png", lpFilePart=0x0) returned 0x7f
	[0087.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.582] GetFileType (hFile=0x234) returned 0x1
	[0087.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.582] GetFileType (hFile=0x234) returned 0x1
	[0087.582] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x67
	[0087.583] ReadFile (in: hFile=0x234, lpBuffer=0x273f900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x273f900*, lpNumberOfBytesRead=0x26eb64*=0x67, lpOverlapped=0x0) returned 1
	[0087.604] CloseHandle (hObject=0x234) returned 1
	[0087.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png.KEKW", lpFilePart=0x0) returned 0x84
	[0087.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.618] GetFileType (hFile=0x234) returned 0x1
	[0087.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.619] GetFileType (hFile=0x234) returned 0x1
	[0087.619] WriteFile (in: hFile=0x234, lpBuffer=0x27420f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27420f8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png", lpFilePart=0x0) returned 0x7f
	[0087.637] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png")) returned 1
	[0087.643] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x692027e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x692027e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69232580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x0, dwReserved1=0x0, cFileName="thankyou[1].htm", cAlternateFileName="THANKY~1.HTM")) returned 1
	[0087.643] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x0, dwReserved1=0x0, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 1
	[0087.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg", lpFilePart=0x0) returned 0x79
	[0087.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.646] GetFileType (hFile=0x234) returned 0x1
	[0087.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.646] GetFileType (hFile=0x234) returned 0x1
	[0087.646] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x911
	[0087.647] ReadFile (in: hFile=0x234, lpBuffer=0x27448b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27448b0*, lpNumberOfBytesRead=0x26eb64*=0x911, lpOverlapped=0x0) returned 1
	[0087.654] CloseHandle (hObject=0x234) returned 1
	[0087.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.KEKW", lpFilePart=0x0) returned 0x7e
	[0087.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.655] GetFileType (hFile=0x234) returned 0x1
	[0087.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.656] GetFileType (hFile=0x234) returned 0x1
	[0087.656] WriteFile (in: hFile=0x234, lpBuffer=0x2747084*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2747084*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.660] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg", lpFilePart=0x0) returned 0x79
	[0087.660] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg")) returned 1
	[0087.664] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0087.665] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0087.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0087.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0087.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\Decrypt.txt", lpFilePart=0x0) returned 0x7b
	[0087.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0087.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0087.666] GetFileType (hFile=0x230) returned 0x1
	[0087.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0087.666] GetFileType (hFile=0x230) returned 0x1
	[0087.667] WriteFile (in: hFile=0x230, lpBuffer=0x27498dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x27498dc*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0087.670] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0087.670] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 1
	[0087.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0087.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8", lpFilePart=0x0) returned 0x6f
	[0087.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpFilePart=0x0) returned 0x70
	[0087.671] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0087.693] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.699] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 1
	[0087.700] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54a46970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x0, dwReserved1=0x0, cFileName="26158[1].png", cAlternateFileName="26158_~1.PNG")) returned 1
	[0087.701] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA42x3V[1].png", cAlternateFileName="AA42X3~1.PNG")) returned 1
	[0087.701] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5341bc90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5341bc90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA58NQj[1].png", cAlternateFileName="AA58NQ~1.PNG")) returned 1
	[0087.702] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA61Ofl[1].png", cAlternateFileName="AA61OF~1.PNG")) returned 1
	[0087.702] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA6SFRQ[2].png", cAlternateFileName="AA6SFR~2.PNG")) returned 1
	[0087.703] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAa1vhm[1].png", cAlternateFileName="AAA1VH~1.PNG")) returned 1
	[0087.704] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAa1xJF[1].png", cAlternateFileName="AAA1XJ~1.PNG")) returned 1
	[0087.704] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAlG41q[1].jpg", cAlternateFileName="AALG41~1.JPG")) returned 1
	[0087.705] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAmin0Z[1].png", cAlternateFileName="AAMIN0~1.PNG")) returned 1
	[0087.706] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533f5b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533f5b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAnhRyj[1].jpg", cAlternateFileName="AANHRY~1.JPG")) returned 1
	[0087.707] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c161a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64c161a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e9d900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1
	[0087.708] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2eca30, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2eca30, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x91dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="adex[1].js", cAlternateFileName="ADEX_1~1.JS")) returned 1
	[0087.709] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x540e72d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540e72d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x540e72d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1
	[0087.709] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb6b0f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdb6b0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdb6b0f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x525b, dwReserved0=0x0, dwReserved1=0x0, cFileName="adsWrapperMSNI[1].js", cAlternateFileName="ADSWRA~1.JS")) returned 1
	[0087.710] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x0, dwReserved1=0x0, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", cAlternateFileName="AE8E98~1.JPG")) returned 1
	[0087.710] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe112530, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe112530, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1183b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ast[1].js", cAlternateFileName="AST_1_~1.JS")) returned 1
	[0087.711] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58798580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58798580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58798580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="autotrack[1].js", cAlternateFileName="AUTOTR~1.JS")) returned 1
	[0087.712] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB56XTo[1].png", cAlternateFileName="BB56XT~1.PNG")) returned 1
	[0087.712] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB5vO0g[1].png", cAlternateFileName="BB5VO0~1.PNG")) returned 1
	[0087.713] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB8AdqN[1].png", cAlternateFileName="BB8ADQ~1.PNG")) returned 1
	[0087.714] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45be8b30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45be8b30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ca7210, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBALZyp[1].jpg", cAlternateFileName="BBALZY~1.JPG")) returned 1
	[0087.714] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5360ae70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5360ae70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5360ae70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBImKp[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 1
	[0087.715] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53630fd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBMGJo[1].jpg", cAlternateFileName="BBBMGJ~1.JPG")) returned 1
	[0087.715] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBMKDF[1].jpg", cAlternateFileName="BBBMKD~1.JPG")) returned 1
	[0087.716] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBMQch[1].jpg", cAlternateFileName="BBBMQC~1.JPG")) returned 1
	[0087.717] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58321c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58321c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58321c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBMyVh[1].jpg", cAlternateFileName="BBBMYV~1.JPG")) returned 1
	[0087.717] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBNAf7[1].jpg", cAlternateFileName="BBBNAF~1.JPG")) returned 1
	[0087.718] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBNnTF[1].jpg", cAlternateFileName="BBBNNT~1.JPG")) returned 1
	[0087.718] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539c30d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539c30d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO4dZ[1].jpg", cAlternateFileName="BBBO4D~1.JPG")) returned 1
	[0087.722] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO8ow[1].jpg", cAlternateFileName="BBBO8O~1.JPG")) returned 1
	[0087.723] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOaeS[1].jpg", cAlternateFileName="BBBOAE~1.JPG")) returned 1
	[0087.723] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53278d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53278d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53278d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOcIb[1].jpg", cAlternateFileName="BBBOCI~1.JPG")) returned 1
	[0087.724] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOddp[1].jpg", cAlternateFileName="BBBODD~1.JPG")) returned 1
	[0087.725] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a1fd500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1fd500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a223660, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOmar[1].jpg", cAlternateFileName="BBBOMA~1.JPG")) returned 1
	[0087.725] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBR4yQ[1].jpg", cAlternateFileName="BBBR4Y~1.JPG")) returned 1
	[0087.726] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBUPaj[1].jpg", cAlternateFileName="BBBUPA~1.JPG")) returned 1
	[0087.726] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 1
	[0087.727] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVLcG[1].jpg", cAlternateFileName="BBBVLC~1.JPG")) returned 1
	[0087.727] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVSkP[1].jpg", cAlternateFileName="BBBVSK~1.JPG")) returned 1
	[0087.728] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x612a8ee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x612a8ee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x612a8ee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 1
	[0087.728] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBZ5vT[1].jpg", cAlternateFileName="BBBZ5V~1.JPG")) returned 1
	[0087.729] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC02Gr[1].jpg", cAlternateFileName="BBC02G~1.JPG")) returned 1
	[0087.729] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC02Gr[2].jpg", cAlternateFileName="BBC02G~2.JPG")) returned 1
	[0087.730] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 1
	[0087.730] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 1
	[0087.731] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0Djg[1].jpg", cAlternateFileName="BBC0DJ~1.JPG")) returned 1
	[0087.731] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 1
	[0087.732] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0lf2[1].jpg", cAlternateFileName="BBC0LF~1.JPG")) returned 1
	[0087.732] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2e35a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2e35a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2e35a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0mK1[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 1
	[0087.733] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0qlB[1].jpg", cAlternateFileName="BBC0QL~1.JPG")) returned 1
	[0087.733] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE7KPZ[1].jpg", cAlternateFileName="BBE7KP~1.JPG")) returned 1
	[0087.734] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE8IlA[1].jpg", cAlternateFileName="BBE8IL~1.JPG")) returned 1
	[0087.734] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE972F[1].jpg", cAlternateFileName="BBE972~1.JPG")) returned 1
	[0087.735] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE9tdx[1].jpg", cAlternateFileName="BBE9TD~1.JPG")) returned 1
	[0087.736] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdrqt[1].jpg", cAlternateFileName="BBEDRQ~1.JPG")) returned 1
	[0087.736] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeEwt[1].jpg", cAlternateFileName="BBEEEW~1.JPG")) returned 1
	[0087.737] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeis3[1].jpg", cAlternateFileName="BBEEIS~1.JPG")) returned 1
	[0087.738] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeKvV[1].jpg", cAlternateFileName="BBEEKV~1.JPG")) returned 1
	[0087.738] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a91ed0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a91ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeNd8[1].png", cAlternateFileName="BBEEND~1.PNG")) returned 1
	[0087.739] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEewZB[1].jpg", cAlternateFileName="BBEEWZ~1.JPG")) returned 1
	[0087.739] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeZ0k[1].jpg", cAlternateFileName="BBEEZ0~1.JPG")) returned 1
	[0087.743] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEf6s4[1].jpg", cAlternateFileName="BBEF6S~1.JPG")) returned 1
	[0087.743] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfAc5[1].jpg", cAlternateFileName="BBEFAC~1.JPG")) returned 1
	[0087.744] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfgDi[1].jpg", cAlternateFileName="BBEFGD~1.JPG")) returned 1
	[0087.744] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 1
	[0087.745] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfkgi[1].jpg", cAlternateFileName="BBEFKG~1.JPG")) returned 1
	[0087.746] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfRKA[1].jpg", cAlternateFileName="BBEFRK~1.JPG")) returned 1
	[0087.746] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfRwv[1].jpg", cAlternateFileName="BBEFRW~1.JPG")) returned 1
	[0087.747] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45478670, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45478670, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45478670, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 1
	[0087.749] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfY4X[1].jpg", cAlternateFileName="BBEFY4~1.JPG")) returned 1
	[0087.749] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgD9f[1].jpg", cAlternateFileName="BBEGD9~1.JPG")) returned 1
	[0087.750] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 1
	[0087.750] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgsWA[1].jpg", cAlternateFileName="BBEGSW~1.JPG")) returned 1
	[0087.751] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgX5G[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 1
	[0087.751] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBih5H[1].png", cAlternateFileName="BBIH5H~1.PNG")) returned 1
	[0087.752] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBmUxRK[1].png", cAlternateFileName="BBMUXR~1.PNG")) returned 1
	[0087.752] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBndhJA[1].png", cAlternateFileName="BBNDHJ~1.PNG")) returned 1
	[0087.753] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBoqF0J[1].png", cAlternateFileName="BBOQF0~1.PNG")) returned 1
	[0087.753] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBzjV9E[1].png", cAlternateFileName="BBZJV9~1.PNG")) returned 1
	[0087.754] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60cdb940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60cdb940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="benefits-1[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 1
	[0087.755] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6157c900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6157c900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x615c8bc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12282, dwReserved0=0x0, dwReserved1=0x0, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1
	[0087.755] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50fa0830, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x82d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="chartbeat[1].js", cAlternateFileName="CHARTB~1.JS")) returned 1
	[0087.756] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c8f680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c8f680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d01aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3bf20, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome-installer.min[1].js", cAlternateFileName="CHROME~1.JS")) returned 1
	[0087.756] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60aec760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_logo_2x[1].png", cAlternateFileName="CHROME~1.PNG")) returned 1
	[0087.757] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x610b9d00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x610b9d00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="close-icon[1].png", cAlternateFileName="CLOSE-~1.PNG")) returned 1
	[0087.757] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="css[1].txt", cAlternateFileName="CSS_1_~1.TXT")) returned 1
	[0087.758] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0087.759] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf7af630, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7af630, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf821a50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4d5b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ebHtml5Banner[1].js", cAlternateFileName="EBHTML~1.JS")) returned 1
	[0087.759] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64009240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64009240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6402f3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula-win[1].jpg", cAlternateFileName="EULA-W~1.JPG")) returned 1
	[0087.760] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1303, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~3")) returned 1
	[0087.769] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1
	[0087.771] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe138690, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe138690, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe138690, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1
	[0087.772] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510ff810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510ff810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51125970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jquery-1.11.1.min[1].js", cAlternateFileName="JQUERY~1.JS")) returned 1
	[0087.772] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5442d110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5442d110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5442d110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1
	[0087.773] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1
	[0087.774] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d66650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d66650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e70ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7154, dwReserved0=0x0, dwReserved1=0x0, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1
	[0087.774] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="latest[2].eot", cAlternateFileName="LATEST~2.EOT")) returned 1
	[0087.775] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="latest[3].eot", cAlternateFileName="LATEST~3.EOT")) returned 1
	[0087.775] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53122110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x922, dwReserved0=0x0, dwReserved1=0x0, cFileName="msn[1].htm", cAlternateFileName="MSN_1_~1.HTM")) returned 1
	[0087.776] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6378e3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6378e3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x637b4540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3112, dwReserved0=0x0, dwReserved1=0x0, cFileName="rpc_shindig_random[1].js", cAlternateFileName="RPC_SH~1.JS")) returned 1
	[0087.777] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xbf7d5790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="thirdparty[1]", cAlternateFileName="THIRDP~1")) returned 1
	[0087.777] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54adeef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x0, dwReserved1=0x0, cFileName="uid[1].htm", cAlternateFileName="UID_1_~1.HTM")) returned 1
	[0087.777] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe5d5130, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe5d5130, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3325, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1
	[0087.778] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x0, dwReserved1=0x0, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 1
	[0087.778] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x0, dwReserved1=0x0, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 0
	[0087.778] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0087.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0087.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0087.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0087.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8", lpFilePart=0x0) returned 0x6f
	[0087.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpFilePart=0x0) returned 0x70
	[0087.783] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0087.786] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0087.787] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 1
	[0087.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", lpFilePart=0x0) returned 0x9b
	[0087.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.788] GetFileType (hFile=0x234) returned 0x1
	[0087.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.788] GetFileType (hFile=0x234) returned 0x1
	[0087.788] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7f7e
	[0087.789] ReadFile (in: hFile=0x234, lpBuffer=0x275e574, nNumberOfBytesToRead=0x7f7e, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x275e574*, lpNumberOfBytesRead=0x26eb64*=0x7f7e, lpOverlapped=0x0) returned 1
	[0087.796] CloseHandle (hObject=0x234) returned 1
	[0087.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.KEKW", lpFilePart=0x0) returned 0xa0
	[0087.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.800] GetFileType (hFile=0x234) returned 0x1
	[0087.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.801] GetFileType (hFile=0x234) returned 0x1
	[0087.801] WriteFile (in: hFile=0x234, lpBuffer=0x2767d94*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2767d94*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.804] CloseHandle (hObject=0x234) returned 1
	[0087.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", lpFilePart=0x0) returned 0x9b
	[0087.805] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg")) returned 1
	[0087.809] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54a46970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x0, dwReserved1=0x0, cFileName="26158[1].png", cAlternateFileName="26158_~1.PNG")) returned 1
	[0087.809] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", lpFilePart=0x0) returned 0x7c
	[0087.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.826] GetFileType (hFile=0x234) returned 0x1
	[0087.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.826] GetFileType (hFile=0x234) returned 0x1
	[0087.827] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xc05f
	[0087.827] ReadFile (in: hFile=0x234, lpBuffer=0x2769678, nNumberOfBytesToRead=0xc05f, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2769678*, lpNumberOfBytesRead=0x26eb64*=0xc05f, lpOverlapped=0x0) returned 1
	[0087.966] CloseHandle (hObject=0x234) returned 1
	[0087.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.KEKW", lpFilePart=0x0) returned 0x81
	[0087.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.968] GetFileType (hFile=0x234) returned 0x1
	[0087.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.969] GetFileType (hFile=0x234) returned 0x1
	[0087.969] WriteFile (in: hFile=0x234, lpBuffer=0x2776eb8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2776eb8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.974] CloseHandle (hObject=0x234) returned 1
	[0087.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", lpFilePart=0x0) returned 0x7c
	[0087.975] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png")) returned 1
	[0087.980] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA42x3V[1].png", cAlternateFileName="AA42X3~1.PNG")) returned 1
	[0087.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", lpFilePart=0x0) returned 0x7e
	[0087.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.981] GetFileType (hFile=0x234) returned 0x1
	[0087.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.982] GetFileType (hFile=0x234) returned 0x1
	[0087.982] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3e3
	[0087.982] ReadFile (in: hFile=0x234, lpBuffer=0x2778b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2778b70*, lpNumberOfBytesRead=0x26eb64*=0x3e3, lpOverlapped=0x0) returned 1
	[0087.987] CloseHandle (hObject=0x234) returned 1
	[0087.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0087.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0087.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.989] GetFileType (hFile=0x234) returned 0x1
	[0087.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0087.989] GetFileType (hFile=0x234) returned 0x1
	[0087.989] WriteFile (in: hFile=0x234, lpBuffer=0x277b35c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x277b35c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0087.992] CloseHandle (hObject=0x234) returned 1
	[0087.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", lpFilePart=0x0) returned 0x7e
	[0087.993] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png")) returned 1
	[0087.997] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5341bc90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5341bc90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA58NQj[1].png", cAlternateFileName="AA58NQ~1.PNG")) returned 1
	[0087.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", lpFilePart=0x0) returned 0x7e
	[0087.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0087.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0087.999] GetFileType (hFile=0x234) returned 0x1
	[0087.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0087.999] GetFileType (hFile=0x234) returned 0x1
	[0087.999] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1d0
	[0087.999] ReadFile (in: hFile=0x234, lpBuffer=0x277ce04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x277ce04*, lpNumberOfBytesRead=0x26eb64*=0x1d0, lpOverlapped=0x0) returned 1
	[0088.006] CloseHandle (hObject=0x234) returned 1
	[0088.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0088.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.011] GetFileType (hFile=0x234) returned 0x1
	[0088.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.011] GetFileType (hFile=0x234) returned 0x1
	[0088.011] WriteFile (in: hFile=0x234, lpBuffer=0x277f5f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x277f5f0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.014] CloseHandle (hObject=0x234) returned 1
	[0088.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", lpFilePart=0x0) returned 0x7e
	[0088.015] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png")) returned 1
	[0088.018] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA61Ofl[1].png", cAlternateFileName="AA61OF~1.PNG")) returned 1
	[0088.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", lpFilePart=0x0) returned 0x7e
	[0088.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.020] GetFileType (hFile=0x234) returned 0x1
	[0088.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.020] GetFileType (hFile=0x234) returned 0x1
	[0088.020] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1c4
	[0088.020] ReadFile (in: hFile=0x234, lpBuffer=0x278108c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x278108c*, lpNumberOfBytesRead=0x26eb64*=0x1c4, lpOverlapped=0x0) returned 1
	[0088.026] CloseHandle (hObject=0x234) returned 1
	[0088.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0088.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.027] GetFileType (hFile=0x234) returned 0x1
	[0088.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.027] GetFileType (hFile=0x234) returned 0x1
	[0088.028] WriteFile (in: hFile=0x234, lpBuffer=0x2783878*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2783878*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.030] CloseHandle (hObject=0x234) returned 1
	[0088.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", lpFilePart=0x0) returned 0x7e
	[0088.031] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png")) returned 1
	[0088.034] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA6SFRQ[2].png", cAlternateFileName="AA6SFR~2.PNG")) returned 1
	[0088.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", lpFilePart=0x0) returned 0x7e
	[0088.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.035] GetFileType (hFile=0x234) returned 0x1
	[0088.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.036] GetFileType (hFile=0x234) returned 0x1
	[0088.036] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2ed
	[0088.036] ReadFile (in: hFile=0x234, lpBuffer=0x2785440, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2785440*, lpNumberOfBytesRead=0x26eb64*=0x2ed, lpOverlapped=0x0) returned 1
	[0088.041] CloseHandle (hObject=0x234) returned 1
	[0088.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.KEKW", lpFilePart=0x0) returned 0x83
	[0088.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.042] GetFileType (hFile=0x234) returned 0x1
	[0088.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.042] GetFileType (hFile=0x234) returned 0x1
	[0088.043] WriteFile (in: hFile=0x234, lpBuffer=0x2787c2c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2787c2c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.048] CloseHandle (hObject=0x234) returned 1
	[0088.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", lpFilePart=0x0) returned 0x7e
	[0088.048] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png")) returned 1
	[0088.055] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAa1vhm[1].png", cAlternateFileName="AAA1VH~1.PNG")) returned 1
	[0088.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", lpFilePart=0x0) returned 0x7e
	[0088.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.056] GetFileType (hFile=0x234) returned 0x1
	[0088.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.057] GetFileType (hFile=0x234) returned 0x1
	[0088.057] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x19e
	[0088.057] ReadFile (in: hFile=0x234, lpBuffer=0x27896a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27896a4*, lpNumberOfBytesRead=0x26eb64*=0x19e, lpOverlapped=0x0) returned 1
	[0088.063] CloseHandle (hObject=0x234) returned 1
	[0088.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0088.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.064] GetFileType (hFile=0x234) returned 0x1
	[0088.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.064] GetFileType (hFile=0x234) returned 0x1
	[0088.065] WriteFile (in: hFile=0x234, lpBuffer=0x278be90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x278be90*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.068] CloseHandle (hObject=0x234) returned 1
	[0088.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", lpFilePart=0x0) returned 0x7e
	[0088.068] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png")) returned 1
	[0088.072] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAa1xJF[1].png", cAlternateFileName="AAA1XJ~1.PNG")) returned 1
	[0088.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", lpFilePart=0x0) returned 0x7e
	[0088.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.072] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.073] GetFileType (hFile=0x234) returned 0x1
	[0088.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.073] GetFileType (hFile=0x234) returned 0x1
	[0088.073] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2c1
	[0088.073] ReadFile (in: hFile=0x234, lpBuffer=0x278da2c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x278da2c*, lpNumberOfBytesRead=0x26eb64*=0x2c1, lpOverlapped=0x0) returned 1
	[0088.078] CloseHandle (hObject=0x234) returned 1
	[0088.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0088.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.079] GetFileType (hFile=0x234) returned 0x1
	[0088.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.079] GetFileType (hFile=0x234) returned 0x1
	[0088.079] WriteFile (in: hFile=0x234, lpBuffer=0x2790218*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2790218*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.083] CloseHandle (hObject=0x234) returned 1
	[0088.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", lpFilePart=0x0) returned 0x7e
	[0088.083] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png")) returned 1
	[0088.086] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAlG41q[1].jpg", cAlternateFileName="AALG41~1.JPG")) returned 1
	[0088.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.087] GetFileType (hFile=0x234) returned 0x1
	[0088.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.087] GetFileType (hFile=0x234) returned 0x1
	[0088.087] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7b8
	[0088.088] ReadFile (in: hFile=0x234, lpBuffer=0x27922a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27922a8*, lpNumberOfBytesRead=0x26eb64*=0x7b8, lpOverlapped=0x0) returned 1
	[0088.093] CloseHandle (hObject=0x234) returned 1
	[0088.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.094] GetFileType (hFile=0x234) returned 0x1
	[0088.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.095] GetFileType (hFile=0x234) returned 0x1
	[0088.095] WriteFile (in: hFile=0x234, lpBuffer=0x2794a94*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2794a94*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.101] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg")) returned 1
	[0088.106] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAmin0Z[1].png", cAlternateFileName="AAMIN0~1.PNG")) returned 1
	[0088.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", lpFilePart=0x0) returned 0x7e
	[0088.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.107] GetFileType (hFile=0x234) returned 0x1
	[0088.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.107] GetFileType (hFile=0x234) returned 0x1
	[0088.107] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x157
	[0088.107] ReadFile (in: hFile=0x234, lpBuffer=0x27964c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27964c4*, lpNumberOfBytesRead=0x26eb64*=0x157, lpOverlapped=0x0) returned 1
	[0088.111] CloseHandle (hObject=0x234) returned 1
	[0088.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0088.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.113] GetFileType (hFile=0x234) returned 0x1
	[0088.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.113] GetFileType (hFile=0x234) returned 0x1
	[0088.114] WriteFile (in: hFile=0x234, lpBuffer=0x2798cb0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2798cb0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", lpFilePart=0x0) returned 0x7e
	[0088.119] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png")) returned 1
	[0088.122] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533f5b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533f5b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAnhRyj[1].jpg", cAlternateFileName="AANHRY~1.JPG")) returned 1
	[0088.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.123] GetFileType (hFile=0x234) returned 0x1
	[0088.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.124] GetFileType (hFile=0x234) returned 0x1
	[0088.124] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x36b1
	[0088.124] ReadFile (in: hFile=0x234, lpBuffer=0x279a57c, nNumberOfBytesToRead=0x36b1, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x279a57c*, lpNumberOfBytesRead=0x26eb64*=0x36b1, lpOverlapped=0x0) returned 1
	[0088.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.130] GetFileType (hFile=0x234) returned 0x1
	[0088.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.130] GetFileType (hFile=0x234) returned 0x1
	[0088.130] WriteFile (in: hFile=0x234, lpBuffer=0x279f41c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x279f41c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.134] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg")) returned 1
	[0088.137] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c161a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64c161a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e9d900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1
	[0088.138] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2eca30, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2eca30, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x91dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="adex[1].js", cAlternateFileName="ADEX_1~1.JS")) returned 1
	[0088.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", lpFilePart=0x0) returned 0x7a
	[0088.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.139] GetFileType (hFile=0x234) returned 0x1
	[0088.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.139] GetFileType (hFile=0x234) returned 0x1
	[0088.139] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x91dd
	[0088.140] ReadFile (in: hFile=0x234, lpBuffer=0x27a1580, nNumberOfBytesToRead=0x91dd, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27a1580*, lpNumberOfBytesRead=0x26eb64*=0x91dd, lpOverlapped=0x0) returned 1
	[0088.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js.KEKW", lpFilePart=0x0) returned 0x7f
	[0088.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.145] GetFileType (hFile=0x234) returned 0x1
	[0088.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.145] GetFileType (hFile=0x234) returned 0x1
	[0088.146] WriteFile (in: hFile=0x234, lpBuffer=0x27abf34*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27abf34*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js", lpFilePart=0x0) returned 0x7a
	[0088.149] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adex[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adex[1].js")) returned 1
	[0088.153] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x540e72d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540e72d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x540e72d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1
	[0088.153] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb6b0f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdb6b0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdb6b0f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x525b, dwReserved0=0x0, dwReserved1=0x0, cFileName="adsWrapperMSNI[1].js", cAlternateFileName="ADSWRA~1.JS")) returned 1
	[0088.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", lpFilePart=0x0) returned 0x84
	[0088.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.154] GetFileType (hFile=0x234) returned 0x1
	[0088.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.154] GetFileType (hFile=0x234) returned 0x1
	[0088.154] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x525b
	[0088.155] ReadFile (in: hFile=0x234, lpBuffer=0x27ade74, nNumberOfBytesToRead=0x525b, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27ade74*, lpNumberOfBytesRead=0x26eb64*=0x525b, lpOverlapped=0x0) returned 1
	[0088.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js.KEKW", lpFilePart=0x0) returned 0x89
	[0088.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.160] GetFileType (hFile=0x234) returned 0x1
	[0088.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.161] GetFileType (hFile=0x234) returned 0x1
	[0088.161] WriteFile (in: hFile=0x234, lpBuffer=0x27b48e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27b48e0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js", lpFilePart=0x0) returned 0x84
	[0088.164] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adsWrapperMSNI[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adswrappermsni[1].js")) returned 1
	[0088.168] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x0, dwReserved1=0x0, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", cAlternateFileName="AE8E98~1.JPG")) returned 1
	[0088.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", lpFilePart=0x0) returned 0x9b
	[0088.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.170] GetFileType (hFile=0x234) returned 0x1
	[0088.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.170] GetFileType (hFile=0x234) returned 0x1
	[0088.170] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x8217
	[0088.170] ReadFile (in: hFile=0x234, lpBuffer=0x27b6380, nNumberOfBytesToRead=0x8217, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27b6380*, lpNumberOfBytesRead=0x26eb64*=0x8217, lpOverlapped=0x0) returned 1
	[0088.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.KEKW", lpFilePart=0x0) returned 0xa0
	[0088.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.177] GetFileType (hFile=0x234) returned 0x1
	[0088.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.178] GetFileType (hFile=0x234) returned 0x1
	[0088.178] WriteFile (in: hFile=0x234, lpBuffer=0x27bfe38*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27bfe38*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", lpFilePart=0x0) returned 0x9b
	[0088.181] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg")) returned 1
	[0088.185] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe112530, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe112530, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1183b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ast[1].js", cAlternateFileName="AST_1_~1.JS")) returned 1
	[0088.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", lpFilePart=0x0) returned 0x79
	[0088.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.186] GetFileType (hFile=0x234) returned 0x1
	[0088.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.186] GetFileType (hFile=0x234) returned 0x1
	[0088.187] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1183b
	[0088.187] ReadFile (in: hFile=0x234, lpBuffer=0x27c16e0, nNumberOfBytesToRead=0x1183b, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27c16e0*, lpNumberOfBytesRead=0x26eb64*=0x1183b, lpOverlapped=0x0) returned 1
	[0088.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js.KEKW", lpFilePart=0x0) returned 0x7e
	[0088.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.195] GetFileType (hFile=0x234) returned 0x1
	[0088.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.195] GetFileType (hFile=0x234) returned 0x1
	[0088.195] WriteFile (in: hFile=0x234, lpBuffer=0x27d46f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27d46f0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js", lpFilePart=0x0) returned 0x79
	[0088.199] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ast[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ast[1].js")) returned 1
	[0088.203] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58798580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58798580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58798580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="autotrack[1].js", cAlternateFileName="AUTOTR~1.JS")) returned 1
	[0088.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", lpFilePart=0x0) returned 0x7f
	[0088.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.206] GetFileType (hFile=0x234) returned 0x1
	[0088.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.206] GetFileType (hFile=0x234) returned 0x1
	[0088.207] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x13a9
	[0088.207] ReadFile (in: hFile=0x234, lpBuffer=0x27d5fb4, nNumberOfBytesToRead=0x13a9, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27d5fb4*, lpNumberOfBytesRead=0x26eb64*=0x13a9, lpOverlapped=0x0) returned 1
	[0088.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js.KEKW", lpFilePart=0x0) returned 0x84
	[0088.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.212] GetFileType (hFile=0x234) returned 0x1
	[0088.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.212] GetFileType (hFile=0x234) returned 0x1
	[0088.213] WriteFile (in: hFile=0x234, lpBuffer=0x27d8b58*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27d8b58*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js", lpFilePart=0x0) returned 0x7f
	[0088.216] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\autotrack[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\autotrack[1].js")) returned 1
	[0088.220] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB56XTo[1].png", cAlternateFileName="BB56XT~1.PNG")) returned 1
	[0088.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", lpFilePart=0x0) returned 0x7e
	[0088.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.222] GetFileType (hFile=0x234) returned 0x1
	[0088.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.222] GetFileType (hFile=0x234) returned 0x1
	[0088.222] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x145
	[0088.222] ReadFile (in: hFile=0x234, lpBuffer=0x27da578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27da578*, lpNumberOfBytesRead=0x26eb64*=0x145, lpOverlapped=0x0) returned 1
	[0088.228] CloseHandle (hObject=0x234) returned 1
	[0088.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0088.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.229] GetFileType (hFile=0x234) returned 0x1
	[0088.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.229] GetFileType (hFile=0x234) returned 0x1
	[0088.230] WriteFile (in: hFile=0x234, lpBuffer=0x27dcd64*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27dcd64*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", lpFilePart=0x0) returned 0x7e
	[0088.233] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png")) returned 1
	[0088.236] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB5vO0g[1].png", cAlternateFileName="BB5VO0~1.PNG")) returned 1
	[0088.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", lpFilePart=0x0) returned 0x7e
	[0088.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.237] GetFileType (hFile=0x234) returned 0x1
	[0088.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.237] GetFileType (hFile=0x234) returned 0x1
	[0088.237] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1b6
	[0088.238] ReadFile (in: hFile=0x234, lpBuffer=0x27de7f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27de7f4*, lpNumberOfBytesRead=0x26eb64*=0x1b6, lpOverlapped=0x0) returned 1
	[0088.242] CloseHandle (hObject=0x234) returned 1
	[0088.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0088.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.243] GetFileType (hFile=0x234) returned 0x1
	[0088.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.244] GetFileType (hFile=0x234) returned 0x1
	[0088.244] WriteFile (in: hFile=0x234, lpBuffer=0x27e0fe0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27e0fe0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", lpFilePart=0x0) returned 0x7e
	[0088.248] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png")) returned 1
	[0088.252] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x0, cFileName="BB8AdqN[1].png", cAlternateFileName="BB8ADQ~1.PNG")) returned 1
	[0088.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", lpFilePart=0x0) returned 0x7e
	[0088.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.253] GetFileType (hFile=0x234) returned 0x1
	[0088.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.254] GetFileType (hFile=0x234) returned 0x1
	[0088.254] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x156
	[0088.254] ReadFile (in: hFile=0x234, lpBuffer=0x27e2a10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27e2a10*, lpNumberOfBytesRead=0x26eb64*=0x156, lpOverlapped=0x0) returned 1
	[0088.258] CloseHandle (hObject=0x234) returned 1
	[0088.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0088.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.259] GetFileType (hFile=0x234) returned 0x1
	[0088.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.260] GetFileType (hFile=0x234) returned 0x1
	[0088.265] WriteFile (in: hFile=0x234, lpBuffer=0x25e6c78*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25e6c78*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.268] CloseHandle (hObject=0x234) returned 1
	[0088.268] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", lpFilePart=0x0) returned 0x7e
	[0088.268] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png")) returned 1
	[0088.271] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45be8b30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45be8b30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ca7210, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBALZyp[1].jpg", cAlternateFileName="BBALZY~1.JPG")) returned 1
	[0088.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.273] GetFileType (hFile=0x234) returned 0x1
	[0088.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.273] GetFileType (hFile=0x234) returned 0x1
	[0088.273] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x152c
	[0088.273] ReadFile (in: hFile=0x234, lpBuffer=0x25e8544, nNumberOfBytesToRead=0x152c, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25e8544*, lpNumberOfBytesRead=0x26eb64*=0x152c, lpOverlapped=0x0) returned 1
	[0088.278] CloseHandle (hObject=0x234) returned 1
	[0088.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.279] GetFileType (hFile=0x234) returned 0x1
	[0088.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.279] GetFileType (hFile=0x234) returned 0x1
	[0088.280] WriteFile (in: hFile=0x234, lpBuffer=0x25eb25c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25eb25c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.284] CloseHandle (hObject=0x234) returned 1
	[0088.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.284] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg")) returned 1
	[0088.288] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5360ae70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5360ae70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5360ae70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBImKp[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 1
	[0088.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.290] GetFileType (hFile=0x234) returned 0x1
	[0088.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.290] GetFileType (hFile=0x234) returned 0x1
	[0088.290] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x97c
	[0088.291] ReadFile (in: hFile=0x234, lpBuffer=0x25ed4b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25ed4b0*, lpNumberOfBytesRead=0x26eb64*=0x97c, lpOverlapped=0x0) returned 1
	[0088.295] CloseHandle (hObject=0x234) returned 1
	[0088.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.296] GetFileType (hFile=0x234) returned 0x1
	[0088.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.296] GetFileType (hFile=0x234) returned 0x1
	[0088.297] WriteFile (in: hFile=0x234, lpBuffer=0x25efc9c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25efc9c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.300] CloseHandle (hObject=0x234) returned 1
	[0088.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.301] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg")) returned 1
	[0088.304] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53630fd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBMGJo[1].jpg", cAlternateFileName="BBBMGJ~1.JPG")) returned 1
	[0088.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.305] GetFileType (hFile=0x234) returned 0x1
	[0088.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.306] GetFileType (hFile=0x234) returned 0x1
	[0088.306] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x29ca
	[0088.306] ReadFile (in: hFile=0x234, lpBuffer=0x25f1568, nNumberOfBytesToRead=0x29ca, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25f1568*, lpNumberOfBytesRead=0x26eb64*=0x29ca, lpOverlapped=0x0) returned 1
	[0088.311] CloseHandle (hObject=0x234) returned 1
	[0088.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.312] GetFileType (hFile=0x234) returned 0x1
	[0088.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.313] GetFileType (hFile=0x234) returned 0x1
	[0088.313] WriteFile (in: hFile=0x234, lpBuffer=0x25f5720*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25f5720*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.317] CloseHandle (hObject=0x234) returned 1
	[0088.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.318] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg")) returned 1
	[0088.321] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBMKDF[1].jpg", cAlternateFileName="BBBMKD~1.JPG")) returned 1
	[0088.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.323] GetFileType (hFile=0x234) returned 0x1
	[0088.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.323] GetFileType (hFile=0x234) returned 0x1
	[0088.323] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x862
	[0088.323] ReadFile (in: hFile=0x234, lpBuffer=0x25f785c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25f785c*, lpNumberOfBytesRead=0x26eb64*=0x862, lpOverlapped=0x0) returned 1
	[0088.328] CloseHandle (hObject=0x234) returned 1
	[0088.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.329] GetFileType (hFile=0x234) returned 0x1
	[0088.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.329] GetFileType (hFile=0x234) returned 0x1
	[0088.330] WriteFile (in: hFile=0x234, lpBuffer=0x25fa048*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25fa048*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.333] CloseHandle (hObject=0x234) returned 1
	[0088.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.334] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg")) returned 1
	[0088.337] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBMQch[1].jpg", cAlternateFileName="BBBMQC~1.JPG")) returned 1
	[0088.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.338] GetFileType (hFile=0x234) returned 0x1
	[0088.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.339] GetFileType (hFile=0x234) returned 0x1
	[0088.339] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x142e
	[0088.339] ReadFile (in: hFile=0x234, lpBuffer=0x25fb914, nNumberOfBytesToRead=0x142e, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25fb914*, lpNumberOfBytesRead=0x26eb64*=0x142e, lpOverlapped=0x0) returned 1
	[0088.344] CloseHandle (hObject=0x234) returned 1
	[0088.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.345] GetFileType (hFile=0x234) returned 0x1
	[0088.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.345] GetFileType (hFile=0x234) returned 0x1
	[0088.346] WriteFile (in: hFile=0x234, lpBuffer=0x25fe530*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25fe530*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.349] CloseHandle (hObject=0x234) returned 1
	[0088.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.349] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg")) returned 1
	[0088.352] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58321c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58321c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58321c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBMyVh[1].jpg", cAlternateFileName="BBBMYV~1.JPG")) returned 1
	[0088.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.355] GetFileType (hFile=0x234) returned 0x1
	[0088.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.355] GetFileType (hFile=0x234) returned 0x1
	[0088.356] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3e6b
	[0088.356] ReadFile (in: hFile=0x234, lpBuffer=0x25ffdfc, nNumberOfBytesToRead=0x3e6b, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x25ffdfc*, lpNumberOfBytesRead=0x26eb64*=0x3e6b, lpOverlapped=0x0) returned 1
	[0088.360] CloseHandle (hObject=0x234) returned 1
	[0088.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.362] GetFileType (hFile=0x234) returned 0x1
	[0088.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.362] GetFileType (hFile=0x234) returned 0x1
	[0088.363] WriteFile (in: hFile=0x234, lpBuffer=0x2605454*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2605454*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.366] CloseHandle (hObject=0x234) returned 1
	[0088.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.366] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg")) returned 1
	[0088.370] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBNAf7[1].jpg", cAlternateFileName="BBBNAF~1.JPG")) returned 1
	[0088.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.371] GetFileType (hFile=0x234) returned 0x1
	[0088.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.371] GetFileType (hFile=0x234) returned 0x1
	[0088.371] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x812
	[0088.372] ReadFile (in: hFile=0x234, lpBuffer=0x2607540, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2607540*, lpNumberOfBytesRead=0x26eb64*=0x812, lpOverlapped=0x0) returned 1
	[0088.376] CloseHandle (hObject=0x234) returned 1
	[0088.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.378] GetFileType (hFile=0x234) returned 0x1
	[0088.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.378] GetFileType (hFile=0x234) returned 0x1
	[0088.379] WriteFile (in: hFile=0x234, lpBuffer=0x2609d2c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2609d2c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.383] CloseHandle (hObject=0x234) returned 1
	[0088.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.383] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg")) returned 1
	[0088.389] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBNnTF[1].jpg", cAlternateFileName="BBBNNT~1.JPG")) returned 1
	[0088.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.390] GetFileType (hFile=0x234) returned 0x1
	[0088.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.390] GetFileType (hFile=0x234) returned 0x1
	[0088.391] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xb22
	[0088.391] ReadFile (in: hFile=0x234, lpBuffer=0x260c128, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x260c128*, lpNumberOfBytesRead=0x26eb64*=0xb22, lpOverlapped=0x0) returned 1
	[0088.396] CloseHandle (hObject=0x234) returned 1
	[0088.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.398] GetFileType (hFile=0x234) returned 0x1
	[0088.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.398] GetFileType (hFile=0x234) returned 0x1
	[0088.398] WriteFile (in: hFile=0x234, lpBuffer=0x260e914*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x260e914*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.402] CloseHandle (hObject=0x234) returned 1
	[0088.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.402] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg")) returned 1
	[0088.406] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539c30d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539c30d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO4dZ[1].jpg", cAlternateFileName="BBBO4D~1.JPG")) returned 1
	[0088.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.407] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.407] GetFileType (hFile=0x234) returned 0x1
	[0088.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.408] GetFileType (hFile=0x234) returned 0x1
	[0088.409] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1529
	[0088.409] ReadFile (in: hFile=0x234, lpBuffer=0x26101e0, nNumberOfBytesToRead=0x1529, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26101e0*, lpNumberOfBytesRead=0x26eb64*=0x1529, lpOverlapped=0x0) returned 1
	[0088.413] CloseHandle (hObject=0x234) returned 1
	[0088.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.415] GetFileType (hFile=0x234) returned 0x1
	[0088.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.415] GetFileType (hFile=0x234) returned 0x1
	[0088.415] WriteFile (in: hFile=0x234, lpBuffer=0x2612ef8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2612ef8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.419] CloseHandle (hObject=0x234) returned 1
	[0088.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.419] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg")) returned 1
	[0088.423] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBO8ow[1].jpg", cAlternateFileName="BBBO8O~1.JPG")) returned 1
	[0088.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.478] GetFileType (hFile=0x234) returned 0x1
	[0088.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.478] GetFileType (hFile=0x234) returned 0x1
	[0088.478] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1e61
	[0088.479] ReadFile (in: hFile=0x234, lpBuffer=0x26147c4, nNumberOfBytesToRead=0x1e61, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26147c4*, lpNumberOfBytesRead=0x26eb64*=0x1e61, lpOverlapped=0x0) returned 1
	[0088.484] CloseHandle (hObject=0x234) returned 1
	[0088.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.484] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.486] GetFileType (hFile=0x234) returned 0x1
	[0088.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.486] GetFileType (hFile=0x234) returned 0x1
	[0088.487] WriteFile (in: hFile=0x234, lpBuffer=0x2617e14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2617e14*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.490] CloseHandle (hObject=0x234) returned 1
	[0088.490] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.490] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg")) returned 1
	[0088.494] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOaeS[1].jpg", cAlternateFileName="BBBOAE~1.JPG")) returned 1
	[0088.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.495] GetFileType (hFile=0x234) returned 0x1
	[0088.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.495] GetFileType (hFile=0x234) returned 0x1
	[0088.496] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x636
	[0088.496] ReadFile (in: hFile=0x234, lpBuffer=0x2619d24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2619d24*, lpNumberOfBytesRead=0x26eb64*=0x636, lpOverlapped=0x0) returned 1
	[0088.500] CloseHandle (hObject=0x234) returned 1
	[0088.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.502] GetFileType (hFile=0x234) returned 0x1
	[0088.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.502] GetFileType (hFile=0x234) returned 0x1
	[0088.503] WriteFile (in: hFile=0x234, lpBuffer=0x261c510*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x261c510*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.506] CloseHandle (hObject=0x234) returned 1
	[0088.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.506] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg")) returned 1
	[0088.510] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53278d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53278d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53278d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOcIb[1].jpg", cAlternateFileName="BBBOCI~1.JPG")) returned 1
	[0088.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.511] GetFileType (hFile=0x234) returned 0x1
	[0088.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.511] GetFileType (hFile=0x234) returned 0x1
	[0088.512] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x82a
	[0088.512] ReadFile (in: hFile=0x234, lpBuffer=0x261e614, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x261e614*, lpNumberOfBytesRead=0x26eb64*=0x82a, lpOverlapped=0x0) returned 1
	[0088.519] CloseHandle (hObject=0x234) returned 1
	[0088.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.521] GetFileType (hFile=0x234) returned 0x1
	[0088.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.521] GetFileType (hFile=0x234) returned 0x1
	[0088.522] WriteFile (in: hFile=0x234, lpBuffer=0x2620e00*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2620e00*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.525] CloseHandle (hObject=0x234) returned 1
	[0088.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.525] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg")) returned 1
	[0088.529] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOddp[1].jpg", cAlternateFileName="BBBODD~1.JPG")) returned 1
	[0088.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.530] GetFileType (hFile=0x234) returned 0x1
	[0088.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.530] GetFileType (hFile=0x234) returned 0x1
	[0088.531] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x161e
	[0088.531] ReadFile (in: hFile=0x234, lpBuffer=0x26226cc, nNumberOfBytesToRead=0x161e, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26226cc*, lpNumberOfBytesRead=0x26eb64*=0x161e, lpOverlapped=0x0) returned 1
	[0088.536] CloseHandle (hObject=0x234) returned 1
	[0088.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.538] GetFileType (hFile=0x234) returned 0x1
	[0088.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.538] GetFileType (hFile=0x234) returned 0x1
	[0088.538] WriteFile (in: hFile=0x234, lpBuffer=0x26254d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26254d8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.541] CloseHandle (hObject=0x234) returned 1
	[0088.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.541] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg")) returned 1
	[0088.545] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a1fd500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1fd500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a223660, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBOmar[1].jpg", cAlternateFileName="BBBOMA~1.JPG")) returned 1
	[0088.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.548] GetFileType (hFile=0x234) returned 0x1
	[0088.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.548] GetFileType (hFile=0x234) returned 0x1
	[0088.548] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x5685
	[0088.548] ReadFile (in: hFile=0x234, lpBuffer=0x2626da4, nNumberOfBytesToRead=0x5685, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2626da4*, lpNumberOfBytesRead=0x26eb64*=0x5685, lpOverlapped=0x0) returned 1
	[0088.553] CloseHandle (hObject=0x234) returned 1
	[0088.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.554] GetFileType (hFile=0x234) returned 0x1
	[0088.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.555] GetFileType (hFile=0x234) returned 0x1
	[0088.555] WriteFile (in: hFile=0x234, lpBuffer=0x262dc18*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x262dc18*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.558] CloseHandle (hObject=0x234) returned 1
	[0088.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.559] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg")) returned 1
	[0088.562] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBR4yQ[1].jpg", cAlternateFileName="BBBR4Y~1.JPG")) returned 1
	[0088.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.565] GetFileType (hFile=0x234) returned 0x1
	[0088.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.565] GetFileType (hFile=0x234) returned 0x1
	[0088.565] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2f6b
	[0088.566] ReadFile (in: hFile=0x234, lpBuffer=0x262f4e4, nNumberOfBytesToRead=0x2f6b, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x262f4e4*, lpNumberOfBytesRead=0x26eb64*=0x2f6b, lpOverlapped=0x0) returned 1
	[0088.571] CloseHandle (hObject=0x234) returned 1
	[0088.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.572] GetFileType (hFile=0x234) returned 0x1
	[0088.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.572] GetFileType (hFile=0x234) returned 0x1
	[0088.573] WriteFile (in: hFile=0x234, lpBuffer=0x2633c3c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2633c3c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.576] CloseHandle (hObject=0x234) returned 1
	[0088.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.577] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg")) returned 1
	[0088.583] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBUPaj[1].jpg", cAlternateFileName="BBBUPA~1.JPG")) returned 1
	[0088.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.585] GetFileType (hFile=0x234) returned 0x1
	[0088.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.585] GetFileType (hFile=0x234) returned 0x1
	[0088.585] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x264b
	[0088.585] ReadFile (in: hFile=0x234, lpBuffer=0x2635508, nNumberOfBytesToRead=0x264b, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2635508*, lpNumberOfBytesRead=0x26eb64*=0x264b, lpOverlapped=0x0) returned 1
	[0088.593] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.594] GetFileType (hFile=0x234) returned 0x1
	[0088.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.594] GetFileType (hFile=0x234) returned 0x1
	[0088.594] WriteFile (in: hFile=0x234, lpBuffer=0x2639340*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2639340*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.599] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg")) returned 1
	[0088.603] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 1
	[0088.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.603] GetFileType (hFile=0x234) returned 0x1
	[0088.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.604] GetFileType (hFile=0x234) returned 0x1
	[0088.604] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3e08
	[0088.604] ReadFile (in: hFile=0x234, lpBuffer=0x263ac0c, nNumberOfBytesToRead=0x3e08, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x263ac0c*, lpNumberOfBytesRead=0x26eb64*=0x3e08, lpOverlapped=0x0) returned 1
	[0088.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.610] GetFileType (hFile=0x234) returned 0x1
	[0088.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.610] GetFileType (hFile=0x234) returned 0x1
	[0088.611] WriteFile (in: hFile=0x234, lpBuffer=0x2640200*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2640200*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.614] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg")) returned 1
	[0088.618] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVLcG[1].jpg", cAlternateFileName="BBBVLC~1.JPG")) returned 1
	[0088.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.618] GetFileType (hFile=0x234) returned 0x1
	[0088.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.619] GetFileType (hFile=0x234) returned 0x1
	[0088.619] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xa1f
	[0088.619] ReadFile (in: hFile=0x234, lpBuffer=0x26424f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26424f8*, lpNumberOfBytesRead=0x26eb64*=0xa1f, lpOverlapped=0x0) returned 1
	[0088.624] CloseHandle (hObject=0x234) returned 1
	[0088.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.625] GetFileType (hFile=0x234) returned 0x1
	[0088.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.625] GetFileType (hFile=0x234) returned 0x1
	[0088.625] WriteFile (in: hFile=0x234, lpBuffer=0x2644ce4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2644ce4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.628] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg")) returned 1
	[0088.631] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBVSkP[1].jpg", cAlternateFileName="BBBVSK~1.JPG")) returned 1
	[0088.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.632] GetFileType (hFile=0x234) returned 0x1
	[0088.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.633] GetFileType (hFile=0x234) returned 0x1
	[0088.633] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x82d
	[0088.633] ReadFile (in: hFile=0x234, lpBuffer=0x2646dec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2646dec*, lpNumberOfBytesRead=0x26eb64*=0x82d, lpOverlapped=0x0) returned 1
	[0088.638] CloseHandle (hObject=0x234) returned 1
	[0088.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.638] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.639] GetFileType (hFile=0x234) returned 0x1
	[0088.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.639] GetFileType (hFile=0x234) returned 0x1
	[0088.639] WriteFile (in: hFile=0x234, lpBuffer=0x26495d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26495d8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.643] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg")) returned 1
	[0088.646] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x612a8ee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x612a8ee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x612a8ee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 1
	[0088.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.647] GetFileType (hFile=0x234) returned 0x1
	[0088.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.647] GetFileType (hFile=0x234) returned 0x1
	[0088.648] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x16f5
	[0088.648] ReadFile (in: hFile=0x234, lpBuffer=0x264aea4, nNumberOfBytesToRead=0x16f5, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x264aea4*, lpNumberOfBytesRead=0x26eb64*=0x16f5, lpOverlapped=0x0) returned 1
	[0088.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.653] GetFileType (hFile=0x234) returned 0x1
	[0088.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.654] GetFileType (hFile=0x234) returned 0x1
	[0088.654] WriteFile (in: hFile=0x234, lpBuffer=0x264dd88*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x264dd88*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.658] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg")) returned 1
	[0088.662] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBBZ5vT[1].jpg", cAlternateFileName="BBBZ5V~1.JPG")) returned 1
	[0088.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.663] GetFileType (hFile=0x234) returned 0x1
	[0088.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.663] GetFileType (hFile=0x234) returned 0x1
	[0088.663] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xc20
	[0088.664] ReadFile (in: hFile=0x234, lpBuffer=0x2650280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2650280*, lpNumberOfBytesRead=0x26eb64*=0xc20, lpOverlapped=0x0) returned 1
	[0088.669] CloseHandle (hObject=0x234) returned 1
	[0088.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.670] GetFileType (hFile=0x234) returned 0x1
	[0088.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.670] GetFileType (hFile=0x234) returned 0x1
	[0088.671] WriteFile (in: hFile=0x234, lpBuffer=0x2652a6c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2652a6c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.674] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.675] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg")) returned 1
	[0088.678] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC02Gr[1].jpg", cAlternateFileName="BBC02G~1.JPG")) returned 1
	[0088.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.679] GetFileType (hFile=0x234) returned 0x1
	[0088.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.680] GetFileType (hFile=0x234) returned 0x1
	[0088.680] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x86e
	[0088.680] ReadFile (in: hFile=0x234, lpBuffer=0x2654bb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2654bb4*, lpNumberOfBytesRead=0x26eb64*=0x86e, lpOverlapped=0x0) returned 1
	[0088.684] CloseHandle (hObject=0x234) returned 1
	[0088.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.685] GetFileType (hFile=0x234) returned 0x1
	[0088.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.686] GetFileType (hFile=0x234) returned 0x1
	[0088.686] WriteFile (in: hFile=0x234, lpBuffer=0x26573a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26573a0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.691] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg")) returned 1
	[0088.694] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC02Gr[2].jpg", cAlternateFileName="BBC02G~2.JPG")) returned 1
	[0088.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", lpFilePart=0x0) returned 0x7e
	[0088.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.695] GetFileType (hFile=0x234) returned 0x1
	[0088.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.695] GetFileType (hFile=0x234) returned 0x1
	[0088.695] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x86e
	[0088.696] ReadFile (in: hFile=0x234, lpBuffer=0x26594e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26594e8*, lpNumberOfBytesRead=0x26eb64*=0x86e, lpOverlapped=0x0) returned 1
	[0088.701] CloseHandle (hObject=0x234) returned 1
	[0088.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.703] GetFileType (hFile=0x234) returned 0x1
	[0088.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.703] GetFileType (hFile=0x234) returned 0x1
	[0088.703] WriteFile (in: hFile=0x234, lpBuffer=0x265bcd4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x265bcd4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", lpFilePart=0x0) returned 0x7e
	[0088.707] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg")) returned 1
	[0088.711] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 1
	[0088.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.721] GetFileType (hFile=0x234) returned 0x1
	[0088.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.721] GetFileType (hFile=0x234) returned 0x1
	[0088.721] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x89a
	[0088.722] ReadFile (in: hFile=0x234, lpBuffer=0x265de48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x265de48*, lpNumberOfBytesRead=0x26eb64*=0x89a, lpOverlapped=0x0) returned 1
	[0088.727] CloseHandle (hObject=0x234) returned 1
	[0088.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.728] GetFileType (hFile=0x234) returned 0x1
	[0088.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.729] GetFileType (hFile=0x234) returned 0x1
	[0088.729] WriteFile (in: hFile=0x234, lpBuffer=0x2660634*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2660634*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.732] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg")) returned 1
	[0088.736] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 1
	[0088.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.737] GetFileType (hFile=0x234) returned 0x1
	[0088.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.737] GetFileType (hFile=0x234) returned 0x1
	[0088.737] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7bb
	[0088.738] ReadFile (in: hFile=0x234, lpBuffer=0x26626c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26626c8*, lpNumberOfBytesRead=0x26eb64*=0x7bb, lpOverlapped=0x0) returned 1
	[0088.749] CloseHandle (hObject=0x234) returned 1
	[0088.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.752] GetFileType (hFile=0x234) returned 0x1
	[0088.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.752] GetFileType (hFile=0x234) returned 0x1
	[0088.753] WriteFile (in: hFile=0x234, lpBuffer=0x2664eb4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2664eb4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.756] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg")) returned 1
	[0088.759] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0Djg[1].jpg", cAlternateFileName="BBC0DJ~1.JPG")) returned 1
	[0088.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.761] GetFileType (hFile=0x234) returned 0x1
	[0088.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.761] GetFileType (hFile=0x234) returned 0x1
	[0088.761] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x9ab
	[0088.761] ReadFile (in: hFile=0x234, lpBuffer=0x2667138, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2667138*, lpNumberOfBytesRead=0x26eb64*=0x9ab, lpOverlapped=0x0) returned 1
	[0088.768] CloseHandle (hObject=0x234) returned 1
	[0088.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.768] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.769] GetFileType (hFile=0x234) returned 0x1
	[0088.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.769] GetFileType (hFile=0x234) returned 0x1
	[0088.770] WriteFile (in: hFile=0x234, lpBuffer=0x2669924*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2669924*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.773] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.773] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg")) returned 1
	[0088.776] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 1
	[0088.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.779] GetFileType (hFile=0x234) returned 0x1
	[0088.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.779] GetFileType (hFile=0x234) returned 0x1
	[0088.779] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7fd
	[0088.779] ReadFile (in: hFile=0x234, lpBuffer=0x266b9fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x266b9fc*, lpNumberOfBytesRead=0x26eb64*=0x7fd, lpOverlapped=0x0) returned 1
	[0088.785] CloseHandle (hObject=0x234) returned 1
	[0088.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.787] GetFileType (hFile=0x234) returned 0x1
	[0088.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.787] GetFileType (hFile=0x234) returned 0x1
	[0088.788] WriteFile (in: hFile=0x234, lpBuffer=0x266e1e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x266e1e8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.791] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg")) returned 1
	[0088.794] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0lf2[1].jpg", cAlternateFileName="BBC0LF~1.JPG")) returned 1
	[0088.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.797] GetFileType (hFile=0x234) returned 0x1
	[0088.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.797] GetFileType (hFile=0x234) returned 0x1
	[0088.797] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x82f
	[0088.797] ReadFile (in: hFile=0x234, lpBuffer=0x26702f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26702f0*, lpNumberOfBytesRead=0x26eb64*=0x82f, lpOverlapped=0x0) returned 1
	[0088.801] CloseHandle (hObject=0x234) returned 1
	[0088.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.803] GetFileType (hFile=0x234) returned 0x1
	[0088.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.803] GetFileType (hFile=0x234) returned 0x1
	[0088.803] WriteFile (in: hFile=0x234, lpBuffer=0x2672adc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2672adc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.807] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg")) returned 1
	[0088.810] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2e35a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2e35a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2e35a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0mK1[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 1
	[0088.810] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.811] GetFileType (hFile=0x234) returned 0x1
	[0088.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.811] GetFileType (hFile=0x234) returned 0x1
	[0088.811] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1afe
	[0088.811] ReadFile (in: hFile=0x234, lpBuffer=0x26743a8, nNumberOfBytesToRead=0x1afe, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26743a8*, lpNumberOfBytesRead=0x26eb64*=0x1afe, lpOverlapped=0x0) returned 1
	[0088.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.845] GetFileType (hFile=0x234) returned 0x1
	[0088.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.846] GetFileType (hFile=0x234) returned 0x1
	[0088.846] WriteFile (in: hFile=0x234, lpBuffer=0x2677694*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2677694*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.850] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg")) returned 1
	[0088.853] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBC0qlB[1].jpg", cAlternateFileName="BBC0QL~1.JPG")) returned 1
	[0088.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.855] GetFileType (hFile=0x234) returned 0x1
	[0088.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.855] GetFileType (hFile=0x234) returned 0x1
	[0088.855] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1fc3
	[0088.856] ReadFile (in: hFile=0x234, lpBuffer=0x2678f60, nNumberOfBytesToRead=0x1fc3, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2678f60*, lpNumberOfBytesRead=0x26eb64*=0x1fc3, lpOverlapped=0x0) returned 1
	[0088.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.863] GetFileType (hFile=0x234) returned 0x1
	[0088.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.863] GetFileType (hFile=0x234) returned 0x1
	[0088.864] WriteFile (in: hFile=0x234, lpBuffer=0x267c710*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x267c710*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.868] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg")) returned 1
	[0088.871] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE7KPZ[1].jpg", cAlternateFileName="BBE7KP~1.JPG")) returned 1
	[0088.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.873] GetFileType (hFile=0x234) returned 0x1
	[0088.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.873] GetFileType (hFile=0x234) returned 0x1
	[0088.873] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2ecb
	[0088.874] ReadFile (in: hFile=0x234, lpBuffer=0x267dfdc, nNumberOfBytesToRead=0x2ecb, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x267dfdc*, lpNumberOfBytesRead=0x26eb64*=0x2ecb, lpOverlapped=0x0) returned 1
	[0088.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.886] GetFileType (hFile=0x234) returned 0x1
	[0088.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.886] GetFileType (hFile=0x234) returned 0x1
	[0088.887] WriteFile (in: hFile=0x234, lpBuffer=0x2682694*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2682694*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.891] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg")) returned 1
	[0088.894] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE8IlA[1].jpg", cAlternateFileName="BBE8IL~1.JPG")) returned 1
	[0088.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.896] GetFileType (hFile=0x234) returned 0x1
	[0088.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.896] GetFileType (hFile=0x234) returned 0x1
	[0088.896] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x9c5
	[0088.896] ReadFile (in: hFile=0x234, lpBuffer=0x2684934, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2684934*, lpNumberOfBytesRead=0x26eb64*=0x9c5, lpOverlapped=0x0) returned 1
	[0088.902] CloseHandle (hObject=0x234) returned 1
	[0088.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.903] GetFileType (hFile=0x234) returned 0x1
	[0088.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.904] GetFileType (hFile=0x234) returned 0x1
	[0088.904] WriteFile (in: hFile=0x234, lpBuffer=0x2687120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2687120*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.909] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg")) returned 1
	[0088.913] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE972F[1].jpg", cAlternateFileName="BBE972~1.JPG")) returned 1
	[0088.914] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.915] GetFileType (hFile=0x234) returned 0x1
	[0088.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.915] GetFileType (hFile=0x234) returned 0x1
	[0088.915] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2669
	[0088.915] ReadFile (in: hFile=0x234, lpBuffer=0x26889ec, nNumberOfBytesToRead=0x2669, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26889ec*, lpNumberOfBytesRead=0x26eb64*=0x2669, lpOverlapped=0x0) returned 1
	[0088.920] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.922] GetFileType (hFile=0x234) returned 0x1
	[0088.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.922] GetFileType (hFile=0x234) returned 0x1
	[0088.923] WriteFile (in: hFile=0x234, lpBuffer=0x268c844*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x268c844*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.926] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg")) returned 1
	[0088.929] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBE9tdx[1].jpg", cAlternateFileName="BBE9TD~1.JPG")) returned 1
	[0088.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.931] GetFileType (hFile=0x234) returned 0x1
	[0088.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.931] GetFileType (hFile=0x234) returned 0x1
	[0088.931] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2a77
	[0088.931] ReadFile (in: hFile=0x234, lpBuffer=0x268e110, nNumberOfBytesToRead=0x2a77, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x268e110*, lpNumberOfBytesRead=0x26eb64*=0x2a77, lpOverlapped=0x0) returned 1
	[0088.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.937] GetFileType (hFile=0x234) returned 0x1
	[0088.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.937] GetFileType (hFile=0x234) returned 0x1
	[0088.938] WriteFile (in: hFile=0x234, lpBuffer=0x2692374*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2692374*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.941] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg")) returned 1
	[0088.945] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEdrqt[1].jpg", cAlternateFileName="BBEDRQ~1.JPG")) returned 1
	[0088.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.946] GetFileType (hFile=0x234) returned 0x1
	[0088.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.946] GetFileType (hFile=0x234) returned 0x1
	[0088.946] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2fe3
	[0088.946] ReadFile (in: hFile=0x234, lpBuffer=0x2693c40, nNumberOfBytesToRead=0x2fe3, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2693c40*, lpNumberOfBytesRead=0x26eb64*=0x2fe3, lpOverlapped=0x0) returned 1
	[0088.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.952] GetFileType (hFile=0x234) returned 0x1
	[0088.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.952] GetFileType (hFile=0x234) returned 0x1
	[0088.952] WriteFile (in: hFile=0x234, lpBuffer=0x2698410*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2698410*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.956] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg")) returned 1
	[0088.959] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeEwt[1].jpg", cAlternateFileName="BBEEEW~1.JPG")) returned 1
	[0088.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.960] GetFileType (hFile=0x234) returned 0x1
	[0088.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.961] GetFileType (hFile=0x234) returned 0x1
	[0088.961] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x857
	[0088.961] ReadFile (in: hFile=0x234, lpBuffer=0x269a540, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x269a540*, lpNumberOfBytesRead=0x26eb64*=0x857, lpOverlapped=0x0) returned 1
	[0088.966] CloseHandle (hObject=0x234) returned 1
	[0088.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.967] GetFileType (hFile=0x234) returned 0x1
	[0088.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.967] GetFileType (hFile=0x234) returned 0x1
	[0088.968] WriteFile (in: hFile=0x234, lpBuffer=0x269cd2c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x269cd2c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.972] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg")) returned 1
	[0088.975] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeis3[1].jpg", cAlternateFileName="BBEEIS~1.JPG")) returned 1
	[0088.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.977] GetFileType (hFile=0x234) returned 0x1
	[0088.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.977] GetFileType (hFile=0x234) returned 0x1
	[0088.977] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x7d9
	[0088.977] ReadFile (in: hFile=0x234, lpBuffer=0x269ede0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x269ede0*, lpNumberOfBytesRead=0x26eb64*=0x7d9, lpOverlapped=0x0) returned 1
	[0088.981] CloseHandle (hObject=0x234) returned 1
	[0088.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.982] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.983] GetFileType (hFile=0x234) returned 0x1
	[0088.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.983] GetFileType (hFile=0x234) returned 0x1
	[0088.984] WriteFile (in: hFile=0x234, lpBuffer=0x26a15cc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26a15cc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0088.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.987] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg")) returned 1
	[0088.991] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeKvV[1].jpg", cAlternateFileName="BBEEKV~1.JPG")) returned 1
	[0088.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", lpFilePart=0x0) returned 0x7e
	[0088.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0088.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.992] GetFileType (hFile=0x234) returned 0x1
	[0088.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0088.992] GetFileType (hFile=0x234) returned 0x1
	[0088.992] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x8c5
	[0088.992] ReadFile (in: hFile=0x234, lpBuffer=0x26a376c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26a376c*, lpNumberOfBytesRead=0x26eb64*=0x8c5, lpOverlapped=0x0) returned 1
	[0088.997] CloseHandle (hObject=0x234) returned 1
	[0088.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0088.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0088.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0088.999] GetFileType (hFile=0x234) returned 0x1
	[0088.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0088.999] GetFileType (hFile=0x234) returned 0x1
	[0088.999] WriteFile (in: hFile=0x234, lpBuffer=0x26a5f58*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26a5f58*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.003] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg")) returned 1
	[0089.006] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a91ed0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a91ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeNd8[1].png", cAlternateFileName="BBEEND~1.PNG")) returned 1
	[0089.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", lpFilePart=0x0) returned 0x7e
	[0089.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.008] GetFileType (hFile=0x234) returned 0x1
	[0089.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.008] GetFileType (hFile=0x234) returned 0x1
	[0089.008] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xef00
	[0089.008] ReadFile (in: hFile=0x234, lpBuffer=0x26a7824, nNumberOfBytesToRead=0xef00, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26a7824*, lpNumberOfBytesRead=0x26eb64*=0xef00, lpOverlapped=0x0) returned 1
	[0089.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0089.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.015] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.016] GetFileType (hFile=0x234) returned 0x1
	[0089.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.016] GetFileType (hFile=0x234) returned 0x1
	[0089.017] WriteFile (in: hFile=0x234, lpBuffer=0x26b7f10*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26b7f10*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", lpFilePart=0x0) returned 0x7e
	[0089.020] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png")) returned 1
	[0089.025] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEewZB[1].jpg", cAlternateFileName="BBEEWZ~1.JPG")) returned 1
	[0089.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.026] GetFileType (hFile=0x234) returned 0x1
	[0089.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.026] GetFileType (hFile=0x234) returned 0x1
	[0089.026] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3323
	[0089.027] ReadFile (in: hFile=0x234, lpBuffer=0x26b97dc, nNumberOfBytesToRead=0x3323, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26b97dc*, lpNumberOfBytesRead=0x26eb64*=0x3323, lpOverlapped=0x0) returned 1
	[0089.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.033] GetFileType (hFile=0x234) returned 0x1
	[0089.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.034] GetFileType (hFile=0x234) returned 0x1
	[0089.034] WriteFile (in: hFile=0x234, lpBuffer=0x26be2ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26be2ec*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.037] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg")) returned 1
	[0089.040] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEeZ0k[1].jpg", cAlternateFileName="BBEEZ0~1.JPG")) returned 1
	[0089.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.042] GetFileType (hFile=0x234) returned 0x1
	[0089.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.042] GetFileType (hFile=0x234) returned 0x1
	[0089.042] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x9d7
	[0089.042] ReadFile (in: hFile=0x234, lpBuffer=0x26c059c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26c059c*, lpNumberOfBytesRead=0x26eb64*=0x9d7, lpOverlapped=0x0) returned 1
	[0089.047] CloseHandle (hObject=0x234) returned 1
	[0089.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.048] GetFileType (hFile=0x234) returned 0x1
	[0089.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.048] GetFileType (hFile=0x234) returned 0x1
	[0089.049] WriteFile (in: hFile=0x234, lpBuffer=0x26c2d88*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26c2d88*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.052] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg")) returned 1
	[0089.055] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEf6s4[1].jpg", cAlternateFileName="BBEF6S~1.JPG")) returned 1
	[0089.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.057] GetFileType (hFile=0x234) returned 0x1
	[0089.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.057] GetFileType (hFile=0x234) returned 0x1
	[0089.057] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2d32
	[0089.057] ReadFile (in: hFile=0x234, lpBuffer=0x26c4654, nNumberOfBytesToRead=0x2d32, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26c4654*, lpNumberOfBytesRead=0x26eb64*=0x2d32, lpOverlapped=0x0) returned 1
	[0089.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.064] GetFileType (hFile=0x234) returned 0x1
	[0089.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.064] GetFileType (hFile=0x234) returned 0x1
	[0089.065] WriteFile (in: hFile=0x234, lpBuffer=0x26c8b74*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26c8b74*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.069] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg")) returned 1
	[0089.072] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfAc5[1].jpg", cAlternateFileName="BBEFAC~1.JPG")) returned 1
	[0089.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.073] GetFileType (hFile=0x234) returned 0x1
	[0089.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.073] GetFileType (hFile=0x234) returned 0x1
	[0089.074] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x85d
	[0089.074] ReadFile (in: hFile=0x234, lpBuffer=0x26cacac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26cacac*, lpNumberOfBytesRead=0x26eb64*=0x85d, lpOverlapped=0x0) returned 1
	[0089.079] CloseHandle (hObject=0x234) returned 1
	[0089.079] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.079] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.080] GetFileType (hFile=0x234) returned 0x1
	[0089.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.080] GetFileType (hFile=0x234) returned 0x1
	[0089.081] WriteFile (in: hFile=0x234, lpBuffer=0x26cd498*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26cd498*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.084] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg")) returned 1
	[0089.087] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfgDi[1].jpg", cAlternateFileName="BBEFGD~1.JPG")) returned 1
	[0089.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.088] GetFileType (hFile=0x234) returned 0x1
	[0089.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.089] GetFileType (hFile=0x234) returned 0x1
	[0089.089] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x197c
	[0089.089] ReadFile (in: hFile=0x234, lpBuffer=0x26ced64, nNumberOfBytesToRead=0x197c, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26ced64*, lpNumberOfBytesRead=0x26eb64*=0x197c, lpOverlapped=0x0) returned 1
	[0089.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.099] GetFileType (hFile=0x234) returned 0x1
	[0089.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.099] GetFileType (hFile=0x234) returned 0x1
	[0089.100] WriteFile (in: hFile=0x234, lpBuffer=0x26d1ecc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26d1ecc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.103] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg")) returned 1
	[0089.106] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 1
	[0089.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.107] GetFileType (hFile=0x234) returned 0x1
	[0089.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.108] GetFileType (hFile=0x234) returned 0x1
	[0089.108] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xb7e
	[0089.108] ReadFile (in: hFile=0x234, lpBuffer=0x26d4324, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26d4324*, lpNumberOfBytesRead=0x26eb64*=0xb7e, lpOverlapped=0x0) returned 1
	[0089.113] CloseHandle (hObject=0x234) returned 1
	[0089.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.114] GetFileType (hFile=0x234) returned 0x1
	[0089.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.114] GetFileType (hFile=0x234) returned 0x1
	[0089.115] WriteFile (in: hFile=0x234, lpBuffer=0x26d6b10*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26d6b10*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.118] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg")) returned 1
	[0089.121] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfkgi[1].jpg", cAlternateFileName="BBEFKG~1.JPG")) returned 1
	[0089.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.122] GetFileType (hFile=0x234) returned 0x1
	[0089.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.122] GetFileType (hFile=0x234) returned 0x1
	[0089.123] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1b14
	[0089.123] ReadFile (in: hFile=0x234, lpBuffer=0x26d83dc, nNumberOfBytesToRead=0x1b14, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26d83dc*, lpNumberOfBytesRead=0x26eb64*=0x1b14, lpOverlapped=0x0) returned 1
	[0089.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.128] GetFileType (hFile=0x234) returned 0x1
	[0089.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.128] GetFileType (hFile=0x234) returned 0x1
	[0089.129] WriteFile (in: hFile=0x234, lpBuffer=0x26db6dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26db6dc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.133] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg")) returned 1
	[0089.136] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfRKA[1].jpg", cAlternateFileName="BBEFRK~1.JPG")) returned 1
	[0089.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.137] GetFileType (hFile=0x234) returned 0x1
	[0089.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.138] GetFileType (hFile=0x234) returned 0x1
	[0089.138] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2978
	[0089.138] ReadFile (in: hFile=0x234, lpBuffer=0x26dcfa8, nNumberOfBytesToRead=0x2978, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26dcfa8*, lpNumberOfBytesRead=0x26eb64*=0x2978, lpOverlapped=0x0) returned 1
	[0089.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.143] GetFileType (hFile=0x234) returned 0x1
	[0089.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.144] GetFileType (hFile=0x234) returned 0x1
	[0089.144] WriteFile (in: hFile=0x234, lpBuffer=0x26e110c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26e110c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.148] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg")) returned 1
	[0089.152] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfRwv[1].jpg", cAlternateFileName="BBEFRW~1.JPG")) returned 1
	[0089.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.153] GetFileType (hFile=0x234) returned 0x1
	[0089.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.153] GetFileType (hFile=0x234) returned 0x1
	[0089.153] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2b6c
	[0089.154] ReadFile (in: hFile=0x234, lpBuffer=0x26e29d8, nNumberOfBytesToRead=0x2b6c, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26e29d8*, lpNumberOfBytesRead=0x26eb64*=0x2b6c, lpOverlapped=0x0) returned 1
	[0089.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.160] GetFileType (hFile=0x234) returned 0x1
	[0089.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.160] GetFileType (hFile=0x234) returned 0x1
	[0089.160] WriteFile (in: hFile=0x234, lpBuffer=0x26e6d30*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26e6d30*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.163] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg")) returned 1
	[0089.166] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45478670, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45478670, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45478670, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 1
	[0089.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.167] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.168] GetFileType (hFile=0x234) returned 0x1
	[0089.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.168] GetFileType (hFile=0x234) returned 0x1
	[0089.168] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x2676
	[0089.168] ReadFile (in: hFile=0x234, lpBuffer=0x26e85fc, nNumberOfBytesToRead=0x2676, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26e85fc*, lpNumberOfBytesRead=0x26eb64*=0x2676, lpOverlapped=0x0) returned 1
	[0089.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.174] GetFileType (hFile=0x234) returned 0x1
	[0089.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.174] GetFileType (hFile=0x234) returned 0x1
	[0089.175] WriteFile (in: hFile=0x234, lpBuffer=0x26ec460*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26ec460*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.178] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg")) returned 1
	[0089.181] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEfY4X[1].jpg", cAlternateFileName="BBEFY4~1.JPG")) returned 1
	[0089.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.182] GetFileType (hFile=0x234) returned 0x1
	[0089.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.182] GetFileType (hFile=0x234) returned 0x1
	[0089.182] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xb41
	[0089.182] ReadFile (in: hFile=0x234, lpBuffer=0x26ee87c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26ee87c*, lpNumberOfBytesRead=0x26eb64*=0xb41, lpOverlapped=0x0) returned 1
	[0089.187] CloseHandle (hObject=0x234) returned 1
	[0089.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.188] GetFileType (hFile=0x234) returned 0x1
	[0089.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.188] GetFileType (hFile=0x234) returned 0x1
	[0089.189] WriteFile (in: hFile=0x234, lpBuffer=0x26f1068*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26f1068*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.192] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg")) returned 1
	[0089.195] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgD9f[1].jpg", cAlternateFileName="BBEGD9~1.JPG")) returned 1
	[0089.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.196] GetFileType (hFile=0x234) returned 0x1
	[0089.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.196] GetFileType (hFile=0x234) returned 0x1
	[0089.196] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x25f6
	[0089.196] ReadFile (in: hFile=0x234, lpBuffer=0x26f2934, nNumberOfBytesToRead=0x25f6, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26f2934*, lpNumberOfBytesRead=0x26eb64*=0x25f6, lpOverlapped=0x0) returned 1
	[0089.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.202] GetFileType (hFile=0x234) returned 0x1
	[0089.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.202] GetFileType (hFile=0x234) returned 0x1
	[0089.202] WriteFile (in: hFile=0x234, lpBuffer=0x26f6718*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26f6718*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.206] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg")) returned 1
	[0089.209] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 1
	[0089.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.210] GetFileType (hFile=0x234) returned 0x1
	[0089.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.210] GetFileType (hFile=0x234) returned 0x1
	[0089.210] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x819
	[0089.210] ReadFile (in: hFile=0x234, lpBuffer=0x26f880c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26f880c*, lpNumberOfBytesRead=0x26eb64*=0x819, lpOverlapped=0x0) returned 1
	[0089.216] CloseHandle (hObject=0x234) returned 1
	[0089.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.217] GetFileType (hFile=0x234) returned 0x1
	[0089.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.218] GetFileType (hFile=0x234) returned 0x1
	[0089.218] WriteFile (in: hFile=0x234, lpBuffer=0x26faff8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26faff8*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.222] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg")) returned 1
	[0089.226] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgsWA[1].jpg", cAlternateFileName="BBEGSW~1.JPG")) returned 1
	[0089.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.227] GetFileType (hFile=0x234) returned 0x1
	[0089.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.227] GetFileType (hFile=0x234) returned 0x1
	[0089.227] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x916
	[0089.227] ReadFile (in: hFile=0x234, lpBuffer=0x26fd1e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x26fd1e8*, lpNumberOfBytesRead=0x26eb64*=0x916, lpOverlapped=0x0) returned 1
	[0089.234] CloseHandle (hObject=0x234) returned 1
	[0089.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.235] GetFileType (hFile=0x234) returned 0x1
	[0089.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.236] GetFileType (hFile=0x234) returned 0x1
	[0089.236] WriteFile (in: hFile=0x234, lpBuffer=0x26ff9d4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x26ff9d4*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.239] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg")) returned 1
	[0089.242] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBEgX5G[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 1
	[0089.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.243] GetFileType (hFile=0x234) returned 0x1
	[0089.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.244] GetFileType (hFile=0x234) returned 0x1
	[0089.244] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x918
	[0089.244] ReadFile (in: hFile=0x234, lpBuffer=0x2701bc4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2701bc4*, lpNumberOfBytesRead=0x26eb64*=0x918, lpOverlapped=0x0) returned 1
	[0089.249] CloseHandle (hObject=0x234) returned 1
	[0089.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.KEKW", lpFilePart=0x0) returned 0x83
	[0089.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.250] GetFileType (hFile=0x234) returned 0x1
	[0089.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.250] GetFileType (hFile=0x234) returned 0x1
	[0089.251] WriteFile (in: hFile=0x234, lpBuffer=0x27043b0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27043b0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", lpFilePart=0x0) returned 0x7e
	[0089.254] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg")) returned 1
	[0089.257] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBih5H[1].png", cAlternateFileName="BBIH5H~1.PNG")) returned 1
	[0089.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", lpFilePart=0x0) returned 0x7d
	[0089.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.258] GetFileType (hFile=0x234) returned 0x1
	[0089.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.259] GetFileType (hFile=0x234) returned 0x1
	[0089.259] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3a2
	[0089.259] ReadFile (in: hFile=0x234, lpBuffer=0x2706014, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2706014*, lpNumberOfBytesRead=0x26eb64*=0x3a2, lpOverlapped=0x0) returned 1
	[0089.264] CloseHandle (hObject=0x234) returned 1
	[0089.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.KEKW", lpFilePart=0x0) returned 0x82
	[0089.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.265] GetFileType (hFile=0x234) returned 0x1
	[0089.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.265] GetFileType (hFile=0x234) returned 0x1
	[0089.265] WriteFile (in: hFile=0x234, lpBuffer=0x2708800*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2708800*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", lpFilePart=0x0) returned 0x7d
	[0089.269] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png")) returned 1
	[0089.272] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBmUxRK[1].png", cAlternateFileName="BBMUXR~1.PNG")) returned 1
	[0089.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", lpFilePart=0x0) returned 0x7e
	[0089.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.273] GetFileType (hFile=0x234) returned 0x1
	[0089.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.274] GetFileType (hFile=0x234) returned 0x1
	[0089.274] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x24c
	[0089.274] ReadFile (in: hFile=0x234, lpBuffer=0x270a320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x270a320*, lpNumberOfBytesRead=0x26eb64*=0x24c, lpOverlapped=0x0) returned 1
	[0089.278] CloseHandle (hObject=0x234) returned 1
	[0089.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0089.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.280] GetFileType (hFile=0x234) returned 0x1
	[0089.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.280] GetFileType (hFile=0x234) returned 0x1
	[0089.280] WriteFile (in: hFile=0x234, lpBuffer=0x270cb0c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x270cb0c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", lpFilePart=0x0) returned 0x7e
	[0089.284] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png")) returned 1
	[0089.287] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBndhJA[1].png", cAlternateFileName="BBNDHJ~1.PNG")) returned 1
	[0089.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", lpFilePart=0x0) returned 0x7e
	[0089.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.288] GetFileType (hFile=0x234) returned 0x1
	[0089.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.289] GetFileType (hFile=0x234) returned 0x1
	[0089.289] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x398
	[0089.289] ReadFile (in: hFile=0x234, lpBuffer=0x270e77c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x270e77c*, lpNumberOfBytesRead=0x26eb64*=0x398, lpOverlapped=0x0) returned 1
	[0089.293] CloseHandle (hObject=0x234) returned 1
	[0089.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0089.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.295] GetFileType (hFile=0x234) returned 0x1
	[0089.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.295] GetFileType (hFile=0x234) returned 0x1
	[0089.295] WriteFile (in: hFile=0x234, lpBuffer=0x2710f68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2710f68*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", lpFilePart=0x0) returned 0x7e
	[0089.299] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png")) returned 1
	[0089.302] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBoqF0J[1].png", cAlternateFileName="BBOQF0~1.PNG")) returned 1
	[0089.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", lpFilePart=0x0) returned 0x7e
	[0089.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.303] GetFileType (hFile=0x234) returned 0x1
	[0089.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.303] GetFileType (hFile=0x234) returned 0x1
	[0089.304] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x230
	[0089.304] ReadFile (in: hFile=0x234, lpBuffer=0x2712a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2712a70*, lpNumberOfBytesRead=0x26eb64*=0x230, lpOverlapped=0x0) returned 1
	[0089.324] CloseHandle (hObject=0x234) returned 1
	[0089.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0089.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.335] GetFileType (hFile=0x234) returned 0x1
	[0089.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.335] GetFileType (hFile=0x234) returned 0x1
	[0089.338] WriteFile (in: hFile=0x234, lpBuffer=0x271525c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x271525c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", lpFilePart=0x0) returned 0x7e
	[0089.342] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png")) returned 1
	[0089.347] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="BBzjV9E[1].png", cAlternateFileName="BBZJV9~1.PNG")) returned 1
	[0089.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", lpFilePart=0x0) returned 0x7e
	[0089.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.350] GetFileType (hFile=0x234) returned 0x1
	[0089.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.350] GetFileType (hFile=0x234) returned 0x1
	[0089.351] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x116
	[0089.351] ReadFile (in: hFile=0x234, lpBuffer=0x2716c4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x2716c4c*, lpNumberOfBytesRead=0x26eb64*=0x116, lpOverlapped=0x0) returned 1
	[0089.356] CloseHandle (hObject=0x234) returned 1
	[0089.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.KEKW", lpFilePart=0x0) returned 0x83
	[0089.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.357] GetFileType (hFile=0x234) returned 0x1
	[0089.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.357] GetFileType (hFile=0x234) returned 0x1
	[0089.358] WriteFile (in: hFile=0x234, lpBuffer=0x2719438*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2719438*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", lpFilePart=0x0) returned 0x7e
	[0089.361] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png")) returned 1
	[0089.364] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60cdb940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60cdb940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="benefits-1[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 1
	[0089.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", lpFilePart=0x0) returned 0x81
	[0089.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.366] GetFileType (hFile=0x234) returned 0x1
	[0089.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.366] GetFileType (hFile=0x234) returned 0x1
	[0089.366] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1fdaf
	[0089.368] ReadFile (in: hFile=0x234, lpBuffer=0x37fc910, nNumberOfBytesToRead=0x1fdaf, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x37fc910*, lpNumberOfBytesRead=0x26eb64*=0x1fdaf, lpOverlapped=0x0) returned 1
	[0089.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.KEKW", lpFilePart=0x0) returned 0x86
	[0089.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.381] GetFileType (hFile=0x234) returned 0x1
	[0089.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.381] GetFileType (hFile=0x234) returned 0x1
	[0089.381] WriteFile (in: hFile=0x234, lpBuffer=0x271c524*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x271c524*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", lpFilePart=0x0) returned 0x81
	[0089.384] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg")) returned 1
	[0089.390] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6157c900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6157c900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x615c8bc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12282, dwReserved0=0x0, dwReserved1=0x0, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1
	[0089.390] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50fa0830, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x82d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="chartbeat[1].js", cAlternateFileName="CHARTB~1.JS")) returned 1
	[0089.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", lpFilePart=0x0) returned 0x7f
	[0089.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.392] GetFileType (hFile=0x234) returned 0x1
	[0089.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.392] GetFileType (hFile=0x234) returned 0x1
	[0089.392] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x82d8
	[0089.393] ReadFile (in: hFile=0x234, lpBuffer=0x271e45c, nNumberOfBytesToRead=0x82d8, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x271e45c*, lpNumberOfBytesRead=0x26eb64*=0x82d8, lpOverlapped=0x0) returned 1
	[0089.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js.KEKW", lpFilePart=0x0) returned 0x84
	[0089.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0089.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.399] GetFileType (hFile=0x234) returned 0x1
	[0089.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0089.399] GetFileType (hFile=0x234) returned 0x1
	[0089.400] WriteFile (in: hFile=0x234, lpBuffer=0x2727f2c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2727f2c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0089.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", lpFilePart=0x0) returned 0x7f
	[0089.405] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chartbeat[1].js")) returned 1
	[0089.409] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c8f680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c8f680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d01aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3bf20, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome-installer.min[1].js", cAlternateFileName="CHROME~1.JS")) returned 1
	[0089.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", lpFilePart=0x0) returned 0x8a
	[0089.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0089.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0089.411] GetFileType (hFile=0x234) returned 0x1
	[0089.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0089.411] GetFileType (hFile=0x234) returned 0x1
	[0089.411] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3bf20
	[0089.413] ReadFile (in: hFile=0x234, lpBuffer=0x381c6e0, nNumberOfBytesToRead=0x3bf20, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x381c6e0*, lpNumberOfBytesRead=0x26eb64*=0x3bf20, lpOverlapped=0x0) returned 1
	[0090.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js.KEKW", lpFilePart=0x0) returned 0x8f
	[0090.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0090.255] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.256] GetFileType (hFile=0x234) returned 0x1
	[0090.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0090.257] GetFileType (hFile=0x234) returned 0x1
	[0090.257] WriteFile (in: hFile=0x234, lpBuffer=0x272b0f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x272b0f0*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0090.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", lpFilePart=0x0) returned 0x8a
	[0090.260] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome-installer.min[1].js")) returned 1
	[0090.269] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60aec760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_logo_2x[1].png", cAlternateFileName="CHROME~1.PNG")) returned 1
	[0090.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", lpFilePart=0x0) returned 0x85
	[0090.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0090.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.270] GetFileType (hFile=0x234) returned 0x1
	[0090.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0090.270] GetFileType (hFile=0x234) returned 0x1
	[0090.270] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1622
	[0090.271] ReadFile (in: hFile=0x234, lpBuffer=0x272ca3c, nNumberOfBytesToRead=0x1622, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x272ca3c*, lpNumberOfBytesRead=0x26eb64*=0x1622, lpOverlapped=0x0) returned 1
	[0090.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.KEKW", lpFilePart=0x0) returned 0x8a
	[0090.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0090.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.278] GetFileType (hFile=0x234) returned 0x1
	[0090.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0090.278] GetFileType (hFile=0x234) returned 0x1
	[0090.278] WriteFile (in: hFile=0x234, lpBuffer=0x272f87c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x272f87c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0090.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", lpFilePart=0x0) returned 0x85
	[0090.281] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png")) returned 1
	[0090.284] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x610b9d00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x610b9d00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="close-icon[1].png", cAlternateFileName="CLOSE-~1.PNG")) returned 1
	[0090.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", lpFilePart=0x0) returned 0x81
	[0090.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0090.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.285] GetFileType (hFile=0x234) returned 0x1
	[0090.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0090.286] GetFileType (hFile=0x234) returned 0x1
	[0090.286] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x13d
	[0090.286] ReadFile (in: hFile=0x234, lpBuffer=0x27312c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x27312c8*, lpNumberOfBytesRead=0x26eb64*=0x13d, lpOverlapped=0x0) returned 1
	[0090.296] CloseHandle (hObject=0x234) returned 1
	[0090.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.KEKW", lpFilePart=0x0) returned 0x86
	[0090.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0090.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.297] GetFileType (hFile=0x234) returned 0x1
	[0090.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0090.298] GetFileType (hFile=0x234) returned 0x1
	[0090.298] WriteFile (in: hFile=0x234, lpBuffer=0x2733acc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2733acc*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0090.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", lpFilePart=0x0) returned 0x81
	[0090.301] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png")) returned 1
	[0090.304] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="css[1].txt", cAlternateFileName="CSS_1_~1.TXT")) returned 1
	[0090.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", lpFilePart=0x0) returned 0x7a
	[0090.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0090.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.306] GetFileType (hFile=0x234) returned 0x1
	[0090.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0090.306] GetFileType (hFile=0x234) returned 0x1
	[0090.306] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x269b2
	[0090.308] ReadFile (in: hFile=0x234, lpBuffer=0x3858620, nNumberOfBytesToRead=0x269b2, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x3858620*, lpNumberOfBytesRead=0x26eb64*=0x269b2, lpOverlapped=0x0) returned 1
	[0090.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.KEKW", lpFilePart=0x0) returned 0x7f
	[0090.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0090.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.481] GetFileType (hFile=0x234) returned 0x1
	[0090.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0090.482] GetFileType (hFile=0x234) returned 0x1
	[0090.482] WriteFile (in: hFile=0x234, lpBuffer=0x2736b24*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2736b24*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0090.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", lpFilePart=0x0) returned 0x7a
	[0090.485] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt")) returned 1
	[0090.492] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0090.493] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf7af630, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7af630, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf821a50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4d5b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ebHtml5Banner[1].js", cAlternateFileName="EBHTML~1.JS")) returned 1
	[0090.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", lpFilePart=0x0) returned 0x83
	[0090.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0090.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.495] GetFileType (hFile=0x234) returned 0x1
	[0090.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0090.495] GetFileType (hFile=0x234) returned 0x1
	[0090.495] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x4d5b9
	[0090.498] ReadFile (in: hFile=0x234, lpBuffer=0x387eff0, nNumberOfBytesToRead=0x4d5b9, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x387eff0*, lpNumberOfBytesRead=0x26eb64*=0x4d5b9, lpOverlapped=0x0) returned 1
	[0090.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js.KEKW", lpFilePart=0x0) returned 0x88
	[0090.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0090.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.529] GetFileType (hFile=0x234) returned 0x1
	[0090.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0090.529] GetFileType (hFile=0x234) returned 0x1
	[0090.531] WriteFile (in: hFile=0x234, lpBuffer=0x273a200*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x273a200*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0090.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", lpFilePart=0x0) returned 0x83
	[0090.534] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ebhtml5banner[1].js")) returned 1
	[0090.546] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64009240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64009240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6402f3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula-win[1].jpg", cAlternateFileName="EULA-W~1.JPG")) returned 1
	[0090.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", lpFilePart=0x0) returned 0x7f
	[0090.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0090.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.548] GetFileType (hFile=0x234) returned 0x1
	[0090.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0090.548] GetFileType (hFile=0x234) returned 0x1
	[0090.548] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x5244
	[0090.548] ReadFile (in: hFile=0x234, lpBuffer=0x273badc, nNumberOfBytesToRead=0x5244, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x273badc*, lpNumberOfBytesRead=0x26eb64*=0x5244, lpOverlapped=0x0) returned 1
	[0090.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.KEKW", lpFilePart=0x0) returned 0x84
	[0090.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0090.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.554] GetFileType (hFile=0x234) returned 0x1
	[0090.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0090.555] GetFileType (hFile=0x234) returned 0x1
	[0090.555] WriteFile (in: hFile=0x234, lpBuffer=0x2742518*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2742518*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0090.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", lpFilePart=0x0) returned 0x7f
	[0090.559] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg")) returned 1
	[0090.562] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1303, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~3")) returned 1
	[0090.563] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1
	[0090.564] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe138690, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe138690, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe138690, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1
	[0090.564] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510ff810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510ff810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51125970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jquery-1.11.1.min[1].js", cAlternateFileName="JQUERY~1.JS")) returned 1
	[0090.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", lpFilePart=0x0) returned 0x87
	[0090.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0090.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.567] GetFileType (hFile=0x234) returned 0x1
	[0090.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0090.567] GetFileType (hFile=0x234) returned 0x1
	[0090.567] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x1762e
	[0090.568] ReadFile (in: hFile=0x234, lpBuffer=0x38cc5c8, nNumberOfBytesToRead=0x1762e, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x38cc5c8*, lpNumberOfBytesRead=0x26eb64*=0x1762e, lpOverlapped=0x0) returned 1
	[0090.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js.KEKW", lpFilePart=0x0) returned 0x8c
	[0090.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0090.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.579] GetFileType (hFile=0x234) returned 0x1
	[0090.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0090.579] GetFileType (hFile=0x234) returned 0x1
	[0090.579] WriteFile (in: hFile=0x234, lpBuffer=0x2747f08*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2747f08*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0090.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", lpFilePart=0x0) returned 0x87
	[0090.583] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\jquery-1.11.1.min[1].js")) returned 1
	[0090.588] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5442d110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5442d110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5442d110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1
	[0090.589] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1
	[0090.589] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d66650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d66650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e70ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7154, dwReserved0=0x0, dwReserved1=0x0, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1
	[0090.590] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="latest[2].eot", cAlternateFileName="LATEST~2.EOT")) returned 1
	[0090.590] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="latest[3].eot", cAlternateFileName="LATEST~3.EOT")) returned 1
	[0090.590] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53122110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x922, dwReserved0=0x0, dwReserved1=0x0, cFileName="msn[1].htm", cAlternateFileName="MSN_1_~1.HTM")) returned 1
	[0090.591] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6378e3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6378e3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x637b4540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3112, dwReserved0=0x0, dwReserved1=0x0, cFileName="rpc_shindig_random[1].js", cAlternateFileName="RPC_SH~1.JS")) returned 1
	[0090.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js", lpFilePart=0x0) returned 0x88
	[0090.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0090.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.592] GetFileType (hFile=0x234) returned 0x1
	[0090.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0090.592] GetFileType (hFile=0x234) returned 0x1
	[0090.593] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x3112
	[0090.593] ReadFile (in: hFile=0x234, lpBuffer=0x274bc0c, nNumberOfBytesToRead=0x3112, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x274bc0c*, lpNumberOfBytesRead=0x26eb64*=0x3112, lpOverlapped=0x0) returned 1
	[0090.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js.KEKW", lpFilePart=0x0) returned 0x8d
	[0090.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0090.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.599] GetFileType (hFile=0x234) returned 0x1
	[0090.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0090.600] GetFileType (hFile=0x234) returned 0x1
	[0090.600] WriteFile (in: hFile=0x234, lpBuffer=0x2750548*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2750548*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0090.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js", lpFilePart=0x0) returned 0x88
	[0090.603] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\rpc_shindig_random[1].js")) returned 1
	[0090.607] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xbf7d5790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="thirdparty[1]", cAlternateFileName="THIRDP~1")) returned 1
	[0090.609] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54adeef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x0, dwReserved1=0x0, cFileName="uid[1].htm", cAlternateFileName="UID_1_~1.HTM")) returned 1
	[0090.609] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe5d5130, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe5d5130, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3325, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1
	[0090.610] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x0, dwReserved1=0x0, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 1
	[0090.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css", lpFilePart=0x0) returned 0x80
	[0090.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0090.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.613] GetFileType (hFile=0x234) returned 0x1
	[0090.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0090.613] GetFileType (hFile=0x234) returned 0x1
	[0090.613] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0x24fea
	[0090.683] ReadFile (in: hFile=0x234, lpBuffer=0x35d54d0, nNumberOfBytesToRead=0x24fea, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x35d54d0*, lpNumberOfBytesRead=0x26eb64*=0x24fea, lpOverlapped=0x0) returned 1
	[0090.690] CloseHandle (hObject=0x234) returned 1
	[0090.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css.KEKW", lpFilePart=0x0) returned 0x85
	[0090.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0090.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0090.692] GetFileType (hFile=0x234) returned 0x1
	[0090.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0090.692] GetFileType (hFile=0x234) returned 0x1
	[0090.694] WriteFile (in: hFile=0x234, lpBuffer=0x25df53c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x25df53c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0090.697] CloseHandle (hObject=0x234) returned 1
	[0090.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css", lpFilePart=0x0) returned 0x80
	[0090.698] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\wc-addons[1].css")) returned 1
	[0090.704] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.704] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0090.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0090.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0090.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\Decrypt.txt", lpFilePart=0x0) returned 0x7b
	[0090.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0090.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0090.706] GetFileType (hFile=0x230) returned 0x1
	[0090.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0090.706] GetFileType (hFile=0x230) returned 0x1
	[0090.707] WriteFile (in: hFile=0x230, lpBuffer=0x25e1da4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x25e1da4*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0090.710] CloseHandle (hObject=0x230) returned 1
	[0090.710] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.711] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0090.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0090.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0090.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0090.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5", lpFilePart=0x0) returned 0x66
	[0090.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\", lpFilePart=0x0) returned 0x67
	[0090.712] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0090.712] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.713] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2661a50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x2661a50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9QH4S0GZ", cAlternateFileName="")) returned 1
	[0090.714] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x401e830, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x401e830, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ABV8L7MY", cAlternateFileName="")) returned 1
	[0090.714] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0090.715] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539bc50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x539bc50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IKQEEPZR", cAlternateFileName="")) returned 1
	[0090.715] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0090.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat", lpFilePart=0x0) returned 0x70
	[0090.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb50) returned 1
	[0090.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0090.717] GetFileType (hFile=0x230) returned 0x1
	[0090.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb4c) returned 1
	[0090.718] GetFileType (hFile=0x230) returned 0x1
	[0090.718] GetFileSize (in: hFile=0x230, lpFileSizeHigh=0x26ec58 | out: lpFileSizeHigh=0x26ec58*=0x0) returned 0x54000
	[0090.721] ReadFile (in: hFile=0x230, lpBuffer=0x35fa4d8, nNumberOfBytesToRead=0x54000, lpNumberOfBytesRead=0x26ec04, lpOverlapped=0x0 | out: lpBuffer=0x35fa4d8*, lpNumberOfBytesRead=0x26ec04*=0x54000, lpOverlapped=0x0) returned 1
	[0090.742] CloseHandle (hObject=0x230) returned 1
	[0090.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat.KEKW", lpFilePart=0x0) returned 0x75
	[0090.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb84) returned 1
	[0090.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0090.750] GetFileType (hFile=0x230) returned 0x1
	[0090.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb80) returned 1
	[0090.750] GetFileType (hFile=0x230) returned 0x1
	[0090.751] WriteFile (in: hFile=0x230, lpBuffer=0x25e6560*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eba8, lpOverlapped=0x0 | out: lpBuffer=0x25e6560*, lpNumberOfBytesWritten=0x26eba8*=0x10, lpOverlapped=0x0) returned 1
	[0090.754] CloseHandle (hObject=0x230) returned 1
	[0090.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat", lpFilePart=0x0) returned 0x70
	[0090.754] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\index.dat")) returned 1
	[0090.766] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x709e870, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x709e870, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 1
	[0090.766] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x709e870, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x709e870, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 0
	[0090.767] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0090.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0090.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0090.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\Decrypt.txt", lpFilePart=0x0) returned 0x72
	[0090.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0090.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0090.768] GetFileType (hFile=0x22c) returned 0x1
	[0090.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0090.769] GetFileType (hFile=0x22c) returned 0x1
	[0090.769] WriteFile (in: hFile=0x22c, lpBuffer=0x25e8fb4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x25e8fb4*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0090.772] CloseHandle (hObject=0x22c) returned 1
	[0090.772] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0090.773] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1
	[0090.773] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0
	[0090.774] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0090.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0090.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0090.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0090.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", lpFilePart=0x0) returned 0x5a
	[0090.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", lpFilePart=0x0) returned 0x5b
	[0090.775] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0090.776] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.776] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x137cbb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x137cbb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1
	[0090.777] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7136df0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7136df0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0090.777] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0090.778] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1
	[0090.778] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", lpFilePart=0x0) returned 0x67
	[0090.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0090.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0090.781] GetFileType (hFile=0x22c) returned 0x1
	[0090.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0090.781] GetFileType (hFile=0x22c) returned 0x1
	[0090.782] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x4000
	[0090.782] ReadFile (in: hFile=0x22c, lpBuffer=0x25ebf88, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x25ebf88*, lpNumberOfBytesRead=0x26eca4*=0x4000, lpOverlapped=0x0) returned 1
	[0090.787] CloseHandle (hObject=0x22c) returned 1
	[0090.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT.KEKW", lpFilePart=0x0) returned 0x6c
	[0090.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0090.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0090.794] GetFileType (hFile=0x22c) returned 0x1
	[0090.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0090.794] GetFileType (hFile=0x22c) returned 0x1
	[0090.794] WriteFile (in: hFile=0x22c, lpBuffer=0x25f1718*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x25f1718*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0090.797] CloseHandle (hObject=0x22c) returned 1
	[0090.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", lpFilePart=0x0) returned 0x67
	[0090.798] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\msimgsiz.dat")) returned 1
	[0090.801] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.801] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0090.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0090.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0090.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0090.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0090.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0090.803] GetFileType (hFile=0x228) returned 0x1
	[0090.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0090.803] GetFileType (hFile=0x228) returned 0x1
	[0090.803] WriteFile (in: hFile=0x228, lpBuffer=0x25f3efc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x25f3efc*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0090.806] CloseHandle (hObject=0x228) returned 1
	[0090.807] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1
	[0090.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0090.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", lpFilePart=0x0) returned 0x62
	[0090.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", lpFilePart=0x0) returned 0x63
	[0090.808] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0090.812] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.812] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1
	[0090.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0090.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C", lpFilePart=0x0) returned 0x64
	[0090.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\", lpFilePart=0x0) returned 0x65
	[0090.813] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0090.814] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.815] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0090.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0090.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users", lpFilePart=0x0) returned 0x6a
	[0090.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\", lpFilePart=0x0) returned 0x6b
	[0090.816] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0090.817] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.817] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1
	[0090.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0090.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x7f
	[0090.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\", lpFilePart=0x0) returned 0x80
	[0090.819] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0090.820] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.821] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0090.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0090.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", lpFilePart=0x0) returned 0x87
	[0090.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpFilePart=0x0) returned 0x88
	[0090.822] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0090.825] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.825] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1
	[0090.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0090.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x8f
	[0090.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x90
	[0090.826] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0090.827] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.828] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0090.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0090.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x26e484, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x99
	[0090.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e458, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x9a
	[0090.829] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x26e6a4 | out: lpFindFileData=0x26e6a4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5eb0
	[0090.830] FindNextFileW (in: hFindFile=0x5f5eb0, lpFindFileData=0x26e6fc | out: lpFindFileData=0x26e6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.831] FindNextFileW (in: hFindFile=0x5f5eb0, lpFindFileData=0x26e6fc | out: lpFindFileData=0x26e6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0090.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0090.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26e3e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0xa1
	[0090.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e3b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0xa2
	[0090.832] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x26e604 | out: lpFindFileData=0x26e604*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5ef0
	[0090.832] FindNextFileW (in: hFindFile=0x5f5ef0, lpFindFileData=0x26e65c | out: lpFindFileData=0x26e65c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.834] FindNextFileW (in: hFindFile=0x5f5ef0, lpFindFileData=0x26e65c | out: lpFindFileData=0x26e65c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1
	[0090.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e83c) returned 1
	[0090.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x26e344, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0xaa
	[0090.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", nBufferLength=0x105, lpBuffer=0x26e318, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpFilePart=0x0) returned 0xab
	[0090.834] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x26e564 | out: lpFindFileData=0x26e564*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5f30
	[0090.835] FindNextFileW (in: hFindFile=0x5f5f30, lpFindFileData=0x26e5bc | out: lpFindFileData=0x26e5bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.836] FindNextFileW (in: hFindFile=0x5f5f30, lpFindFileData=0x26e5bc | out: lpFindFileData=0x26e5bc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0090.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e79c) returned 1
	[0090.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x26e2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0xae
	[0090.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", nBufferLength=0x105, lpBuffer=0x26e278, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", lpFilePart=0x0) returned 0xaf
	[0090.837] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x26e4c4 | out: lpFindFileData=0x26e4c4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5f70
	[0090.839] FindNextFileW (in: hFindFile=0x5f5f70, lpFindFileData=0x26e51c | out: lpFindFileData=0x26e51c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.844] FindNextFileW (in: hFindFile=0x5f5f70, lpFindFileData=0x26e51c | out: lpFindFileData=0x26e51c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0090.845] FindClose (in: hFindFile=0x5f5f70 | out: hFindFile=0x5f5f70) returned 1
	[0090.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e7a4) returned 1
	[0090.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e7b0) returned 1
	[0090.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e79c) returned 1
	[0090.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x26e2a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0xae
	[0090.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", nBufferLength=0x105, lpBuffer=0x26e278, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", lpFilePart=0x0) returned 0xaf
	[0090.851] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x26e4c4 | out: lpFindFileData=0x26e4c4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5f70
	[0090.851] FindNextFileW (in: hFindFile=0x5f5f70, lpFindFileData=0x26e51c | out: lpFindFileData=0x26e51c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.852] FindNextFileW (in: hFindFile=0x5f5f70, lpFindFileData=0x26e51c | out: lpFindFileData=0x26e51c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0090.852] FindClose (in: hFindFile=0x5f5f70 | out: hFindFile=0x5f5f70) returned 1
	[0090.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e7a4) returned 1
	[0090.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e7b0) returned 1
	[0090.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e168, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0xba
	[0090.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e65c) returned 1
	[0090.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x174
	[0090.854] GetFileType (hFile=0x174) returned 0x1
	[0090.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e658) returned 1
	[0090.854] GetFileType (hFile=0x174) returned 0x1
	[0090.855] WriteFile (in: hFile=0x174, lpBuffer=0x26040ec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e6f4, lpOverlapped=0x0 | out: lpBuffer=0x26040ec*, lpNumberOfBytesWritten=0x26e6f4*=0xa5, lpOverlapped=0x0) returned 1
	[0090.858] CloseHandle (hObject=0x174) returned 1
	[0090.858] FindNextFileW (in: hFindFile=0x5f5f30, lpFindFileData=0x26e5bc | out: lpFindFileData=0x26e5bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.859] FindClose (in: hFindFile=0x5f5f30 | out: hFindFile=0x5f5f30) returned 1
	[0090.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e844) returned 1
	[0090.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e850) returned 1
	[0090.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e83c) returned 1
	[0090.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x26e344, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0xaa
	[0090.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", nBufferLength=0x105, lpBuffer=0x26e318, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpFilePart=0x0) returned 0xab
	[0090.860] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x26e564 | out: lpFindFileData=0x26e564*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5f30
	[0090.860] FindNextFileW (in: hFindFile=0x5f5f30, lpFindFileData=0x26e5bc | out: lpFindFileData=0x26e5bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.861] FindNextFileW (in: hFindFile=0x5f5f30, lpFindFileData=0x26e5bc | out: lpFindFileData=0x26e5bc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x71f54d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x71f54d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0090.861] FindNextFileW (in: hFindFile=0x5f5f30, lpFindFileData=0x26e5bc | out: lpFindFileData=0x26e5bc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x71f54d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x71f54d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0090.862] FindClose (in: hFindFile=0x5f5f30 | out: hFindFile=0x5f5f30) returned 1
	[0090.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e844) returned 1
	[0090.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e850) returned 1
	[0090.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e208, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Decrypt.txt", lpFilePart=0x0) returned 0xb6
	[0090.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e6fc) returned 1
	[0090.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x21c
	[0090.863] GetFileType (hFile=0x21c) returned 0x1
	[0090.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e6f8) returned 1
	[0090.863] GetFileType (hFile=0x21c) returned 0x1
	[0090.864] WriteFile (in: hFile=0x21c, lpBuffer=0x26080d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e794, lpOverlapped=0x0 | out: lpBuffer=0x26080d8*, lpNumberOfBytesWritten=0x26e794*=0xa5, lpOverlapped=0x0) returned 1
	[0090.867] CloseHandle (hObject=0x21c) returned 1
	[0090.867] FindNextFileW (in: hFindFile=0x5f5ef0, lpFindFileData=0x26e65c | out: lpFindFileData=0x26e65c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.867] FindClose (in: hFindFile=0x5f5ef0 | out: hFindFile=0x5f5ef0) returned 1
	[0090.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8e4) returned 1
	[0090.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8f0) returned 1
	[0090.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0090.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26e3e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0xa1
	[0090.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e3b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0xa2
	[0090.869] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x26e604 | out: lpFindFileData=0x26e604*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5ef0
	[0090.869] FindNextFileW (in: hFindFile=0x5f5ef0, lpFindFileData=0x26e65c | out: lpFindFileData=0x26e65c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.870] FindNextFileW (in: hFindFile=0x5f5ef0, lpFindFileData=0x26e65c | out: lpFindFileData=0x26e65c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x721b630, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x721b630, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1
	[0090.870] FindNextFileW (in: hFindFile=0x5f5ef0, lpFindFileData=0x26e65c | out: lpFindFileData=0x26e65c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x721b630, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x721b630, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 0
	[0090.871] FindClose (in: hFindFile=0x5f5ef0 | out: hFindFile=0x5f5ef0) returned 1
	[0090.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8e4) returned 1
	[0090.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8f0) returned 1
	[0090.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e2a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0xad
	[0090.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e79c) returned 1
	[0090.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x20c
	[0090.872] GetFileType (hFile=0x20c) returned 0x1
	[0090.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e798) returned 1
	[0090.873] GetFileType (hFile=0x20c) returned 0x1
	[0090.890] WriteFile (in: hFile=0x20c, lpBuffer=0x260bfb0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e834, lpOverlapped=0x0 | out: lpBuffer=0x260bfb0*, lpNumberOfBytesWritten=0x26e834*=0xa5, lpOverlapped=0x0) returned 1
	[0090.893] CloseHandle (hObject=0x20c) returned 1
	[0090.894] FindNextFileW (in: hFindFile=0x5f5eb0, lpFindFileData=0x26e6fc | out: lpFindFileData=0x26e6fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.894] FindClose (in: hFindFile=0x5f5eb0 | out: hFindFile=0x5f5eb0) returned 1
	[0090.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e984) returned 1
	[0090.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e990) returned 1
	[0090.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0090.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x26e484, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x99
	[0090.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e458, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x9a
	[0090.895] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x26e6a4 | out: lpFindFileData=0x26e6a4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5eb0
	[0090.896] FindNextFileW (in: hFindFile=0x5f5eb0, lpFindFileData=0x26e6fc | out: lpFindFileData=0x26e6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.896] FindNextFileW (in: hFindFile=0x5f5eb0, lpFindFileData=0x26e6fc | out: lpFindFileData=0x26e6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x721b630, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x721b630, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0090.897] FindNextFileW (in: hFindFile=0x5f5eb0, lpFindFileData=0x26e6fc | out: lpFindFileData=0x26e6fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x721b630, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x721b630, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0
	[0090.897] FindClose (in: hFindFile=0x5f5eb0 | out: hFindFile=0x5f5eb0) returned 1
	[0090.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e984) returned 1
	[0090.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e990) returned 1
	[0090.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e348, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0xa5
	[0090.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e83c) returned 1
	[0090.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x210
	[0090.899] GetFileType (hFile=0x210) returned 0x1
	[0090.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e838) returned 1
	[0090.899] GetFileType (hFile=0x210) returned 0x1
	[0090.899] WriteFile (in: hFile=0x210, lpBuffer=0x260fd68*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e8d4, lpOverlapped=0x0 | out: lpBuffer=0x260fd68*, lpNumberOfBytesWritten=0x26e8d4*=0xa5, lpOverlapped=0x0) returned 1
	[0090.903] CloseHandle (hObject=0x210) returned 1
	[0090.903] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.903] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0090.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0090.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0090.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0090.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x26e524, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x8f
	[0090.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x26e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x90
	[0090.905] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x26e744 | out: lpFindFileData=0x26e744*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e70
	[0090.906] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.906] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x72678f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x72678f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0090.907] FindNextFileW (in: hFindFile=0x5f5e70, lpFindFileData=0x26e79c | out: lpFindFileData=0x26e79c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x72678f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x72678f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0
	[0090.908] FindClose (in: hFindFile=0x5f5e70 | out: hFindFile=0x5f5e70) returned 1
	[0090.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea24) returned 1
	[0090.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea30) returned 1
	[0090.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e3e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Decrypt.txt", lpFilePart=0x0) returned 0x9b
	[0090.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8dc) returned 1
	[0090.908] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x214
	[0090.909] GetFileType (hFile=0x214) returned 0x1
	[0090.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e8d8) returned 1
	[0090.909] GetFileType (hFile=0x214) returned 0x1
	[0090.910] WriteFile (in: hFile=0x214, lpBuffer=0x2613a1c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26e974, lpOverlapped=0x0 | out: lpBuffer=0x2613a1c*, lpNumberOfBytesWritten=0x26e974*=0xa5, lpOverlapped=0x0) returned 1
	[0090.913] CloseHandle (hObject=0x214) returned 1
	[0090.913] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.913] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0090.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0090.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0090.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0090.914] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", lpFilePart=0x0) returned 0x87
	[0090.914] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpFilePart=0x0) returned 0x88
	[0090.914] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0090.915] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.916] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x728da50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x728da50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1
	[0090.916] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x728da50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x728da50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0
	[0090.917] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0090.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0090.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0090.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x93
	[0090.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0090.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x218
	[0090.918] GetFileType (hFile=0x218) returned 0x1
	[0090.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0090.919] GetFileType (hFile=0x218) returned 0x1
	[0090.919] WriteFile (in: hFile=0x218, lpBuffer=0x2617570*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x2617570*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0090.925] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.926] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0090.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0090.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0090.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0090.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x7f
	[0090.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\", lpFilePart=0x0) returned 0x80
	[0090.926] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0090.927] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.928] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x728da50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x728da50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0090.928] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x728da50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x728da50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0
	[0090.929] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0090.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0090.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0090.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\Decrypt.txt", lpFilePart=0x0) returned 0x8b
	[0090.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0090.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0090.930] GetFileType (hFile=0x234) returned 0x1
	[0090.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0090.930] GetFileType (hFile=0x234) returned 0x1
	[0090.931] WriteFile (in: hFile=0x234, lpBuffer=0x261afb4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x261afb4*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0090.934] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.934] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0090.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0090.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0090.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0090.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users", lpFilePart=0x0) returned 0x6a
	[0090.938] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\", lpFilePart=0x0) returned 0x6b
	[0090.938] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0090.939] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.939] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x72b3bb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x72b3bb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1
	[0090.940] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x72b3bb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x72b3bb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0
	[0090.940] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0090.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0090.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0090.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\Decrypt.txt", lpFilePart=0x0) returned 0x76
	[0090.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0090.941] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0090.942] GetFileType (hFile=0x230) returned 0x1
	[0090.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0090.942] GetFileType (hFile=0x230) returned 0x1
	[0090.943] WriteFile (in: hFile=0x230, lpBuffer=0x261e7e8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x261e7e8*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0090.946] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.946] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0090.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0090.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0090.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0090.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C", lpFilePart=0x0) returned 0x64
	[0090.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\", lpFilePart=0x0) returned 0x65
	[0090.947] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0090.948] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.948] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x72d9d10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x72d9d10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0090.949] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x72d9d10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x72d9d10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0
	[0090.949] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0090.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0090.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0090.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Decrypt.txt", lpFilePart=0x0) returned 0x70
	[0090.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0090.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0090.976] GetFileType (hFile=0x22c) returned 0x1
	[0090.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0090.976] GetFileType (hFile=0x22c) returned 0x1
	[0090.977] WriteFile (in: hFile=0x22c, lpBuffer=0x2621e98*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2621e98*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0090.980] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0090.981] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0090.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0090.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0090.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0090.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", lpFilePart=0x0) returned 0x62
	[0090.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", lpFilePart=0x0) returned 0x63
	[0090.991] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0090.992] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0090.992] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x72d9d10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x72d9d10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1
	[0090.993] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x72d9d10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x72d9d10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 0
	[0090.993] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0090.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0090.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0090.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0090.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0090.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0090.995] GetFileType (hFile=0x228) returned 0x1
	[0090.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0090.996] GetFileType (hFile=0x228) returned 0x1
	[0090.996] WriteFile (in: hFile=0x228, lpBuffer=0x26254e4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26254e4*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0091.000] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.001] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x56
	[0091.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x57
	[0091.001] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.002] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.003] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x12be4d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12be4d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0091.003] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x12e4630, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12e4630, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1
	[0091.004] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x12e4630, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12e4630, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1
	[0091.004] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0091.005] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x71830b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x71830b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0091.005] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x734c130, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x734c130, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1
	[0091.006] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x734c130, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x734c130, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0
	[0091.006] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0091.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0091.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0091.009] GetFileType (hFile=0x224) returned 0x1
	[0091.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0091.009] GetFileType (hFile=0x224) returned 0x1
	[0091.009] WriteFile (in: hFile=0x224, lpBuffer=0x262966c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x262966c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0091.012] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0091.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x44
	[0091.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x45
	[0091.014] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.016] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.016] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1
	[0091.017] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0
	[0091.017] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x44
	[0091.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x45
	[0091.018] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.019] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.020] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1
	[0091.020] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.020] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0091.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0091.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0091.022] GetFileType (hFile=0x224) returned 0x1
	[0091.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0091.022] GetFileType (hFile=0x224) returned 0x1
	[0091.023] WriteFile (in: hFile=0x224, lpBuffer=0x262d940*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x262d940*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0091.026] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8f3fc040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8f3fc040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1
	[0091.026] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8f3d5ee0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1
	[0091.027] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1
	[0091.028] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1
	[0091.028] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1
	[0091.030] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1
	[0091.030] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1
	[0091.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x41
	[0091.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x42
	[0091.031] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.032] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.033] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1
	[0091.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0091.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", lpFilePart=0x0) returned 0x45
	[0091.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", lpFilePart=0x0) returned 0x46
	[0091.034] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0091.034] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.035] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.035] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0091.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0091.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0091.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0091.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", lpFilePart=0x0) returned 0x45
	[0091.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", lpFilePart=0x0) returned 0x46
	[0091.036] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0091.036] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.037] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.037] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0091.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0091.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0091.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0091.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\wer\\erc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0091.039] GetFileType (hFile=0x228) returned 0x1
	[0091.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0091.039] GetFileType (hFile=0x228) returned 0x1
	[0091.039] WriteFile (in: hFile=0x228, lpBuffer=0x263300c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x263300c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0091.042] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1
	[0091.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0091.043] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x4f
	[0091.043] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x50
	[0091.043] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0091.044] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.045] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.045] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0091.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0091.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0091.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0091.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x4f
	[0091.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x50
	[0091.046] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0091.046] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.047] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.047] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0091.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0091.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0091.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0091.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\wer\\reportarchive\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0091.049] GetFileType (hFile=0x228) returned 0x1
	[0091.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0091.049] GetFileType (hFile=0x228) returned 0x1
	[0091.049] WriteFile (in: hFile=0x228, lpBuffer=0x2636f50*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2636f50*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0091.052] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.053] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x41
	[0091.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x42
	[0091.053] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.054] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.054] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x73be550, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x73be550, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1
	[0091.055] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x73e46b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x73e46b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1
	[0091.055] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x73e46b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x73e46b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0
	[0091.055] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0091.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0091.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\wer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0091.057] GetFileType (hFile=0x224) returned 0x1
	[0091.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0091.057] GetFileType (hFile=0x224) returned 0x1
	[0091.057] WriteFile (in: hFile=0x224, lpBuffer=0x263a320*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x263a320*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0091.061] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1
	[0091.061] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0
	[0091.061] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0091.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0091.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0091.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0091.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x3d
	[0091.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x3e
	[0091.062] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0091.063] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.063] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xdfb8d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xdfb8d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1024", cAlternateFileName="")) returned 1
	[0091.064] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xe6dcf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xe6dcf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0091.064] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf78690, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf78690, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0091.065] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf9e7f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf9e7f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1
	[0091.065] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xfc4950, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfc4950, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1
	[0091.066] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xfeaab0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfeaab0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0091.066] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x111b5b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x111b5b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0091.066] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1141710, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1141710, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1
	[0091.067] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7372290, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7372290, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0091.067] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0x73983f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x73983f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0091.068] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8f3fc040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8f3fc040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1
	[0091.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", lpFilePart=0x0) returned 0x4a
	[0091.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0091.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0091.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26db68) returned 1
	[0091.083] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8f3d5ee0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1
	[0091.083] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1
	[0091.084] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1
	[0091.084] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1
	[0091.085] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1
	[0091.085] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x73e46b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x73e46b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1
	[0091.086] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1
	[0091.086] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.087] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0091.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0091.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0091.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0091.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0091.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0091.089] GetFileType (hFile=0x220) returned 0x1
	[0091.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0091.089] GetFileType (hFile=0x220) returned 0x1
	[0091.090] WriteFile (in: hFile=0x220, lpBuffer=0x26412cc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26412cc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0091.093] CloseHandle (hObject=0x220) returned 1
	[0091.094] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1
	[0091.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0091.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail", lpFilePart=0x0) returned 0x42
	[0091.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpFilePart=0x0) returned 0x43
	[0091.095] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0091.102] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.103] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1
	[0091.104] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1
	[0091.104] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1
	[0091.105] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1
	[0091.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", lpFilePart=0x0) returned 0x49
	[0091.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", lpFilePart=0x0) returned 0x4a
	[0091.106] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.107] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.107] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 1
	[0091.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0091.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", lpFilePart=0x0) returned 0x4d
	[0091.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", lpFilePart=0x0) returned 0x4e
	[0091.108] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0091.113] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.113] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0091.114] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0091.115] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0091.115] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0
	[0091.116] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0091.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0091.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0091.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0091.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old", lpFilePart=0x0) returned 0x4d
	[0091.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", lpFilePart=0x0) returned 0x4e
	[0091.120] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0091.123] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.123] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0091.124] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0091.124] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0091.125] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.125] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0091.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0091.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0091.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0091.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0091.132] GetFileType (hFile=0x228) returned 0x1
	[0091.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0091.133] GetFileType (hFile=0x228) returned 0x1
	[0091.133] WriteFile (in: hFile=0x228, lpBuffer=0x264860c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x264860c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0091.136] CloseHandle (hObject=0x228) returned 1
	[0091.136] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.137] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", lpFilePart=0x0) returned 0x49
	[0091.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", lpFilePart=0x0) returned 0x4a
	[0091.138] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.138] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.139] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74a2d90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x74a2d90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 1
	[0091.140] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74a2d90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x74a2d90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 0
	[0091.140] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0091.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0091.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0091.142] GetFileType (hFile=0x224) returned 0x1
	[0091.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0091.142] GetFileType (hFile=0x224) returned 0x1
	[0091.143] WriteFile (in: hFile=0x224, lpBuffer=0x264b904*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x264b904*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0091.146] CloseHandle (hObject=0x224) returned 1
	[0091.146] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1
	[0091.147] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1
	[0091.147] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0091.148] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1
	[0091.149] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1
	[0091.149] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeold.xml", cAlternateFileName="")) returned 1
	[0091.150] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0091.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", lpFilePart=0x0) returned 0x4d
	[0091.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpFilePart=0x0) returned 0x4e
	[0091.151] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.157] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.158] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1
	[0091.158] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1
	[0091.159] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0091.159] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1
	[0091.160] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1
	[0091.160] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1
	[0091.161] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1
	[0091.161] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1
	[0091.162] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1
	[0091.162] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1
	[0091.163] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1
	[0091.164] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1
	[0091.164] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1
	[0091.165] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1
	[0091.166] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1
	[0091.166] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1
	[0091.167] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1
	[0091.167] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1
	[0091.168] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1
	[0091.169] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1
	[0091.169] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1
	[0091.170] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0
	[0091.170] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", lpFilePart=0x0) returned 0x4d
	[0091.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpFilePart=0x0) returned 0x4e
	[0091.174] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.177] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.178] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1
	[0091.178] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1
	[0091.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFilePart=0x0) returned 0x57
	[0091.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0091.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.191] GetFileType (hFile=0x228) returned 0x1
	[0091.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0091.191] GetFileType (hFile=0x228) returned 0x1
	[0091.191] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x432
	[0091.191] ReadFile (in: hFile=0x228, lpBuffer=0x2651f30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2651f30*, lpNumberOfBytesRead=0x26ed44*=0x432, lpOverlapped=0x0) returned 1
	[0091.196] CloseHandle (hObject=0x228) returned 1
	[0091.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.KEKW", lpFilePart=0x0) returned 0x5c
	[0091.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0091.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.198] GetFileType (hFile=0x228) returned 0x1
	[0091.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0091.198] GetFileType (hFile=0x228) returned 0x1
	[0091.199] WriteFile (in: hFile=0x228, lpBuffer=0x265467c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x265467c*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0091.208] CloseHandle (hObject=0x228) returned 1
	[0091.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFilePart=0x0) returned 0x57
	[0091.209] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 1
	[0091.213] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0091.213] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1
	[0091.214] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1
	[0091.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFilePart=0x0) returned 0x58
	[0091.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0091.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.215] GetFileType (hFile=0x228) returned 0x1
	[0091.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0091.215] GetFileType (hFile=0x228) returned 0x1
	[0091.215] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x5d3f
	[0091.216] ReadFile (in: hFile=0x228, lpBuffer=0x26565b4, nNumberOfBytesToRead=0x5d3f, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26565b4*, lpNumberOfBytesRead=0x26ed44*=0x5d3f, lpOverlapped=0x0) returned 1
	[0091.221] CloseHandle (hObject=0x228) returned 1
	[0091.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.KEKW", lpFilePart=0x0) returned 0x5d
	[0091.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0091.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.222] GetFileType (hFile=0x228) returned 0x1
	[0091.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0091.223] GetFileType (hFile=0x228) returned 0x1
	[0091.223] WriteFile (in: hFile=0x228, lpBuffer=0x265da40*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x265da40*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0091.226] CloseHandle (hObject=0x228) returned 1
	[0091.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFilePart=0x0) returned 0x58
	[0091.226] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 1
	[0091.230] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1
	[0091.231] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1
	[0091.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFilePart=0x0) returned 0x5e
	[0091.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0091.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.233] GetFileType (hFile=0x228) returned 0x1
	[0091.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0091.233] GetFileType (hFile=0x228) returned 0x1
	[0091.233] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x1906
	[0091.233] ReadFile (in: hFile=0x228, lpBuffer=0x265f610, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x265f610*, lpNumberOfBytesRead=0x26ed44*=0x1906, lpOverlapped=0x0) returned 1
	[0091.242] CloseHandle (hObject=0x228) returned 1
	[0091.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.KEKW", lpFilePart=0x0) returned 0x63
	[0091.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0091.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.243] GetFileType (hFile=0x228) returned 0x1
	[0091.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0091.243] GetFileType (hFile=0x228) returned 0x1
	[0091.244] WriteFile (in: hFile=0x228, lpBuffer=0x2662688*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2662688*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0091.247] CloseHandle (hObject=0x228) returned 1
	[0091.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFilePart=0x0) returned 0x5e
	[0091.248] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 1
	[0091.252] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1
	[0091.252] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1
	[0091.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFilePart=0x0) returned 0x5c
	[0091.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0091.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.253] GetFileType (hFile=0x228) returned 0x1
	[0091.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0091.253] GetFileType (hFile=0x228) returned 0x1
	[0091.254] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x107e
	[0091.254] ReadFile (in: hFile=0x228, lpBuffer=0x266422c, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x266422c*, lpNumberOfBytesRead=0x26ed44*=0x107e, lpOverlapped=0x0) returned 1
	[0091.259] CloseHandle (hObject=0x228) returned 1
	[0091.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.KEKW", lpFilePart=0x0) returned 0x61
	[0091.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0091.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.260] GetFileType (hFile=0x228) returned 0x1
	[0091.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0091.260] GetFileType (hFile=0x228) returned 0x1
	[0091.261] WriteFile (in: hFile=0x228, lpBuffer=0x2666a10*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2666a10*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0091.264] CloseHandle (hObject=0x228) returned 1
	[0091.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFilePart=0x0) returned 0x5c
	[0091.264] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 1
	[0091.268] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1
	[0091.269] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1
	[0091.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFilePart=0x0) returned 0x5f
	[0091.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0091.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.272] GetFileType (hFile=0x228) returned 0x1
	[0091.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0091.272] GetFileType (hFile=0x228) returned 0x1
	[0091.272] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x18ed
	[0091.272] ReadFile (in: hFile=0x228, lpBuffer=0x2668600, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2668600*, lpNumberOfBytesRead=0x26ed44*=0x18ed, lpOverlapped=0x0) returned 1
	[0091.277] CloseHandle (hObject=0x228) returned 1
	[0091.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.KEKW", lpFilePart=0x0) returned 0x64
	[0091.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0091.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.279] GetFileType (hFile=0x228) returned 0x1
	[0091.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0091.279] GetFileType (hFile=0x228) returned 0x1
	[0091.280] WriteFile (in: hFile=0x228, lpBuffer=0x266b66c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x266b66c*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0091.283] CloseHandle (hObject=0x228) returned 1
	[0091.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFilePart=0x0) returned 0x5f
	[0091.283] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 1
	[0091.287] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1
	[0091.287] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1
	[0091.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFilePart=0x0) returned 0x59
	[0091.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0091.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.289] GetFileType (hFile=0x228) returned 0x1
	[0091.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0091.289] GetFileType (hFile=0x228) returned 0x1
	[0091.289] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x13fb
	[0091.290] ReadFile (in: hFile=0x228, lpBuffer=0x266d154, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x266d154*, lpNumberOfBytesRead=0x26ed44*=0x13fb, lpOverlapped=0x0) returned 1
	[0091.296] CloseHandle (hObject=0x228) returned 1
	[0091.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.KEKW", lpFilePart=0x0) returned 0x5e
	[0091.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0091.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.298] GetFileType (hFile=0x228) returned 0x1
	[0091.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0091.298] GetFileType (hFile=0x228) returned 0x1
	[0091.298] WriteFile (in: hFile=0x228, lpBuffer=0x266fca8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x266fca8*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0091.302] CloseHandle (hObject=0x228) returned 1
	[0091.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFilePart=0x0) returned 0x59
	[0091.302] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 1
	[0091.306] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1
	[0091.306] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1
	[0091.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFilePart=0x0) returned 0x57
	[0091.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0091.307] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.311] GetFileType (hFile=0x228) returned 0x1
	[0091.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0091.311] GetFileType (hFile=0x228) returned 0x1
	[0091.311] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x780
	[0091.311] ReadFile (in: hFile=0x228, lpBuffer=0x2671ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2671ed8*, lpNumberOfBytesRead=0x26ed44*=0x780, lpOverlapped=0x0) returned 1
	[0091.318] CloseHandle (hObject=0x228) returned 1
	[0091.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.KEKW", lpFilePart=0x0) returned 0x5c
	[0091.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0091.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.320] GetFileType (hFile=0x228) returned 0x1
	[0091.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0091.320] GetFileType (hFile=0x228) returned 0x1
	[0091.320] WriteFile (in: hFile=0x228, lpBuffer=0x2674624*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2674624*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0091.324] CloseHandle (hObject=0x228) returned 1
	[0091.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFilePart=0x0) returned 0x57
	[0091.324] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 1
	[0091.327] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1
	[0091.328] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1
	[0091.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFilePart=0x0) returned 0x5e
	[0091.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0091.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.329] GetFileType (hFile=0x228) returned 0x1
	[0091.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0091.329] GetFileType (hFile=0x228) returned 0x1
	[0091.329] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x127e
	[0091.330] ReadFile (in: hFile=0x228, lpBuffer=0x2676204, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2676204*, lpNumberOfBytesRead=0x26ed44*=0x127e, lpOverlapped=0x0) returned 1
	[0091.334] CloseHandle (hObject=0x228) returned 1
	[0091.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.KEKW", lpFilePart=0x0) returned 0x63
	[0091.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0091.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.337] GetFileType (hFile=0x228) returned 0x1
	[0091.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0091.337] GetFileType (hFile=0x228) returned 0x1
	[0091.338] WriteFile (in: hFile=0x228, lpBuffer=0x2678bf4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2678bf4*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0091.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFilePart=0x0) returned 0x5e
	[0091.345] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 1
	[0091.348] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1
	[0091.348] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1
	[0091.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFilePart=0x0) returned 0x5a
	[0091.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0091.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.350] GetFileType (hFile=0x228) returned 0x1
	[0091.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0091.351] GetFileType (hFile=0x228) returned 0x1
	[0091.351] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x2949
	[0091.351] ReadFile (in: hFile=0x228, lpBuffer=0x267a738, nNumberOfBytesToRead=0x2949, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x267a738*, lpNumberOfBytesRead=0x26ed44*=0x2949, lpOverlapped=0x0) returned 1
	[0091.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.KEKW", lpFilePart=0x0) returned 0x5f
	[0091.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0091.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.357] GetFileType (hFile=0x228) returned 0x1
	[0091.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0091.357] GetFileType (hFile=0x228) returned 0x1
	[0091.358] WriteFile (in: hFile=0x228, lpBuffer=0x267e7dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x267e7dc*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0091.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFilePart=0x0) returned 0x5a
	[0091.361] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 1
	[0091.365] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1
	[0091.365] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1
	[0091.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFilePart=0x0) returned 0x57
	[0091.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0091.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.366] GetFileType (hFile=0x228) returned 0x1
	[0091.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0091.366] GetFileType (hFile=0x228) returned 0x1
	[0091.366] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x1d51
	[0091.367] ReadFile (in: hFile=0x228, lpBuffer=0x2680284, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2680284*, lpNumberOfBytesRead=0x26ed44*=0x1d51, lpOverlapped=0x0) returned 1
	[0091.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.KEKW", lpFilePart=0x0) returned 0x5c
	[0091.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0091.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0091.372] GetFileType (hFile=0x228) returned 0x1
	[0091.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0091.373] GetFileType (hFile=0x228) returned 0x1
	[0091.373] WriteFile (in: hFile=0x228, lpBuffer=0x2683724*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2683724*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0091.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFilePart=0x0) returned 0x57
	[0091.377] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 1
	[0091.380] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.381] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0091.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0091.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0091.382] GetFileType (hFile=0x224) returned 0x1
	[0091.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0091.382] GetFileType (hFile=0x224) returned 0x1
	[0091.382] WriteFile (in: hFile=0x224, lpBuffer=0x2685eb0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2685eb0*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0091.386] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0091.386] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0091.387] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0
	[0091.387] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0091.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0091.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0091.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0091.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail", lpFilePart=0x0) returned 0x42
	[0091.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpFilePart=0x0) returned 0x43
	[0091.389] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0091.389] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.390] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1
	[0091.390] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1
	[0091.391] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1
	[0091.391] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74c8ef0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x74c8ef0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1
	[0091.392] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1
	[0091.392] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1
	[0091.393] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0091.393] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1
	[0091.394] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1
	[0091.394] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeold.xml", cAlternateFileName="")) returned 1
	[0091.395] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7704390, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7704390, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0091.395] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0091.396] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0091.396] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.396] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0091.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0091.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0091.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0091.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0091.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0091.398] GetFileType (hFile=0x220) returned 0x1
	[0091.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0091.398] GetFileType (hFile=0x220) returned 0x1
	[0091.398] WriteFile (in: hFile=0x220, lpBuffer=0x268cafc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x268cafc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0091.401] CloseHandle (hObject=0x220) returned 1
	[0091.402] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1
	[0091.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0091.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media", lpFilePart=0x0) returned 0x43
	[0091.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\", lpFilePart=0x0) returned 0x44
	[0091.403] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0091.406] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.407] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1
	[0091.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0", lpFilePart=0x0) returned 0x48
	[0091.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpFilePart=0x0) returned 0x49
	[0091.408] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.409] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.409] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1
	[0091.410] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1
	[0091.410] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0
	[0091.411] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0", lpFilePart=0x0) returned 0x48
	[0091.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpFilePart=0x0) returned 0x49
	[0091.412] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.412] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.413] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1
	[0091.414] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1
	[0091.414] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.414] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0091.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0091.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0091.416] GetFileType (hFile=0x224) returned 0x1
	[0091.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0091.416] GetFileType (hFile=0x224) returned 0x1
	[0091.417] WriteFile (in: hFile=0x224, lpBuffer=0x2692000*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2692000*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0091.469] CloseHandle (hObject=0x224) returned 1
	[0091.469] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.470] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0091.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0091.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0091.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0091.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media", lpFilePart=0x0) returned 0x43
	[0091.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\", lpFilePart=0x0) returned 0x44
	[0091.471] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0091.471] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.472] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7750650, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7750650, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1
	[0091.473] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7750650, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7750650, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 0
	[0091.473] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0091.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0091.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0091.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0091.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0091.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0091.474] GetFileType (hFile=0x220) returned 0x1
	[0091.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0091.475] GetFileType (hFile=0x220) returned 0x1
	[0091.475] WriteFile (in: hFile=0x220, lpBuffer=0x269523c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x269523c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0091.478] CloseHandle (hObject=0x220) returned 1
	[0091.479] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0091.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0091.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x45
	[0091.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpFilePart=0x0) returned 0x46
	[0091.480] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0091.481] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.482] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0091.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x4d
	[0091.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", lpFilePart=0x0) returned 0x4e
	[0091.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.483] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.484] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.484] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x4d
	[0091.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", lpFilePart=0x0) returned 0x4e
	[0091.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.486] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.486] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.487] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0091.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0091.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0091.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0091.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0091.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\gadgets\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0091.488] GetFileType (hFile=0x224) returned 0x1
	[0091.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0091.489] GetFileType (hFile=0x224) returned 0x1
	[0091.489] WriteFile (in: hFile=0x224, lpBuffer=0x2699cb0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2699cb0*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0091.492] CloseHandle (hObject=0x224) returned 1
	[0091.493] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 1
	[0091.493] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 0
	[0091.493] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0091.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0091.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0091.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0091.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x45
	[0091.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpFilePart=0x0) returned 0x46
	[0091.494] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0091.495] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.495] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x780ed30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x780ed30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0091.496] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 1
	[0091.496] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.496] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0091.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0091.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0091.497] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0091.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0091.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0091.498] GetFileType (hFile=0x220) returned 0x1
	[0091.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0091.498] GetFileType (hFile=0x220) returned 0x1
	[0091.499] WriteFile (in: hFile=0x220, lpBuffer=0x269d51c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x269d51c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0091.502] CloseHandle (hObject=0x220) returned 1
	[0091.502] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.503] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0091.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0091.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0091.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0091.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x35
	[0091.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x36
	[0091.504] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0091.505] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.505] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xffaf08d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffaf08d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0091.506] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xffb16a30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffb16a30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0091.506] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xffdea450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffdea450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0091.507] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xfffff790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xfffff790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0091.507] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x214ad0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x214ad0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1
	[0091.508] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x23ac30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x23ac30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1
	[0091.509] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x260d90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x260d90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1
	[0091.509] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2ad050, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x2ad050, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1
	[0091.509] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x2d31b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x2d31b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1
	[0091.510] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68b410, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x68b410, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0091.511] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7bbf10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7bbf10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0091.511] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xbe6590, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xbe6590, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0091.512] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xc589b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xc589b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1
	[0091.512] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xcf0f30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xcf0f30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0091.513] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xd17090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xd17090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1
	[0091.514] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xdd5770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xdd5770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1
	[0091.514] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7430970, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7430970, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0091.515] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x772a4f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x772a4f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1
	[0091.516] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x77e8bd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x77e8bd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1
	[0091.516] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x780ed30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x780ed30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0091.517] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x780ed30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x780ed30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0
	[0091.517] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0091.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0091.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0091.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0091.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0091.520] GetFileType (hFile=0x208) returned 0x1
	[0091.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0091.520] GetFileType (hFile=0x208) returned 0x1
	[0091.521] WriteFile (in: hFile=0x208, lpBuffer=0x26a200c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26a200c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0091.524] CloseHandle (hObject=0x208) returned 1
	[0091.524] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0091.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0091.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x3a
	[0091.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", lpFilePart=0x0) returned 0x3b
	[0091.525] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0091.527] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.529] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.529] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0091.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0091.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0091.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0091.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x3a
	[0091.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", lpFilePart=0x0) returned 0x3b
	[0091.530] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0091.531] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.532] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.532] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0091.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0091.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0091.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0091.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft help\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0091.534] GetFileType (hFile=0x208) returned 0x1
	[0091.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0091.534] GetFileType (hFile=0x208) returned 0x1
	[0091.534] WriteFile (in: hFile=0x208, lpBuffer=0x26a5a84*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26a5a84*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0091.538] CloseHandle (hObject=0x208) returned 1
	[0091.538] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0091.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0091.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x33
	[0091.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", lpFilePart=0x0) returned 0x34
	[0091.539] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0091.540] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.541] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1
	[0091.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0091.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3b
	[0091.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3c
	[0091.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0091.544] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.545] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0091.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0091.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x44
	[0091.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x45
	[0091.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0091.547] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.547] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1
	[0091.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0091.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x55
	[0091.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpFilePart=0x0) returned 0x56
	[0091.548] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0091.555] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.555] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0091.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0091.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache", lpFilePart=0x0) returned 0x5b
	[0091.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpFilePart=0x0) returned 0x5c
	[0091.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0091.562] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.563] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1
	[0091.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0", lpFilePart=0x0) returned 0x5d
	[0091.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\", lpFilePart=0x0) returned 0x5e
	[0091.564] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.566] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.567] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="98", cAlternateFileName="")) returned 1
	[0091.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0091.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98", lpFilePart=0x0) returned 0x60
	[0091.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\", lpFilePart=0x0) returned 0x61
	[0091.568] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.569] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.569] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B60F3d01", cAlternateFileName="")) returned 1
	[0091.569] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B60F3d01", cAlternateFileName="")) returned 0
	[0091.570] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0091.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0091.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0091.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98", lpFilePart=0x0) returned 0x60
	[0091.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\", lpFilePart=0x0) returned 0x61
	[0091.571] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.571] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.572] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B60F3d01", cAlternateFileName="")) returned 1
	[0091.572] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.573] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0091.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0091.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0091.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0091.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0091.574] GetFileType (hFile=0x234) returned 0x1
	[0091.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0091.575] GetFileType (hFile=0x234) returned 0x1
	[0091.575] WriteFile (in: hFile=0x234, lpBuffer=0x26aeec0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x26aeec0*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0091.578] CloseHandle (hObject=0x234) returned 1
	[0091.579] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 1
	[0091.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0091.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8", lpFilePart=0x0) returned 0x60
	[0091.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\", lpFilePart=0x0) returned 0x61
	[0091.579] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.584] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.585] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x0, dwReserved1=0x0, cFileName="C3B7Bd01", cAlternateFileName="")) returned 1
	[0091.585] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x0, dwReserved1=0x0, cFileName="C3B7Bd01", cAlternateFileName="")) returned 0
	[0091.585] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0091.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0091.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0091.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8", lpFilePart=0x0) returned 0x60
	[0091.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\", lpFilePart=0x0) returned 0x61
	[0091.586] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.587] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.587] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x0, dwReserved1=0x0, cFileName="C3B7Bd01", cAlternateFileName="")) returned 1
	[0091.587] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.588] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0091.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0091.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0091.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0091.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0091.590] GetFileType (hFile=0x234) returned 0x1
	[0091.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0091.590] GetFileType (hFile=0x234) returned 0x1
	[0091.599] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.599] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0", lpFilePart=0x0) returned 0x5d
	[0091.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\", lpFilePart=0x0) returned 0x5e
	[0091.600] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.601] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.601] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x78cd410, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x78cd410, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="98", cAlternateFileName="")) returned 1
	[0091.601] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x78f3570, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x78f3570, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 1
	[0091.602] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x78f3570, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x78f3570, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 0
	[0091.602] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0091.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.636] GetFileType (hFile=0x230) returned 0x1
	[0091.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0091.636] GetFileType (hFile=0x230) returned 0x1
	[0091.639] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1", cAlternateFileName="")) returned 1
	[0091.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1", lpFilePart=0x0) returned 0x5d
	[0091.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", lpFilePart=0x0) returned 0x5e
	[0091.640] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.641] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.641] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B", cAlternateFileName="")) returned 1
	[0091.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0091.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B", lpFilePart=0x0) returned 0x60
	[0091.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\", lpFilePart=0x0) returned 0x61
	[0091.642] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.643] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.643] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="FCBF5d01", cAlternateFileName="")) returned 1
	[0091.644] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="FCBF5d01", cAlternateFileName="")) returned 0
	[0091.644] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0091.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0091.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0091.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B", lpFilePart=0x0) returned 0x60
	[0091.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\", lpFilePart=0x0) returned 0x61
	[0091.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.645] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.646] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="FCBF5d01", cAlternateFileName="")) returned 1
	[0091.646] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.646] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0091.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0091.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0091.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0091.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0091.648] GetFileType (hFile=0x234) returned 0x1
	[0091.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0091.648] GetFileType (hFile=0x234) returned 0x1
	[0091.651] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2", cAlternateFileName="")) returned 1
	[0091.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0091.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2", lpFilePart=0x0) returned 0x60
	[0091.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\", lpFilePart=0x0) returned 0x61
	[0091.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.655] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.655] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B619d01", cAlternateFileName="")) returned 1
	[0091.656] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B619d01", cAlternateFileName="")) returned 0
	[0091.656] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0091.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0091.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0091.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2", lpFilePart=0x0) returned 0x60
	[0091.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\", lpFilePart=0x0) returned 0x61
	[0091.657] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.657] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.658] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B619d01", cAlternateFileName="")) returned 1
	[0091.658] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.658] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0091.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0091.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0091.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0091.659] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0091.660] GetFileType (hFile=0x234) returned 0x1
	[0091.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0091.660] GetFileType (hFile=0x234) returned 0x1
	[0091.663] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 1
	[0091.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0091.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6", lpFilePart=0x0) returned 0x60
	[0091.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\", lpFilePart=0x0) returned 0x61
	[0091.664] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.664] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.665] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CBD4Dd01", cAlternateFileName="")) returned 1
	[0091.665] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CBD4Dd01", cAlternateFileName="")) returned 0
	[0091.666] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0091.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0091.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0091.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6", lpFilePart=0x0) returned 0x60
	[0091.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\", lpFilePart=0x0) returned 0x61
	[0091.666] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.667] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.667] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CBD4Dd01", cAlternateFileName="")) returned 1
	[0091.668] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.668] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0091.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0091.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0091.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0091.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0091.670] GetFileType (hFile=0x234) returned 0x1
	[0091.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0091.670] GetFileType (hFile=0x234) returned 0x1
	[0091.673] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.673] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.674] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1", lpFilePart=0x0) returned 0x5d
	[0091.674] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", lpFilePart=0x0) returned 0x5e
	[0091.674] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.675] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.675] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x798baf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x798baf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B", cAlternateFileName="")) returned 1
	[0091.675] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x79b1c50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x79b1c50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2", cAlternateFileName="")) returned 1
	[0091.676] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x79d7db0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x79d7db0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 1
	[0091.676] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x79d7db0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x79d7db0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 0
	[0091.676] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0091.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.678] GetFileType (hFile=0x230) returned 0x1
	[0091.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0091.678] GetFileType (hFile=0x230) returned 0x1
	[0091.681] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2", cAlternateFileName="")) returned 1
	[0091.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2", lpFilePart=0x0) returned 0x5d
	[0091.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\", lpFilePart=0x0) returned 0x5e
	[0091.681] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.684] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.684] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.684] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2", lpFilePart=0x0) returned 0x5d
	[0091.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\", lpFilePart=0x0) returned 0x5e
	[0091.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.686] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.686] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.686] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0091.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\2\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.688] GetFileType (hFile=0x230) returned 0x1
	[0091.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0091.688] GetFileType (hFile=0x230) returned 0x1
	[0091.691] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3", cAlternateFileName="")) returned 1
	[0091.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3", lpFilePart=0x0) returned 0x5d
	[0091.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\", lpFilePart=0x0) returned 0x5e
	[0091.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.694] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.695] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 1
	[0091.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0091.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B", lpFilePart=0x0) returned 0x60
	[0091.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\", lpFilePart=0x0) returned 0x61
	[0091.695] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.698] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.698] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D8FDd01", cAlternateFileName="")) returned 1
	[0091.698] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D8FDd01", cAlternateFileName="")) returned 0
	[0091.698] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0091.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0091.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0091.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B", lpFilePart=0x0) returned 0x60
	[0091.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\", lpFilePart=0x0) returned 0x61
	[0091.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.700] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.700] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D8FDd01", cAlternateFileName="")) returned 1
	[0091.700] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.700] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0091.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0091.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0091.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0091.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0091.702] GetFileType (hFile=0x234) returned 0x1
	[0091.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0091.702] GetFileType (hFile=0x234) returned 0x1
	[0091.705] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0091.705] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3", lpFilePart=0x0) returned 0x5d
	[0091.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\", lpFilePart=0x0) returned 0x5e
	[0091.706] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.706] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.706] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7a24070, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7a24070, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 1
	[0091.706] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7a24070, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7a24070, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 0
	[0091.707] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0091.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.708] GetFileType (hFile=0x230) returned 0x1
	[0091.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0091.708] GetFileType (hFile=0x230) returned 0x1
	[0091.711] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4", cAlternateFileName="")) returned 1
	[0091.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4", lpFilePart=0x0) returned 0x5d
	[0091.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\", lpFilePart=0x0) returned 0x5e
	[0091.712] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.712] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.712] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.712] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4", lpFilePart=0x0) returned 0x5d
	[0091.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\", lpFilePart=0x0) returned 0x5e
	[0091.713] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.713] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.714] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.714] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0091.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\4\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.716] GetFileType (hFile=0x230) returned 0x1
	[0091.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0091.716] GetFileType (hFile=0x230) returned 0x1
	[0091.719] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5", cAlternateFileName="")) returned 1
	[0091.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5", lpFilePart=0x0) returned 0x5d
	[0091.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\", lpFilePart=0x0) returned 0x5e
	[0091.720] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.722] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.722] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.722] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5", lpFilePart=0x0) returned 0x5d
	[0091.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\", lpFilePart=0x0) returned 0x5e
	[0091.723] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.723] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.724] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.724] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0091.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\5\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.725] GetFileType (hFile=0x230) returned 0x1
	[0091.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0091.725] GetFileType (hFile=0x230) returned 0x1
	[0091.728] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6", cAlternateFileName="")) returned 1
	[0091.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6", lpFilePart=0x0) returned 0x5d
	[0091.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\", lpFilePart=0x0) returned 0x5e
	[0091.729] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.729] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.729] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0091.730] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6", lpFilePart=0x0) returned 0x5d
	[0091.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\", lpFilePart=0x0) returned 0x5e
	[0091.730] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.731] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0091.732] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0091.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\6\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.733] GetFileType (hFile=0x230) returned 0x1
	[0091.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0091.733] GetFileType (hFile=0x230) returned 0x1
	[0091.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7", lpFilePart=0x0) returned 0x5d
	[0091.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\", lpFilePart=0x0) returned 0x5e
	[0091.737] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.739] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.739] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7", lpFilePart=0x0) returned 0x5d
	[0091.739] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\", lpFilePart=0x0) returned 0x5e
	[0091.740] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.740] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0091.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\7\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.741] GetFileType (hFile=0x230) returned 0x1
	[0091.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0091.742] GetFileType (hFile=0x230) returned 0x1
	[0091.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8", lpFilePart=0x0) returned 0x5d
	[0091.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\", lpFilePart=0x0) returned 0x5e
	[0091.746] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.747] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0091.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8", lpFilePart=0x0) returned 0x5d
	[0091.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\", lpFilePart=0x0) returned 0x5e
	[0091.747] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.749] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0091.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0091.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0091.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\8\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.751] GetFileType (hFile=0x230) returned 0x1
	[0091.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0091.751] GetFileType (hFile=0x230) returned 0x1
	[0091.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9", lpFilePart=0x0) returned 0x5d
	[0091.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", lpFilePart=0x0) returned 0x5e
	[0091.754] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10", lpFilePart=0x0) returned 0x60
	[0091.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\", lpFilePart=0x0) returned 0x61
	[0091.757] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.757] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10", lpFilePart=0x0) returned 0x60
	[0091.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\", lpFilePart=0x0) returned 0x61
	[0091.758] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.758] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0091.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0091.759] GetFileType (hFile=0x234) returned 0x1
	[0091.760] GetFileType (hFile=0x234) returned 0x1
	[0091.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C", lpFilePart=0x0) returned 0x60
	[0091.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\", lpFilePart=0x0) returned 0x61
	[0091.764] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.765] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C", lpFilePart=0x0) returned 0x60
	[0091.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\", lpFilePart=0x0) returned 0x61
	[0091.766] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.766] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0091.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0091.767] GetFileType (hFile=0x234) returned 0x1
	[0091.767] GetFileType (hFile=0x234) returned 0x1
	[0091.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61", lpFilePart=0x0) returned 0x60
	[0091.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\", lpFilePart=0x0) returned 0x61
	[0091.771] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.771] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.772] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61", lpFilePart=0x0) returned 0x60
	[0091.772] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\", lpFilePart=0x0) returned 0x61
	[0091.772] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.772] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.772] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0091.773] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0091.773] GetFileType (hFile=0x234) returned 0x1
	[0091.774] GetFileType (hFile=0x234) returned 0x1
	[0091.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0", lpFilePart=0x0) returned 0x60
	[0091.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\", lpFilePart=0x0) returned 0x61
	[0091.777] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.779] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0", lpFilePart=0x0) returned 0x60
	[0091.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\", lpFilePart=0x0) returned 0x61
	[0091.779] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.780] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0091.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0091.781] GetFileType (hFile=0x234) returned 0x1
	[0091.781] GetFileType (hFile=0x234) returned 0x1
	[0091.784] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9", lpFilePart=0x0) returned 0x5d
	[0091.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", lpFilePart=0x0) returned 0x5e
	[0091.785] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.785] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.786] GetFileType (hFile=0x230) returned 0x1
	[0091.786] GetFileType (hFile=0x230) returned 0x1
	[0091.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A", lpFilePart=0x0) returned 0x5d
	[0091.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\", lpFilePart=0x0) returned 0x5e
	[0091.790] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.790] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A", lpFilePart=0x0) returned 0x5d
	[0091.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\", lpFilePart=0x0) returned 0x5e
	[0091.791] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.791] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\a\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.792] GetFileType (hFile=0x230) returned 0x1
	[0091.793] GetFileType (hFile=0x230) returned 0x1
	[0091.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B", lpFilePart=0x0) returned 0x5d
	[0091.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\", lpFilePart=0x0) returned 0x5e
	[0091.796] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.802] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B", lpFilePart=0x0) returned 0x5d
	[0091.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\", lpFilePart=0x0) returned 0x5e
	[0091.803] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.803] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.804] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\b\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.804] GetFileType (hFile=0x230) returned 0x1
	[0091.804] GetFileType (hFile=0x230) returned 0x1
	[0091.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C", lpFilePart=0x0) returned 0x5d
	[0091.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\", lpFilePart=0x0) returned 0x5e
	[0091.808] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6", lpFilePart=0x0) returned 0x60
	[0091.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\", lpFilePart=0x0) returned 0x61
	[0091.808] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.814] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6", lpFilePart=0x0) returned 0x60
	[0091.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\", lpFilePart=0x0) returned 0x61
	[0091.814] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0091.815] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0091.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0091.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0091.816] GetFileType (hFile=0x234) returned 0x1
	[0091.816] GetFileType (hFile=0x234) returned 0x1
	[0091.819] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C", lpFilePart=0x0) returned 0x5d
	[0091.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\", lpFilePart=0x0) returned 0x5e
	[0091.819] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0091.819] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0091.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0091.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0091.820] GetFileType (hFile=0x230) returned 0x1
	[0091.820] GetFileType (hFile=0x230) returned 0x1
	[0091.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D", lpFilePart=0x0) returned 0x5d
	[0091.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\", lpFilePart=0x0) returned 0x5e
	[0091.823] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0092.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08", lpFilePart=0x0) returned 0x60
	[0092.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\", lpFilePart=0x0) returned 0x61
	[0092.024] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0092.028] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0092.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08", lpFilePart=0x0) returned 0x60
	[0092.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\", lpFilePart=0x0) returned 0x61
	[0092.028] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0092.029] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0092.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0092.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0092.030] GetFileType (hFile=0x234) returned 0x1
	[0092.030] GetFileType (hFile=0x234) returned 0x1
	[0092.033] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0092.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D", lpFilePart=0x0) returned 0x5d
	[0092.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\", lpFilePart=0x0) returned 0x5e
	[0092.034] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0092.034] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0092.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0092.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0092.035] GetFileType (hFile=0x230) returned 0x1
	[0092.035] GetFileType (hFile=0x230) returned 0x1
	[0092.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E", lpFilePart=0x0) returned 0x5d
	[0092.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\", lpFilePart=0x0) returned 0x5e
	[0092.038] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0092.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69", lpFilePart=0x0) returned 0x60
	[0092.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\", lpFilePart=0x0) returned 0x61
	[0092.039] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0092.040] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0092.040] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69", lpFilePart=0x0) returned 0x60
	[0092.040] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\", lpFilePart=0x0) returned 0x61
	[0092.040] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0092.041] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0092.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0092.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0092.042] GetFileType (hFile=0x234) returned 0x1
	[0092.042] GetFileType (hFile=0x234) returned 0x1
	[0092.049] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0092.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E", lpFilePart=0x0) returned 0x5d
	[0092.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\", lpFilePart=0x0) returned 0x5e
	[0092.049] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0092.050] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0092.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0092.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0092.051] GetFileType (hFile=0x230) returned 0x1
	[0092.051] GetFileType (hFile=0x230) returned 0x1
	[0092.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F", lpFilePart=0x0) returned 0x5d
	[0092.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\", lpFilePart=0x0) returned 0x5e
	[0092.054] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0092.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23", lpFilePart=0x0) returned 0x60
	[0092.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\", lpFilePart=0x0) returned 0x61
	[0092.061] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0092.062] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0092.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23", lpFilePart=0x0) returned 0x60
	[0092.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\", lpFilePart=0x0) returned 0x61
	[0092.062] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0092.063] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0092.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0092.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0092.064] GetFileType (hFile=0x234) returned 0x1
	[0092.064] GetFileType (hFile=0x234) returned 0x1
	[0092.067] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0", lpFilePart=0x0) returned 0x60
	[0092.067] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\", lpFilePart=0x0) returned 0x61
	[0092.067] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0092.076] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0092.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0", lpFilePart=0x0) returned 0x60
	[0092.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\", lpFilePart=0x0) returned 0x61
	[0092.076] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0092.077] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0092.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0092.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0092.078] GetFileType (hFile=0x234) returned 0x1
	[0092.078] GetFileType (hFile=0x234) returned 0x1
	[0092.081] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0092.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F", lpFilePart=0x0) returned 0x5d
	[0092.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\", lpFilePart=0x0) returned 0x5e
	[0092.082] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0092.082] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0092.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0092.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0092.094] GetFileType (hFile=0x230) returned 0x1
	[0092.094] GetFileType (hFile=0x230) returned 0x1
	[0092.097] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0092.097] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache", lpFilePart=0x0) returned 0x5b
	[0092.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpFilePart=0x0) returned 0x5c
	[0092.098] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0092.098] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0092.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0092.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0092.099] GetFileType (hFile=0x22c) returned 0x1
	[0092.099] GetFileType (hFile=0x22c) returned 0x1
	[0092.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache", lpFilePart=0x0) returned 0x62
	[0092.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\", lpFilePart=0x0) returned 0x63
	[0092.103] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0092.106] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0092.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache", lpFilePart=0x0) returned 0x62
	[0092.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\", lpFilePart=0x0) returned 0x63
	[0092.113] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0092.113] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0092.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0092.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0092.114] GetFileType (hFile=0x22c) returned 0x1
	[0092.114] GetFileType (hFile=0x22c) returned 0x1
	[0092.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing", lpFilePart=0x0) returned 0x62
	[0092.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpFilePart=0x0) returned 0x63
	[0092.117] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0092.144] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0092.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing", lpFilePart=0x0) returned 0x62
	[0092.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpFilePart=0x0) returned 0x63
	[0092.147] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0092.150] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0092.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0092.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0092.156] GetFileType (hFile=0x22c) returned 0x1
	[0092.156] GetFileType (hFile=0x22c) returned 0x1
	[0092.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache", lpFilePart=0x0) returned 0x62
	[0092.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\", lpFilePart=0x0) returned 0x63
	[0092.160] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0092.170] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0092.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache", lpFilePart=0x0) returned 0x62
	[0092.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\", lpFilePart=0x0) returned 0x63
	[0092.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0092.171] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0092.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0092.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0092.173] GetFileType (hFile=0x22c) returned 0x1
	[0092.173] GetFileType (hFile=0x22c) returned 0x1
	[0092.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails", lpFilePart=0x0) returned 0x60
	[0092.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", lpFilePart=0x0) returned 0x61
	[0092.176] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0092.182] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0092.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails", lpFilePart=0x0) returned 0x60
	[0092.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", lpFilePart=0x0) returned 0x61
	[0092.185] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0092.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", nBufferLength=0x105, lpBuffer=0x26e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", lpFilePart=0x0) returned 0x85
	[0092.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0092.189] GetFileType (hFile=0x230) returned 0x1
	[0092.190] GetFileType (hFile=0x230) returned 0x1
	[0092.190] GetFileSize (in: hFile=0x230, lpFileSizeHigh=0x26ec58 | out: lpFileSizeHigh=0x26ec58*=0x0) returned 0x40b0
	[0092.190] ReadFile (in: hFile=0x230, lpBuffer=0x274e95c, nNumberOfBytesToRead=0x40b0, lpNumberOfBytesRead=0x26ec04, lpOverlapped=0x0 | out: lpBuffer=0x274e95c*, lpNumberOfBytesRead=0x26ec04*=0x40b0, lpOverlapped=0x0) returned 1
	[0092.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.KEKW", lpFilePart=0x0) returned 0x8a
	[0092.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0092.196] GetFileType (hFile=0x230) returned 0x1
	[0092.196] GetFileType (hFile=0x230) returned 0x1
	[0092.197] WriteFile (in: hFile=0x230, lpBuffer=0x2754244*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eba8, lpOverlapped=0x0 | out: lpBuffer=0x2754244*, lpNumberOfBytesWritten=0x26eba8*=0x10, lpOverlapped=0x0) returned 1
	[0092.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", nBufferLength=0x105, lpBuffer=0x26e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", lpFilePart=0x0) returned 0x85
	[0092.200] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png")) returned 1
	[0092.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", nBufferLength=0x105, lpBuffer=0x26e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", lpFilePart=0x0) returned 0x85
	[0092.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0092.204] GetFileType (hFile=0x230) returned 0x1
	[0092.205] GetFileType (hFile=0x230) returned 0x1
	[0092.205] GetFileSize (in: hFile=0x230, lpFileSizeHigh=0x26ec58 | out: lpFileSizeHigh=0x26ec58*=0x0) returned 0x40b0
	[0092.205] ReadFile (in: hFile=0x230, lpBuffer=0x2755bc0, nNumberOfBytesToRead=0x40b0, lpNumberOfBytesRead=0x26ec04, lpOverlapped=0x0 | out: lpBuffer=0x2755bc0*, lpNumberOfBytesRead=0x26ec04*=0x40b0, lpOverlapped=0x0) returned 1
	[0092.209] CloseHandle (hObject=0x230) returned 1
	[0092.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.KEKW", lpFilePart=0x0) returned 0x8a
	[0092.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0092.211] GetFileType (hFile=0x230) returned 0x1
	[0092.211] GetFileType (hFile=0x230) returned 0x1
	[0092.211] WriteFile (in: hFile=0x230, lpBuffer=0x275b4a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eba8, lpOverlapped=0x0 | out: lpBuffer=0x275b4a8*, lpNumberOfBytesWritten=0x26eba8*=0x10, lpOverlapped=0x0) returned 1
	[0092.215] CloseHandle (hObject=0x230) returned 1
	[0092.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", nBufferLength=0x105, lpBuffer=0x26e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", lpFilePart=0x0) returned 0x85
	[0092.216] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png")) returned 1
	[0092.220] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x0, dwReserved1=0x0, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 1
	[0092.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", nBufferLength=0x105, lpBuffer=0x26e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", lpFilePart=0x0) returned 0x85
	[0092.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb50) returned 1
	[0092.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0092.223] GetFileType (hFile=0x230) returned 0x1
	[0092.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb4c) returned 1
	[0092.223] GetFileType (hFile=0x230) returned 0x1
	[0092.223] GetFileSize (in: hFile=0x230, lpFileSizeHigh=0x26ec58 | out: lpFileSizeHigh=0x26ec58*=0x0) returned 0x1c362
	[0092.225] ReadFile (in: hFile=0x230, lpBuffer=0x364e4f8, nNumberOfBytesToRead=0x1c362, lpNumberOfBytesRead=0x26ec04, lpOverlapped=0x0 | out: lpBuffer=0x364e4f8*, lpNumberOfBytesRead=0x26ec04*=0x1c362, lpOverlapped=0x0) returned 1
	[0092.234] CloseHandle (hObject=0x230) returned 1
	[0092.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.KEKW", lpFilePart=0x0) returned 0x8a
	[0092.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb84) returned 1
	[0092.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0092.236] GetFileType (hFile=0x230) returned 0x1
	[0092.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb80) returned 1
	[0092.236] GetFileType (hFile=0x230) returned 0x1
	[0092.237] WriteFile (in: hFile=0x230, lpBuffer=0x275e650*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eba8, lpOverlapped=0x0 | out: lpBuffer=0x275e650*, lpNumberOfBytesWritten=0x26eba8*=0x10, lpOverlapped=0x0) returned 1
	[0092.240] CloseHandle (hObject=0x230) returned 1
	[0092.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", nBufferLength=0x105, lpBuffer=0x26e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", lpFilePart=0x0) returned 0x85
	[0092.240] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png")) returned 1
	[0092.246] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.246] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0092.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0092.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0092.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0092.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0092.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0092.248] GetFileType (hFile=0x22c) returned 0x1
	[0092.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0092.248] GetFileType (hFile=0x22c) returned 0x1
	[0092.248] WriteFile (in: hFile=0x22c, lpBuffer=0x2760e88*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2760e88*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0092.251] CloseHandle (hObject=0x22c) returned 1
	[0092.251] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 1
	[0092.252] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 0
	[0092.252] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0092.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0092.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0092.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x55
	[0092.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpFilePart=0x0) returned 0x56
	[0092.253] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0092.253] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.254] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7ddc2d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7ddc2d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0092.255] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7e02430, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7e02430, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfflineCache", cAlternateFileName="OFFLIN~1")) returned 1
	[0092.255] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e74850, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7e74850, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="safebrowsing", cAlternateFileName="SAFEBR~2")) returned 1
	[0092.256] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="startupCache", cAlternateFileName="STARTU~1")) returned 1
	[0092.256] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7f59090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7f59090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbnails", cAlternateFileName="THUMBN~1")) returned 1
	[0092.257] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 1
	[0092.257] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.257] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0092.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0092.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0092.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0092.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0092.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0092.259] GetFileType (hFile=0x228) returned 0x1
	[0092.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0092.259] GetFileType (hFile=0x228) returned 0x1
	[0092.259] WriteFile (in: hFile=0x228, lpBuffer=0x2765274*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2765274*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0092.269] CloseHandle (hObject=0x228) returned 1
	[0092.270] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.270] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0092.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0092.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0092.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0092.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x44
	[0092.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x45
	[0092.271] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0092.272] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.272] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7f59090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7f59090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1
	[0092.273] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7f59090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7f59090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0
	[0092.273] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0092.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0092.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0092.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0092.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0092.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0092.275] GetFileType (hFile=0x224) returned 0x1
	[0092.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0092.275] GetFileType (hFile=0x224) returned 0x1
	[0092.275] WriteFile (in: hFile=0x224, lpBuffer=0x276858c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x276858c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0092.278] CloseHandle (hObject=0x224) returned 1
	[0092.279] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.279] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0092.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0092.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0092.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0092.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3b
	[0092.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3c
	[0092.280] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0092.280] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.281] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0092.281] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0
	[0092.282] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0092.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0092.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0092.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0092.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0092.284] GetFileType (hFile=0x220) returned 0x1
	[0092.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0092.284] GetFileType (hFile=0x220) returned 0x1
	[0092.285] WriteFile (in: hFile=0x220, lpBuffer=0x276b6d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x276b6d8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0092.287] CloseHandle (hObject=0x220) returned 1
	[0092.288] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1
	[0092.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0092.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", lpFilePart=0x0) returned 0x3b
	[0092.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", lpFilePart=0x0) returned 0x3c
	[0092.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0092.289] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.290] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 1
	[0092.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0092.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", lpFilePart=0x0) returned 0x4c
	[0092.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpFilePart=0x0) returned 0x4d
	[0092.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0092.297] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.298] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 1
	[0092.298] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1
	[0092.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", lpFilePart=0x0) returned 0x54
	[0092.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", lpFilePart=0x0) returned 0x55
	[0092.299] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0092.301] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.302] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1
	[0092.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0092.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0", lpFilePart=0x0) returned 0x56
	[0092.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", lpFilePart=0x0) returned 0x57
	[0092.303] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0092.303] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.304] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x818016b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x927c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.mar", cAlternateFileName="")) returned 1
	[0092.304] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 1
	[0092.305] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 0
	[0092.306] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0092.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0092.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0092.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0092.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0", lpFilePart=0x0) returned 0x56
	[0092.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", lpFilePart=0x0) returned 0x57
	[0092.307] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0092.307] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.308] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x818016b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x927c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.mar", cAlternateFileName="")) returned 1
	[0092.309] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 1
	[0092.309] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.309] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0092.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0092.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0092.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0092.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0092.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0092.311] GetFileType (hFile=0x22c) returned 0x1
	[0092.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0092.311] GetFileType (hFile=0x22c) returned 0x1
	[0092.312] WriteFile (in: hFile=0x22c, lpBuffer=0x2772c28*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2772c28*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0092.315] CloseHandle (hObject=0x22c) returned 1
	[0092.315] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.316] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0092.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0092.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0092.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", lpFilePart=0x0) returned 0x54
	[0092.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", lpFilePart=0x0) returned 0x55
	[0092.317] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0092.318] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.318] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7ff1610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7ff1610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1
	[0092.319] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7ff1610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7ff1610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 0
	[0092.319] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0092.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0092.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0092.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0092.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0092.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0092.321] GetFileType (hFile=0x228) returned 0x1
	[0092.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0092.321] GetFileType (hFile=0x228) returned 0x1
	[0092.321] WriteFile (in: hFile=0x228, lpBuffer=0x2776098*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2776098*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0092.324] CloseHandle (hObject=0x228) returned 1
	[0092.325] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates.xml", cAlternateFileName="")) returned 1
	[0092.327] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates.xml", cAlternateFileName="")) returned 0
	[0092.327] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0092.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0092.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0092.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0092.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", lpFilePart=0x0) returned 0x4c
	[0092.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpFilePart=0x0) returned 0x4d
	[0092.328] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0092.328] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.329] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 1
	[0092.330] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7ff1610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7ff1610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1
	[0092.330] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates.xml", cAlternateFileName="")) returned 1
	[0092.331] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.331] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0092.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0092.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0092.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Decrypt.txt", lpFilePart=0x0) returned 0x58
	[0092.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0092.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0092.333] GetFileType (hFile=0x224) returned 0x1
	[0092.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0092.333] GetFileType (hFile=0x224) returned 0x1
	[0092.333] WriteFile (in: hFile=0x224, lpBuffer=0x2779f20*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2779f20*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0092.336] CloseHandle (hObject=0x224) returned 1
	[0092.337] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.337] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0092.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0092.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0092.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0092.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", lpFilePart=0x0) returned 0x3b
	[0092.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", lpFilePart=0x0) returned 0x3c
	[0092.338] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0092.338] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.340] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8017770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8017770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 1
	[0092.340] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8017770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8017770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 0
	[0092.341] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0092.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0092.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0092.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0092.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0092.342] GetFileType (hFile=0x220) returned 0x1
	[0092.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0092.343] GetFileType (hFile=0x220) returned 0x1
	[0092.343] WriteFile (in: hFile=0x220, lpBuffer=0x277d0ec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x277d0ec*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0092.346] CloseHandle (hObject=0x220) returned 1
	[0092.346] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.347] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0092.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0092.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0092.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0092.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x33
	[0092.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", lpFilePart=0x0) returned 0x34
	[0092.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0092.348] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.349] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7fa5350, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7fa5350, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1
	[0092.350] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x803d8d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x803d8d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1
	[0092.350] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x803d8d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x803d8d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 0
	[0092.350] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0092.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0092.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0092.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0092.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0092.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0092.352] GetFileType (hFile=0x208) returned 0x1
	[0092.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0092.352] GetFileType (hFile=0x208) returned 0x1
	[0092.353] WriteFile (in: hFile=0x208, lpBuffer=0x2780250*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2780250*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0092.357] CloseHandle (hObject=0x208) returned 1
	[0092.357] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeb237b80, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xeb237b80, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0092.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0092.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
	[0092.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31
	[0092.358] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeb237b80, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xeb237b80, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0092.358] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeb237b80, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xeb237b80, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.359] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57762c00, ftCreationTime.dwHighDateTime=0x1d5dad1, ftLastAccessTime.dwLowDateTime=0x190cad70, ftLastAccessTime.dwHighDateTime=0x1d5e70d, ftLastWriteTime.dwLowDateTime=0x190cad70, ftLastWriteTime.dwHighDateTime=0x1d5e70d, nFileSizeHigh=0x0, nFileSizeLow=0xc4c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="-woNQk54G8nB.mp3", cAlternateFileName="-WONQK~1.MP3")) returned 1
	[0092.360] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8a019e0, ftCreationTime.dwHighDateTime=0x1d5dcb5, ftLastAccessTime.dwLowDateTime=0x54d41ba0, ftLastAccessTime.dwHighDateTime=0x1d5df8c, ftLastWriteTime.dwLowDateTime=0x54d41ba0, ftLastWriteTime.dwHighDateTime=0x1d5df8c, nFileSizeHigh=0x0, nFileSizeLow=0xac6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0E7G14Wd5zXVzS.jpg", cAlternateFileName="0E7G14~1.JPG")) returned 1
	[0092.360] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5afddd60, ftCreationTime.dwHighDateTime=0x1d5e81d, ftLastAccessTime.dwLowDateTime=0xb0946d0, ftLastAccessTime.dwHighDateTime=0x1d5e36f, ftLastWriteTime.dwLowDateTime=0xb0946d0, ftLastWriteTime.dwHighDateTime=0x1d5e36f, nFileSizeHigh=0x0, nFileSizeLow=0x1f7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1fQvFBAb.m4a", cAlternateFileName="")) returned 1
	[0092.361] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe270dfc0, ftCreationTime.dwHighDateTime=0x1d5da73, ftLastAccessTime.dwLowDateTime=0x6c1d9c20, ftLastAccessTime.dwHighDateTime=0x1d5e54d, ftLastWriteTime.dwLowDateTime=0x6c1d9c20, ftLastWriteTime.dwHighDateTime=0x1d5e54d, nFileSizeHigh=0x0, nFileSizeLow=0x183c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="4pwLEa.wav", cAlternateFileName="")) returned 1
	[0092.362] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x250b5570, ftCreationTime.dwHighDateTime=0x1d5da7b, ftLastAccessTime.dwLowDateTime=0xb04f24f0, ftLastAccessTime.dwHighDateTime=0x1d5dea3, ftLastWriteTime.dwLowDateTime=0xb04f24f0, ftLastWriteTime.dwHighDateTime=0x1d5dea3, nFileSizeHigh=0x0, nFileSizeLow=0x10262, dwReserved0=0x0, dwReserved1=0x0, cFileName="4T_8FhctsVyDn5n2Vs7o.ots", cAlternateFileName="4T_8FH~1.OTS")) returned 1
	[0092.362] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd50c0be0, ftCreationTime.dwHighDateTime=0x1d5d8be, ftLastAccessTime.dwLowDateTime=0x43da51b0, ftLastAccessTime.dwHighDateTime=0x1d5e70d, ftLastWriteTime.dwLowDateTime=0x43da51b0, ftLastWriteTime.dwHighDateTime=0x1d5e70d, nFileSizeHigh=0x0, nFileSizeLow=0xa486, dwReserved0=0x0, dwReserved1=0x0, cFileName="6kYt7Oq.flv", cAlternateFileName="")) returned 1
	[0092.363] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b053080, ftCreationTime.dwHighDateTime=0x1d5dd6d, ftLastAccessTime.dwLowDateTime=0x495363a0, ftLastAccessTime.dwHighDateTime=0x1d5e3c2, ftLastWriteTime.dwLowDateTime=0x495363a0, ftLastWriteTime.dwHighDateTime=0x1d5e3c2, nFileSizeHigh=0x0, nFileSizeLow=0xaf03, dwReserved0=0x0, dwReserved1=0x0, cFileName="6o9QhWGVDttu5BYX9I.odp", cAlternateFileName="6O9QHW~1.ODP")) returned 1
	[0092.363] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8cb10730, ftCreationTime.dwHighDateTime=0x1d5df74, ftLastAccessTime.dwLowDateTime=0xa7defb30, ftLastAccessTime.dwHighDateTime=0x1d5e4f0, ftLastWriteTime.dwLowDateTime=0xa7defb30, ftLastWriteTime.dwHighDateTime=0x1d5e4f0, nFileSizeHigh=0x0, nFileSizeLow=0x5d2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7p6R.doc", cAlternateFileName="")) returned 1
	[0092.364] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa145ae0, ftCreationTime.dwHighDateTime=0x1d5e17f, ftLastAccessTime.dwLowDateTime=0xc0e56600, ftLastAccessTime.dwHighDateTime=0x1d5d92e, ftLastWriteTime.dwLowDateTime=0xc0e56600, ftLastWriteTime.dwHighDateTime=0x1d5d92e, nFileSizeHigh=0x0, nFileSizeLow=0x1509d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9b3apoDbxfF0.mp3", cAlternateFileName="9B3APO~1.MP3")) returned 1
	[0092.364] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7e39220, ftCreationTime.dwHighDateTime=0x1d5d824, ftLastAccessTime.dwLowDateTime=0xca6bba50, ftLastAccessTime.dwHighDateTime=0x1d5e13d, ftLastWriteTime.dwLowDateTime=0xca6bba50, ftLastWriteTime.dwHighDateTime=0x1d5e13d, nFileSizeHigh=0x0, nFileSizeLow=0x13d3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="aaFw.avi", cAlternateFileName="")) returned 1
	[0092.365] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a0318e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6a0318e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb20126a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1
	[0092.366] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6be9bb00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6be9bb00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x6be9bb00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bst449D.tmp", cAlternateFileName="")) returned 1
	[0092.366] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa40dc900, ftCreationTime.dwHighDateTime=0x1d5e6df, ftLastAccessTime.dwLowDateTime=0xefdcf7a0, ftLastAccessTime.dwHighDateTime=0x1d5df3e, ftLastWriteTime.dwLowDateTime=0xefdcf7a0, ftLastWriteTime.dwHighDateTime=0x1d5df3e, nFileSizeHigh=0x0, nFileSizeLow=0x154b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cGg1aWCsNJku9vTtAm66.mp4", cAlternateFileName="CGG1AW~1.MP4")) returned 1
	[0092.367] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0092.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0092.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38
	[0092.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", lpFilePart=0x0) returned 0x39
	[0092.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0092.371] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.372] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0092.372] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0092.372] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0092.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0092.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0092.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0092.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies", lpFilePart=0x0) returned 0x38
	[0092.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", lpFilePart=0x0) returned 0x39
	[0092.373] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0092.374] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.374] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0092.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", lpFilePart=0x0) returned 0x42
	[0092.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0092.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0092.375] GetFileType (hFile=0x224) returned 0x1
	[0092.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0092.376] GetFileType (hFile=0x224) returned 0x1
	[0092.376] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x4000
	[0092.376] ReadFile (in: hFile=0x224, lpBuffer=0x2784774, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2784774*, lpNumberOfBytesRead=0x26ede4*=0x4000, lpOverlapped=0x0) returned 1
	[0092.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.KEKW", lpFilePart=0x0) returned 0x47
	[0092.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0092.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0092.384] GetFileType (hFile=0x224) returned 0x1
	[0092.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0092.385] GetFileType (hFile=0x224) returned 0x1
	[0092.385] WriteFile (in: hFile=0x224, lpBuffer=0x2789e68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2789e68*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0092.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", lpFilePart=0x0) returned 0x42
	[0092.389] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\index.dat")) returned 1
	[0092.393] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.393] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0092.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0092.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0092.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0092.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0092.395] GetFileType (hFile=0x220) returned 0x1
	[0092.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0092.395] GetFileType (hFile=0x220) returned 0x1
	[0092.395] WriteFile (in: hFile=0x220, lpBuffer=0x278c57c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x278c57c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0092.398] CloseHandle (hObject=0x220) returned 1
	[0092.399] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf184cde0, ftCreationTime.dwHighDateTime=0x1d5df83, ftLastAccessTime.dwLowDateTime=0xe9d99440, ftLastAccessTime.dwHighDateTime=0x1d5d9bb, ftLastWriteTime.dwLowDateTime=0xe9d99440, ftLastWriteTime.dwHighDateTime=0x1d5d9bb, nFileSizeHigh=0x0, nFileSizeLow=0xecc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cpqr.pptx", cAlternateFileName="CPQR~1.PPT")) returned 1
	[0092.399] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe507f70, ftCreationTime.dwHighDateTime=0x1d5df72, ftLastAccessTime.dwLowDateTime=0x71e04810, ftLastAccessTime.dwHighDateTime=0x1d5e07f, ftLastWriteTime.dwLowDateTime=0x71e04810, ftLastWriteTime.dwHighDateTime=0x1d5e07f, nFileSizeHigh=0x0, nFileSizeLow=0x3095, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7QYbicNi.swf", cAlternateFileName="E7QYBI~1.SWF")) returned 1
	[0092.400] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdb84d770, ftCreationTime.dwHighDateTime=0x1d5de6f, ftLastAccessTime.dwLowDateTime=0xca01ccc0, ftLastAccessTime.dwHighDateTime=0x1d5e652, ftLastWriteTime.dwLowDateTime=0xca01ccc0, ftLastWriteTime.dwHighDateTime=0x1d5e652, nFileSizeHigh=0x0, nFileSizeLow=0x13ce1, dwReserved0=0x0, dwReserved1=0x0, cFileName="fvrTqCbpRrDy.png", cAlternateFileName="FVRTQC~1.PNG")) returned 1
	[0092.400] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1
	[0092.401] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35b05900, ftCreationTime.dwHighDateTime=0x1d5dc58, ftLastAccessTime.dwLowDateTime=0xc40b6f20, ftLastAccessTime.dwHighDateTime=0x1d5e237, ftLastWriteTime.dwLowDateTime=0xc40b6f20, ftLastWriteTime.dwHighDateTime=0x1d5e237, nFileSizeHigh=0x0, nFileSizeLow=0x16d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fy7ojirPSxZB6.mp4", cAlternateFileName="FY7OJI~1.MP4")) returned 1
	[0092.403] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea94b5a0, ftCreationTime.dwHighDateTime=0x1d5e5ea, ftLastAccessTime.dwLowDateTime=0x6e594d70, ftLastAccessTime.dwHighDateTime=0x1d5da9b, ftLastWriteTime.dwLowDateTime=0x6e594d70, ftLastWriteTime.dwHighDateTime=0x1d5da9b, nFileSizeHigh=0x0, nFileSizeLow=0x34b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="G7xtpu-tcctiadIKAdC.wav", cAlternateFileName="G7XTPU~1.WAV")) returned 1
	[0092.403] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda945220, ftCreationTime.dwHighDateTime=0x1d5df0d, ftLastAccessTime.dwLowDateTime=0x15ac07c0, ftLastAccessTime.dwHighDateTime=0x1d5e514, ftLastWriteTime.dwLowDateTime=0x15ac07c0, ftLastWriteTime.dwHighDateTime=0x1d5e514, nFileSizeHigh=0x0, nFileSizeLow=0x11ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gfr4isOlW6S_.xls", cAlternateFileName="GFR4IS~1.XLS")) returned 1
	[0092.404] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0092.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0092.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38
	[0092.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", lpFilePart=0x0) returned 0x39
	[0092.405] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0092.408] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.408] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0092.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0092.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44
	[0092.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpFilePart=0x0) returned 0x45
	[0092.409] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0092.410] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.411] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0092.411] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0092.412] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0092.412] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0092.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0092.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0092.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0092.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5", lpFilePart=0x0) returned 0x44
	[0092.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpFilePart=0x0) returned 0x45
	[0092.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0092.414] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.414] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0092.415] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0092.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", lpFilePart=0x0) returned 0x4e
	[0092.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0092.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0092.416] GetFileType (hFile=0x228) returned 0x1
	[0092.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0092.416] GetFileType (hFile=0x228) returned 0x1
	[0092.416] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x4000
	[0092.416] ReadFile (in: hFile=0x228, lpBuffer=0x2790d10, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2790d10*, lpNumberOfBytesRead=0x26ed44*=0x4000, lpOverlapped=0x0) returned 1
	[0092.454] CloseHandle (hObject=0x228) returned 1
	[0092.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.KEKW", lpFilePart=0x0) returned 0x53
	[0092.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0092.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0092.456] GetFileType (hFile=0x228) returned 0x1
	[0092.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0092.456] GetFileType (hFile=0x228) returned 0x1
	[0092.457] WriteFile (in: hFile=0x228, lpBuffer=0x2796434*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2796434*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0092.460] CloseHandle (hObject=0x228) returned 1
	[0092.460] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", lpFilePart=0x0) returned 0x4e
	[0092.460] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\index.dat")) returned 1
	[0092.464] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.465] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0092.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0092.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0092.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0092.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0092.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0092.466] GetFileType (hFile=0x224) returned 0x1
	[0092.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0092.466] GetFileType (hFile=0x224) returned 0x1
	[0092.467] WriteFile (in: hFile=0x224, lpBuffer=0x2798b90*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2798b90*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0092.470] CloseHandle (hObject=0x224) returned 1
	[0092.470] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.470] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0092.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0092.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0092.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0092.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History", lpFilePart=0x0) returned 0x38
	[0092.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", lpFilePart=0x0) returned 0x39
	[0092.471] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0092.472] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.472] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x816e3d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x816e3d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0092.473] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x816e3d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x816e3d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0
	[0092.473] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0092.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0092.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0092.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0092.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0092.475] GetFileType (hFile=0x220) returned 0x1
	[0092.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0092.475] GetFileType (hFile=0x220) returned 0x1
	[0092.476] WriteFile (in: hFile=0x220, lpBuffer=0x279bc98*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x279bc98*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0092.479] CloseHandle (hObject=0x220) returned 1
	[0092.479] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x486704b0, ftCreationTime.dwHighDateTime=0x1d5e56b, ftLastAccessTime.dwLowDateTime=0x91466550, ftLastAccessTime.dwHighDateTime=0x1d5e10a, ftLastWriteTime.dwLowDateTime=0x91466550, ftLastWriteTime.dwHighDateTime=0x1d5e10a, nFileSizeHigh=0x0, nFileSizeLow=0x39c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HwxfeDn5Bq68NPyEv.gif", cAlternateFileName="HWXFED~1.GIF")) returned 1
	[0092.486] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x32ed5810, ftCreationTime.dwHighDateTime=0x1d5dcbe, ftLastAccessTime.dwLowDateTime=0x6f181e90, ftLastAccessTime.dwHighDateTime=0x1d5e378, ftLastWriteTime.dwLowDateTime=0x6f181e90, ftLastWriteTime.dwHighDateTime=0x1d5e378, nFileSizeHigh=0x0, nFileSizeLow=0xdaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="hym0YsegPr3.pdf", cAlternateFileName="HYM0YS~1.PDF")) returned 1
	[0092.487] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd5e97e10, ftCreationTime.dwHighDateTime=0x1d5dbf4, ftLastAccessTime.dwLowDateTime=0x2c71ef00, ftLastAccessTime.dwHighDateTime=0x1d5e3f3, ftLastWriteTime.dwLowDateTime=0x2c71ef00, ftLastWriteTime.dwHighDateTime=0x1d5e3f3, nFileSizeHigh=0x0, nFileSizeLow=0x37f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="h_5k_decEE4iA7R.mp3", cAlternateFileName="H_5K_D~1.MP3")) returned 1
	[0092.487] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9d59cd0, ftCreationTime.dwHighDateTime=0x1d5e0be, ftLastAccessTime.dwLowDateTime=0x188656a0, ftLastAccessTime.dwHighDateTime=0x1d5e7e2, ftLastWriteTime.dwLowDateTime=0x188656a0, ftLastWriteTime.dwHighDateTime=0x1d5e7e2, nFileSizeHigh=0x0, nFileSizeLow=0x3a8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J8Vv7dW_.bmp", cAlternateFileName="")) returned 1
	[0092.488] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4c89750, ftCreationTime.dwHighDateTime=0x1d5e477, ftLastAccessTime.dwLowDateTime=0x764daff0, ftLastAccessTime.dwHighDateTime=0x1d5e2d2, ftLastWriteTime.dwLowDateTime=0x764daff0, ftLastWriteTime.dwHighDateTime=0x1d5e2d2, nFileSizeHigh=0x0, nFileSizeLow=0x15f31, dwReserved0=0x0, dwReserved1=0x0, cFileName="jMZchOwb.pdf", cAlternateFileName="")) returned 1
	[0092.488] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafed3820, ftCreationTime.dwHighDateTime=0x1d5d7fb, ftLastAccessTime.dwLowDateTime=0xa5239150, ftLastAccessTime.dwHighDateTime=0x1d5d7e2, ftLastWriteTime.dwLowDateTime=0xa5239150, ftLastWriteTime.dwHighDateTime=0x1d5d7e2, nFileSizeHigh=0x0, nFileSizeLow=0x8b51, dwReserved0=0x0, dwReserved1=0x0, cFileName="jYIRnb _.avi", cAlternateFileName="JYIRNB~1.AVI")) returned 1
	[0092.492] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42eb07f0, ftCreationTime.dwHighDateTime=0x1d5df73, ftLastAccessTime.dwLowDateTime=0x12ed88a0, ftLastAccessTime.dwHighDateTime=0x1d5dacf, ftLastWriteTime.dwLowDateTime=0x12ed88a0, ftLastWriteTime.dwHighDateTime=0x1d5dacf, nFileSizeHigh=0x0, nFileSizeLow=0x3176, dwReserved0=0x0, dwReserved1=0x0, cFileName="K5W5aHuYJQeIDdHll.m4a", cAlternateFileName="K5W5AH~1.M4A")) returned 1
	[0092.492] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18e222a0, ftCreationTime.dwHighDateTime=0x1d5e3fa, ftLastAccessTime.dwLowDateTime=0x26428e40, ftLastAccessTime.dwHighDateTime=0x1d5e110, ftLastWriteTime.dwLowDateTime=0x26428e40, ftLastWriteTime.dwHighDateTime=0x1d5e110, nFileSizeHigh=0x0, nFileSizeLow=0xc957, dwReserved0=0x0, dwReserved1=0x0, cFileName="lWTBcFnBpv.bmp", cAlternateFileName="LWTBCF~1.BMP")) returned 1
	[0092.493] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41795930, ftCreationTime.dwHighDateTime=0x1d5e7bb, ftLastAccessTime.dwLowDateTime=0xbf7f9740, ftLastAccessTime.dwHighDateTime=0x1d5db59, ftLastWriteTime.dwLowDateTime=0xbf7f9740, ftLastWriteTime.dwHighDateTime=0x1d5db59, nFileSizeHigh=0x0, nFileSizeLow=0xb18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="O CxWx.mp4", cAlternateFileName="OCXWX~1.MP4")) returned 1
	[0092.493] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda6a3cf0, ftCreationTime.dwHighDateTime=0x1d5e2d3, ftLastAccessTime.dwLowDateTime=0x3a35d790, ftLastAccessTime.dwHighDateTime=0x1d5e12e, ftLastWriteTime.dwLowDateTime=0x3a35d790, ftLastWriteTime.dwHighDateTime=0x1d5e12e, nFileSizeHigh=0x0, nFileSizeLow=0x1aa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="od2HJ.jpg", cAlternateFileName="")) returned 1
	[0092.494] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa09fd840, ftCreationTime.dwHighDateTime=0x1d5e085, ftLastAccessTime.dwLowDateTime=0x41d66b60, ftLastAccessTime.dwHighDateTime=0x1d5dad8, ftLastWriteTime.dwLowDateTime=0x41d66b60, ftLastWriteTime.dwHighDateTime=0x1d5dad8, nFileSizeHigh=0x0, nFileSizeLow=0x1346d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIhn.mp4", cAlternateFileName="")) returned 1
	[0092.495] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6904ff90, ftCreationTime.dwHighDateTime=0x1d5e54f, ftLastAccessTime.dwLowDateTime=0x570e01f0, ftLastAccessTime.dwHighDateTime=0x1d5e3b1, ftLastWriteTime.dwLowDateTime=0x570e01f0, ftLastWriteTime.dwHighDateTime=0x1d5e3b1, nFileSizeHigh=0x0, nFileSizeLow=0x8b8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rRoOEbsQAZ-SwPiF.mp3", cAlternateFileName="RROOEB~1.MP3")) returned 1
	[0092.496] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x67bc24f0, ftCreationTime.dwHighDateTime=0x1d5dd85, ftLastAccessTime.dwLowDateTime=0x99558100, ftLastAccessTime.dwHighDateTime=0x1d5dc36, ftLastWriteTime.dwLowDateTime=0x99558100, ftLastWriteTime.dwHighDateTime=0x1d5dc36, nFileSizeHigh=0x0, nFileSizeLow=0x1665, dwReserved0=0x0, dwReserved1=0x0, cFileName="ruNROWAu.pdf", cAlternateFileName="")) returned 1
	[0092.496] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x617a0c90, ftCreationTime.dwHighDateTime=0x1d5e0a2, ftLastAccessTime.dwLowDateTime=0xc53c4410, ftLastAccessTime.dwHighDateTime=0x1d5e452, ftLastWriteTime.dwLowDateTime=0xc53c4410, ftLastWriteTime.dwHighDateTime=0x1d5e452, nFileSizeHigh=0x0, nFileSizeLow=0x116e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="S 3Gr3 pcheo.png", cAlternateFileName="S3GR3P~1.PNG")) returned 1
	[0092.497] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a16a450, ftCreationTime.dwHighDateTime=0x1d5e814, ftLastAccessTime.dwLowDateTime=0x62a956f0, ftLastAccessTime.dwHighDateTime=0x1d5e496, ftLastWriteTime.dwLowDateTime=0x62a956f0, ftLastWriteTime.dwHighDateTime=0x1d5e496, nFileSizeHigh=0x0, nFileSizeLow=0x1543c, dwReserved0=0x0, dwReserved1=0x0, cFileName="snerTA_937NJl-_cV.wav", cAlternateFileName="SNERTA~1.WAV")) returned 1
	[0092.497] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x137b49a0, ftCreationTime.dwHighDateTime=0x1d5e7c8, ftLastAccessTime.dwLowDateTime=0x5241c900, ftLastAccessTime.dwHighDateTime=0x1d5e2a2, ftLastWriteTime.dwLowDateTime=0x5241c900, ftLastWriteTime.dwHighDateTime=0x1d5e2a2, nFileSizeHigh=0x0, nFileSizeLow=0x4b39, dwReserved0=0x0, dwReserved1=0x0, cFileName="SWRI.jpg", cAlternateFileName="")) returned 1
	[0092.498] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0092.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0092.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49
	[0092.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x4a
	[0092.499] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0092.502] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.502] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0092.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0092.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55
	[0092.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x56
	[0092.503] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0092.504] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.504] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1
	[0092.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e
	[0092.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", lpFilePart=0x0) returned 0x5f
	[0092.505] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0092.507] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.508] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0092.508] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0092.509] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0092.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0092.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0092.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0", lpFilePart=0x0) returned 0x5e
	[0092.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", lpFilePart=0x0) returned 0x5f
	[0092.510] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0092.510] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.511] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0092.511] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.511] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0092.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0092.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0092.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0092.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0092.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0092.513] GetFileType (hFile=0x228) returned 0x1
	[0092.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0092.514] GetFileType (hFile=0x228) returned 0x1
	[0092.514] WriteFile (in: hFile=0x228, lpBuffer=0x27a37a0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27a37a0*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0092.517] CloseHandle (hObject=0x228) returned 1
	[0092.518] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0092.518] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0092.519] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KETAJP6D", cAlternateFileName="")) returned 1
	[0092.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e
	[0092.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", lpFilePart=0x0) returned 0x5f
	[0092.519] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0092.520] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.521] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0092.521] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0092.521] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0092.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0092.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0092.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D", lpFilePart=0x0) returned 0x5e
	[0092.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", lpFilePart=0x0) returned 0x5f
	[0092.523] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0092.523] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.524] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0092.524] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.524] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0092.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0092.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0092.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0092.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0092.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0092.526] GetFileType (hFile=0x228) returned 0x1
	[0092.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0092.526] GetFileType (hFile=0x228) returned 0x1
	[0092.530] WriteFile (in: hFile=0x228, lpBuffer=0x27a8524*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27a8524*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0092.533] CloseHandle (hObject=0x228) returned 1
	[0092.533] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1
	[0092.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e
	[0092.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", lpFilePart=0x0) returned 0x5f
	[0092.534] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0092.535] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.535] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0092.536] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0092.536] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0092.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0092.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0092.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB", lpFilePart=0x0) returned 0x5e
	[0092.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", lpFilePart=0x0) returned 0x5f
	[0092.537] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0092.538] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.538] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0092.539] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.539] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0092.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0092.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0092.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0092.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0092.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0092.540] GetFileType (hFile=0x228) returned 0x1
	[0092.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0092.541] GetFileType (hFile=0x228) returned 0x1
	[0092.541] WriteFile (in: hFile=0x228, lpBuffer=0x27acf04*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27acf04*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0092.544] CloseHandle (hObject=0x228) returned 1
	[0092.544] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1
	[0092.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e
	[0092.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", lpFilePart=0x0) returned 0x5f
	[0092.545] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0092.550] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.550] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0092.551] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0092.551] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0092.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0092.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0092.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9", lpFilePart=0x0) returned 0x5e
	[0092.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", lpFilePart=0x0) returned 0x5f
	[0092.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0092.553] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.553] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0092.553] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.554] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0092.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0092.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0092.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0092.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0092.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0092.555] GetFileType (hFile=0x228) returned 0x1
	[0092.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0092.556] GetFileType (hFile=0x228) returned 0x1
	[0092.556] WriteFile (in: hFile=0x228, lpBuffer=0x27b18e4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27b18e4*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0092.559] CloseHandle (hObject=0x228) returned 1
	[0092.560] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.560] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0092.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0092.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0092.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0092.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55
	[0092.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x56
	[0092.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0092.561] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.562] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81e07f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x81e07f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1
	[0092.562] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0092.562] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0092.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", lpFilePart=0x0) returned 0x5f
	[0092.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0092.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0092.564] GetFileType (hFile=0x228) returned 0x1
	[0092.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0092.564] GetFileType (hFile=0x228) returned 0x1
	[0092.564] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x8000
	[0092.565] ReadFile (in: hFile=0x228, lpBuffer=0x27b4160, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x27b4160*, lpNumberOfBytesRead=0x26ed44*=0x8000, lpOverlapped=0x0) returned 1
	[0092.570] CloseHandle (hObject=0x228) returned 1
	[0092.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.KEKW", lpFilePart=0x0) returned 0x64
	[0092.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0092.570] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0092.576] GetFileType (hFile=0x228) returned 0x1
	[0092.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0092.576] GetFileType (hFile=0x228) returned 0x1
	[0092.577] WriteFile (in: hFile=0x228, lpBuffer=0x27bd8cc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x27bd8cc*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0092.580] CloseHandle (hObject=0x228) returned 1
	[0092.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", lpFilePart=0x0) returned 0x5f
	[0092.588] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\index.dat")) returned 1
	[0092.592] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81e07f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x81e07f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KETAJP6D", cAlternateFileName="")) returned 1
	[0092.593] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8206950, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8206950, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1
	[0092.593] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x822cab0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x822cab0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1
	[0092.594] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x822cab0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x822cab0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0
	[0092.594] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0092.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0092.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0092.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0092.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0092.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0092.596] GetFileType (hFile=0x224) returned 0x1
	[0092.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0092.596] GetFileType (hFile=0x224) returned 0x1
	[0092.596] WriteFile (in: hFile=0x224, lpBuffer=0x27c060c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27c060c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0092.599] CloseHandle (hObject=0x224) returned 1
	[0092.599] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0092.600] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0092.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0092.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0092.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0092.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files", lpFilePart=0x0) returned 0x49
	[0092.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x4a
	[0092.600] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0092.601] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.602] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x829eed0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x829eed0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0092.602] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x829eed0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x829eed0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 0
	[0092.602] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0092.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0092.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0092.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0092.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0092.604] GetFileType (hFile=0x220) returned 0x1
	[0092.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0092.604] GetFileType (hFile=0x220) returned 0x1
	[0092.605] WriteFile (in: hFile=0x220, lpBuffer=0x27c3944*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27c3944*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0092.611] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4651470, ftCreationTime.dwHighDateTime=0x1d5dc08, ftLastAccessTime.dwLowDateTime=0xfbc1c680, ftLastAccessTime.dwHighDateTime=0x1d5e188, ftLastWriteTime.dwLowDateTime=0xfbc1c680, ftLastWriteTime.dwHighDateTime=0x1d5e188, nFileSizeHigh=0x0, nFileSizeLow=0x349d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vmhaJ8NsVsaY5fSuFZz.m4a", cAlternateFileName="VMHAJ8~1.M4A")) returned 1
	[0092.612] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa40cac60, ftCreationTime.dwHighDateTime=0x1d5d88d, ftLastAccessTime.dwLowDateTime=0xa0797cb0, ftLastAccessTime.dwHighDateTime=0x1d5dac0, ftLastWriteTime.dwLowDateTime=0xa0797cb0, ftLastWriteTime.dwHighDateTime=0x1d5dac0, nFileSizeHigh=0x0, nFileSizeLow=0x9c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VUiR.csv", cAlternateFileName="")) returned 1
	[0092.612] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5439c80, ftCreationTime.dwHighDateTime=0x1d5e416, ftLastAccessTime.dwLowDateTime=0x33289a0, ftLastAccessTime.dwHighDateTime=0x1d5dfc6, ftLastWriteTime.dwLowDateTime=0x33289a0, ftLastWriteTime.dwHighDateTime=0x1d5dfc6, nFileSizeHigh=0x0, nFileSizeLow=0xc49b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WBIJIQZL7dCwVcHp.odt", cAlternateFileName="WBIJIQ~1.ODT")) returned 1
	[0092.613] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1
	[0092.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0092.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37
	[0092.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", lpFilePart=0x0) returned 0x38
	[0092.614] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0092.615] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.616] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0092.616] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0092.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0092.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0092.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0092.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x37
	[0092.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\", lpFilePart=0x0) returned 0x38
	[0092.617] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0092.617] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.618] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xb51728d0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb51728d0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0092.618] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0092.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0092.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0092.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0092.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0092.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\wpdnse\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0092.620] GetFileType (hFile=0x220) returned 0x1
	[0092.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0092.620] GetFileType (hFile=0x220) returned 0x1
	[0092.620] WriteFile (in: hFile=0x220, lpBuffer=0x27c774c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27c774c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0092.624] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadb6ed50, ftCreationTime.dwHighDateTime=0x1d5dbc3, ftLastAccessTime.dwLowDateTime=0x6400fe0, ftLastAccessTime.dwHighDateTime=0x1d5de96, ftLastWriteTime.dwLowDateTime=0x6400fe0, ftLastWriteTime.dwHighDateTime=0x1d5de96, nFileSizeHigh=0x0, nFileSizeLow=0x88e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="XXam3.png", cAlternateFileName="")) returned 1
	[0092.624] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef030a60, ftCreationTime.dwHighDateTime=0x1d5df96, ftLastAccessTime.dwLowDateTime=0x8d15a00, ftLastAccessTime.dwHighDateTime=0x1d5e816, ftLastWriteTime.dwLowDateTime=0x8d15a00, ftLastWriteTime.dwHighDateTime=0x1d5e816, nFileSizeHigh=0x0, nFileSizeLow=0x185e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ypaxS23.mp3", cAlternateFileName="")) returned 1
	[0092.625] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef030a60, ftCreationTime.dwHighDateTime=0x1d5df96, ftLastAccessTime.dwLowDateTime=0x8d15a00, ftLastAccessTime.dwHighDateTime=0x1d5e816, ftLastWriteTime.dwLowDateTime=0x8d15a00, ftLastWriteTime.dwHighDateTime=0x1d5e816, nFileSizeHigh=0x0, nFileSizeLow=0x185e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ypaxS23.mp3", cAlternateFileName="")) returned 0
	[0092.625] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0092.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0092.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0092.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0092.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
	[0092.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31
	[0092.626] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeb237b80, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xeb237b80, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0092.626] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xeb237b80, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xeb237b80, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0092.627] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57762c00, ftCreationTime.dwHighDateTime=0x1d5dad1, ftLastAccessTime.dwLowDateTime=0x190cad70, ftLastAccessTime.dwHighDateTime=0x1d5e70d, ftLastWriteTime.dwLowDateTime=0x190cad70, ftLastWriteTime.dwHighDateTime=0x1d5e70d, nFileSizeHigh=0x0, nFileSizeLow=0xc4c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="-woNQk54G8nB.mp3", cAlternateFileName="-WONQK~1.MP3")) returned 1
	[0092.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-woNQk54G8nB.mp3", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-woNQk54G8nB.mp3", lpFilePart=0x0) returned 0x41
	[0092.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-woNQk54G8nB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-wonqk54g8nb.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.628] GetFileType (hFile=0x220) returned 0x1
	[0092.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.628] GetFileType (hFile=0x220) returned 0x1
	[0092.628] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc4c5
	[0092.629] ReadFile (in: hFile=0x220, lpBuffer=0x27c96f4, nNumberOfBytesToRead=0xc4c5, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27c96f4*, lpNumberOfBytesRead=0x26ee84*=0xc4c5, lpOverlapped=0x0) returned 1
	[0092.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-woNQk54G8nB.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-woNQk54G8nB.mp3.KEKW", lpFilePart=0x0) returned 0x46
	[0092.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-woNQk54G8nB.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-wonqk54g8nb.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.634] GetFileType (hFile=0x220) returned 0x1
	[0092.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.634] GetFileType (hFile=0x220) returned 0x1
	[0092.635] WriteFile (in: hFile=0x220, lpBuffer=0x27d72bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27d72bc*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-woNQk54G8nB.mp3", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-woNQk54G8nB.mp3", lpFilePart=0x0) returned 0x41
	[0092.638] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\-woNQk54G8nB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\-wonqk54g8nb.mp3")) returned 1
	[0092.643] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8a019e0, ftCreationTime.dwHighDateTime=0x1d5dcb5, ftLastAccessTime.dwLowDateTime=0x54d41ba0, ftLastAccessTime.dwHighDateTime=0x1d5df8c, ftLastWriteTime.dwLowDateTime=0x54d41ba0, ftLastWriteTime.dwHighDateTime=0x1d5df8c, nFileSizeHigh=0x0, nFileSizeLow=0xac6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0E7G14Wd5zXVzS.jpg", cAlternateFileName="0E7G14~1.JPG")) returned 1
	[0092.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0E7G14Wd5zXVzS.jpg", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0E7G14Wd5zXVzS.jpg", lpFilePart=0x0) returned 0x43
	[0092.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0E7G14Wd5zXVzS.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\0e7g14wd5zxvzs.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.644] GetFileType (hFile=0x220) returned 0x1
	[0092.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.644] GetFileType (hFile=0x220) returned 0x1
	[0092.644] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xac6e
	[0092.645] ReadFile (in: hFile=0x220, lpBuffer=0x27d8840, nNumberOfBytesToRead=0xac6e, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27d8840*, lpNumberOfBytesRead=0x26ee84*=0xac6e, lpOverlapped=0x0) returned 1
	[0092.648] CloseHandle (hObject=0x220) returned 1
	[0092.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0E7G14Wd5zXVzS.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0E7G14Wd5zXVzS.jpg.KEKW", lpFilePart=0x0) returned 0x48
	[0092.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0E7G14Wd5zXVzS.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\0e7g14wd5zxvzs.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.650] GetFileType (hFile=0x220) returned 0x1
	[0092.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.650] GetFileType (hFile=0x220) returned 0x1
	[0092.659] WriteFile (in: hFile=0x220, lpBuffer=0x25ea584*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x25ea584*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.662] CloseHandle (hObject=0x220) returned 1
	[0092.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0E7G14Wd5zXVzS.jpg", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0E7G14Wd5zXVzS.jpg", lpFilePart=0x0) returned 0x43
	[0092.662] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0E7G14Wd5zXVzS.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\0e7g14wd5zxvzs.jpg")) returned 1
	[0092.666] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5afddd60, ftCreationTime.dwHighDateTime=0x1d5e81d, ftLastAccessTime.dwLowDateTime=0xb0946d0, ftLastAccessTime.dwHighDateTime=0x1d5e36f, ftLastWriteTime.dwLowDateTime=0xb0946d0, ftLastWriteTime.dwHighDateTime=0x1d5e36f, nFileSizeHigh=0x0, nFileSizeLow=0x1f7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1fQvFBAb.m4a", cAlternateFileName="")) returned 1
	[0092.667] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe270dfc0, ftCreationTime.dwHighDateTime=0x1d5da73, ftLastAccessTime.dwLowDateTime=0x6c1d9c20, ftLastAccessTime.dwHighDateTime=0x1d5e54d, ftLastWriteTime.dwLowDateTime=0x6c1d9c20, ftLastWriteTime.dwHighDateTime=0x1d5e54d, nFileSizeHigh=0x0, nFileSizeLow=0x183c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="4pwLEa.wav", cAlternateFileName="")) returned 1
	[0092.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pwLEa.wav", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pwLEa.wav", lpFilePart=0x0) returned 0x3b
	[0092.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pwLEa.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4pwlea.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.668] GetFileType (hFile=0x220) returned 0x1
	[0092.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.668] GetFileType (hFile=0x220) returned 0x1
	[0092.668] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x183c1
	[0092.669] ReadFile (in: hFile=0x220, lpBuffer=0x366a878, nNumberOfBytesToRead=0x183c1, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x366a878*, lpNumberOfBytesRead=0x26ee84*=0x183c1, lpOverlapped=0x0) returned 1
	[0092.677] CloseHandle (hObject=0x220) returned 1
	[0092.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pwLEa.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pwLEa.wav.KEKW", lpFilePart=0x0) returned 0x40
	[0092.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pwLEa.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4pwlea.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.679] GetFileType (hFile=0x220) returned 0x1
	[0092.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.679] GetFileType (hFile=0x220) returned 0x1
	[0092.683] WriteFile (in: hFile=0x220, lpBuffer=0x25ed488*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x25ed488*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.687] CloseHandle (hObject=0x220) returned 1
	[0092.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pwLEa.wav", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pwLEa.wav", lpFilePart=0x0) returned 0x3b
	[0092.687] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4pwLEa.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4pwlea.wav")) returned 1
	[0092.692] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x250b5570, ftCreationTime.dwHighDateTime=0x1d5da7b, ftLastAccessTime.dwLowDateTime=0xb04f24f0, ftLastAccessTime.dwHighDateTime=0x1d5dea3, ftLastWriteTime.dwLowDateTime=0xb04f24f0, ftLastWriteTime.dwHighDateTime=0x1d5dea3, nFileSizeHigh=0x0, nFileSizeLow=0x10262, dwReserved0=0x0, dwReserved1=0x0, cFileName="4T_8FhctsVyDn5n2Vs7o.ots", cAlternateFileName="4T_8FH~1.OTS")) returned 1
	[0092.693] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd50c0be0, ftCreationTime.dwHighDateTime=0x1d5d8be, ftLastAccessTime.dwLowDateTime=0x43da51b0, ftLastAccessTime.dwHighDateTime=0x1d5e70d, ftLastWriteTime.dwLowDateTime=0x43da51b0, ftLastWriteTime.dwHighDateTime=0x1d5e70d, nFileSizeHigh=0x0, nFileSizeLow=0xa486, dwReserved0=0x0, dwReserved1=0x0, cFileName="6kYt7Oq.flv", cAlternateFileName="")) returned 1
	[0092.693] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b053080, ftCreationTime.dwHighDateTime=0x1d5dd6d, ftLastAccessTime.dwLowDateTime=0x495363a0, ftLastAccessTime.dwHighDateTime=0x1d5e3c2, ftLastWriteTime.dwLowDateTime=0x495363a0, ftLastWriteTime.dwHighDateTime=0x1d5e3c2, nFileSizeHigh=0x0, nFileSizeLow=0xaf03, dwReserved0=0x0, dwReserved1=0x0, cFileName="6o9QhWGVDttu5BYX9I.odp", cAlternateFileName="6O9QHW~1.ODP")) returned 1
	[0092.694] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8cb10730, ftCreationTime.dwHighDateTime=0x1d5df74, ftLastAccessTime.dwLowDateTime=0xa7defb30, ftLastAccessTime.dwHighDateTime=0x1d5e4f0, ftLastWriteTime.dwLowDateTime=0xa7defb30, ftLastWriteTime.dwHighDateTime=0x1d5e4f0, nFileSizeHigh=0x0, nFileSizeLow=0x5d2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7p6R.doc", cAlternateFileName="")) returned 1
	[0092.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7p6R.doc", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7p6R.doc", lpFilePart=0x0) returned 0x39
	[0092.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7p6R.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7p6r.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.694] GetFileType (hFile=0x220) returned 0x1
	[0092.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.695] GetFileType (hFile=0x220) returned 0x1
	[0092.695] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x5d2a
	[0092.695] ReadFile (in: hFile=0x220, lpBuffer=0x25ef484, nNumberOfBytesToRead=0x5d2a, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x25ef484*, lpNumberOfBytesRead=0x26ee84*=0x5d2a, lpOverlapped=0x0) returned 1
	[0092.699] CloseHandle (hObject=0x220) returned 1
	[0092.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7p6R.doc.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7p6R.doc.KEKW", lpFilePart=0x0) returned 0x3e
	[0092.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7p6R.doc.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7p6r.doc.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.701] GetFileType (hFile=0x220) returned 0x1
	[0092.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.701] GetFileType (hFile=0x220) returned 0x1
	[0092.702] WriteFile (in: hFile=0x220, lpBuffer=0x25f6880*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x25f6880*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.704] CloseHandle (hObject=0x220) returned 1
	[0092.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7p6R.doc", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7p6R.doc", lpFilePart=0x0) returned 0x39
	[0092.705] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\7p6R.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\7p6r.doc")) returned 1
	[0092.709] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa145ae0, ftCreationTime.dwHighDateTime=0x1d5e17f, ftLastAccessTime.dwLowDateTime=0xc0e56600, ftLastAccessTime.dwHighDateTime=0x1d5d92e, ftLastWriteTime.dwLowDateTime=0xc0e56600, ftLastWriteTime.dwHighDateTime=0x1d5d92e, nFileSizeHigh=0x0, nFileSizeLow=0x1509d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9b3apoDbxfF0.mp3", cAlternateFileName="9B3APO~1.MP3")) returned 1
	[0092.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9b3apoDbxfF0.mp3", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9b3apoDbxfF0.mp3", lpFilePart=0x0) returned 0x41
	[0092.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9b3apoDbxfF0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9b3apodbxff0.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.710] GetFileType (hFile=0x220) returned 0x1
	[0092.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.710] GetFileType (hFile=0x220) returned 0x1
	[0092.710] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x1509d
	[0092.711] ReadFile (in: hFile=0x220, lpBuffer=0x3682c58, nNumberOfBytesToRead=0x1509d, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x3682c58*, lpNumberOfBytesRead=0x26ee84*=0x1509d, lpOverlapped=0x0) returned 1
	[0092.718] CloseHandle (hObject=0x220) returned 1
	[0092.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9b3apoDbxfF0.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9b3apoDbxfF0.mp3.KEKW", lpFilePart=0x0) returned 0x46
	[0092.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9b3apoDbxfF0.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9b3apodbxff0.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.720] GetFileType (hFile=0x220) returned 0x1
	[0092.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.720] GetFileType (hFile=0x220) returned 0x1
	[0092.721] WriteFile (in: hFile=0x220, lpBuffer=0x25f94c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x25f94c8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.723] CloseHandle (hObject=0x220) returned 1
	[0092.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9b3apoDbxfF0.mp3", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9b3apoDbxfF0.mp3", lpFilePart=0x0) returned 0x41
	[0092.724] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9b3apoDbxfF0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9b3apodbxff0.mp3")) returned 1
	[0092.728] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7e39220, ftCreationTime.dwHighDateTime=0x1d5d824, ftLastAccessTime.dwLowDateTime=0xca6bba50, ftLastAccessTime.dwHighDateTime=0x1d5e13d, ftLastWriteTime.dwLowDateTime=0xca6bba50, ftLastWriteTime.dwHighDateTime=0x1d5e13d, nFileSizeHigh=0x0, nFileSizeLow=0x13d3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="aaFw.avi", cAlternateFileName="")) returned 1
	[0092.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aaFw.avi", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aaFw.avi", lpFilePart=0x0) returned 0x39
	[0092.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aaFw.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\aafw.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.730] GetFileType (hFile=0x220) returned 0x1
	[0092.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.730] GetFileType (hFile=0x220) returned 0x1
	[0092.730] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x13d3b
	[0092.730] ReadFile (in: hFile=0x220, lpBuffer=0x25fa984, nNumberOfBytesToRead=0x13d3b, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x25fa984*, lpNumberOfBytesRead=0x26ee84*=0x13d3b, lpOverlapped=0x0) returned 1
	[0092.734] CloseHandle (hObject=0x220) returned 1
	[0092.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aaFw.avi.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aaFw.avi.KEKW", lpFilePart=0x0) returned 0x3e
	[0092.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aaFw.avi.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\aafw.avi.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.736] GetFileType (hFile=0x220) returned 0x1
	[0092.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.736] GetFileType (hFile=0x220) returned 0x1
	[0092.737] WriteFile (in: hFile=0x220, lpBuffer=0x260fd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x260fd90*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.740] CloseHandle (hObject=0x220) returned 1
	[0092.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aaFw.avi", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aaFw.avi", lpFilePart=0x0) returned 0x39
	[0092.740] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aaFw.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\aafw.avi")) returned 1
	[0092.746] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a0318e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6a0318e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xb20126a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1
	[0092.746] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6be9bb00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x6be9bb00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x6be9bb00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bst449D.tmp", cAlternateFileName="")) returned 1
	[0092.747] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa40dc900, ftCreationTime.dwHighDateTime=0x1d5e6df, ftLastAccessTime.dwLowDateTime=0xefdcf7a0, ftLastAccessTime.dwHighDateTime=0x1d5df3e, ftLastWriteTime.dwLowDateTime=0xefdcf7a0, ftLastWriteTime.dwHighDateTime=0x1d5df3e, nFileSizeHigh=0x0, nFileSizeLow=0x154b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cGg1aWCsNJku9vTtAm66.mp4", cAlternateFileName="CGG1AW~1.MP4")) returned 1
	[0092.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cGg1aWCsNJku9vTtAm66.mp4", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cGg1aWCsNJku9vTtAm66.mp4", lpFilePart=0x0) returned 0x49
	[0092.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cGg1aWCsNJku9vTtAm66.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cgg1awcsnjku9vttam66.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.749] GetFileType (hFile=0x220) returned 0x1
	[0092.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.749] GetFileType (hFile=0x220) returned 0x1
	[0092.749] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x154b1
	[0092.750] ReadFile (in: hFile=0x220, lpBuffer=0x3697d18, nNumberOfBytesToRead=0x154b1, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x3697d18*, lpNumberOfBytesRead=0x26ee84*=0x154b1, lpOverlapped=0x0) returned 1
	[0092.757] CloseHandle (hObject=0x220) returned 1
	[0092.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cGg1aWCsNJku9vTtAm66.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cGg1aWCsNJku9vTtAm66.mp4.KEKW", lpFilePart=0x0) returned 0x4e
	[0092.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cGg1aWCsNJku9vTtAm66.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cgg1awcsnjku9vttam66.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.759] GetFileType (hFile=0x220) returned 0x1
	[0092.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.760] GetFileType (hFile=0x220) returned 0x1
	[0092.760] WriteFile (in: hFile=0x220, lpBuffer=0x2613128*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2613128*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.763] CloseHandle (hObject=0x220) returned 1
	[0092.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cGg1aWCsNJku9vTtAm66.mp4", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cGg1aWCsNJku9vTtAm66.mp4", lpFilePart=0x0) returned 0x49
	[0092.763] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cGg1aWCsNJku9vTtAm66.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cgg1awcsnjku9vttam66.mp4")) returned 1
	[0092.768] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80afcf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x80afcf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0092.769] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf184cde0, ftCreationTime.dwHighDateTime=0x1d5df83, ftLastAccessTime.dwLowDateTime=0xe9d99440, ftLastAccessTime.dwHighDateTime=0x1d5d9bb, ftLastWriteTime.dwLowDateTime=0xe9d99440, ftLastWriteTime.dwHighDateTime=0x1d5d9bb, nFileSizeHigh=0x0, nFileSizeLow=0xecc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cpqr.pptx", cAlternateFileName="CPQR~1.PPT")) returned 1
	[0092.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cpqr.pptx", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cpqr.pptx", lpFilePart=0x0) returned 0x3a
	[0092.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cpqr.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cpqr.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.770] GetFileType (hFile=0x220) returned 0x1
	[0092.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.770] GetFileType (hFile=0x220) returned 0x1
	[0092.770] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xecc7
	[0092.770] ReadFile (in: hFile=0x220, lpBuffer=0x2614760, nNumberOfBytesToRead=0xecc7, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2614760*, lpNumberOfBytesRead=0x26ee84*=0xecc7, lpOverlapped=0x0) returned 1
	[0092.774] CloseHandle (hObject=0x220) returned 1
	[0092.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cpqr.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cpqr.pptx.KEKW", lpFilePart=0x0) returned 0x3f
	[0092.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cpqr.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cpqr.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.777] GetFileType (hFile=0x220) returned 0x1
	[0092.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.778] GetFileType (hFile=0x220) returned 0x1
	[0092.778] WriteFile (in: hFile=0x220, lpBuffer=0x2624afc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2624afc*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.782] CloseHandle (hObject=0x220) returned 1
	[0092.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cpqr.pptx", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cpqr.pptx", lpFilePart=0x0) returned 0x3a
	[0092.782] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cpqr.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cpqr.pptx")) returned 1
	[0092.786] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe507f70, ftCreationTime.dwHighDateTime=0x1d5df72, ftLastAccessTime.dwLowDateTime=0x71e04810, ftLastAccessTime.dwHighDateTime=0x1d5e07f, ftLastWriteTime.dwLowDateTime=0x71e04810, ftLastWriteTime.dwHighDateTime=0x1d5e07f, nFileSizeHigh=0x0, nFileSizeLow=0x3095, dwReserved0=0x0, dwReserved1=0x0, cFileName="E7QYbicNi.swf", cAlternateFileName="E7QYBI~1.SWF")) returned 1
	[0092.787] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdb84d770, ftCreationTime.dwHighDateTime=0x1d5de6f, ftLastAccessTime.dwLowDateTime=0xca01ccc0, ftLastAccessTime.dwHighDateTime=0x1d5e652, ftLastWriteTime.dwLowDateTime=0xca01ccc0, ftLastWriteTime.dwHighDateTime=0x1d5e652, nFileSizeHigh=0x0, nFileSizeLow=0x13ce1, dwReserved0=0x0, dwReserved1=0x0, cFileName="fvrTqCbpRrDy.png", cAlternateFileName="FVRTQC~1.PNG")) returned 1
	[0092.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fvrTqCbpRrDy.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fvrTqCbpRrDy.png", lpFilePart=0x0) returned 0x41
	[0092.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.788] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fvrTqCbpRrDy.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fvrtqcbprrdy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.788] GetFileType (hFile=0x220) returned 0x1
	[0092.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.788] GetFileType (hFile=0x220) returned 0x1
	[0092.788] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x13ce1
	[0092.789] ReadFile (in: hFile=0x220, lpBuffer=0x26263e0, nNumberOfBytesToRead=0x13ce1, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26263e0*, lpNumberOfBytesRead=0x26ee84*=0x13ce1, lpOverlapped=0x0) returned 1
	[0092.793] CloseHandle (hObject=0x220) returned 1
	[0092.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fvrTqCbpRrDy.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fvrTqCbpRrDy.png.KEKW", lpFilePart=0x0) returned 0x46
	[0092.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fvrTqCbpRrDy.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fvrtqcbprrdy.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.795] GetFileType (hFile=0x220) returned 0x1
	[0092.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.795] GetFileType (hFile=0x220) returned 0x1
	[0092.796] WriteFile (in: hFile=0x220, lpBuffer=0x263b7c4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x263b7c4*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.799] CloseHandle (hObject=0x220) returned 1
	[0092.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fvrTqCbpRrDy.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fvrTqCbpRrDy.png", lpFilePart=0x0) returned 0x41
	[0092.800] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\fvrTqCbpRrDy.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fvrtqcbprrdy.png")) returned 1
	[0092.804] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1
	[0092.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x47
	[0092.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0092.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc08) returned 1
	[0092.811] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35b05900, ftCreationTime.dwHighDateTime=0x1d5dc58, ftLastAccessTime.dwLowDateTime=0xc40b6f20, ftLastAccessTime.dwHighDateTime=0x1d5e237, ftLastWriteTime.dwLowDateTime=0xc40b6f20, ftLastWriteTime.dwHighDateTime=0x1d5e237, nFileSizeHigh=0x0, nFileSizeLow=0x16d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fy7ojirPSxZB6.mp4", cAlternateFileName="FY7OJI~1.MP4")) returned 1
	[0092.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fy7ojirPSxZB6.mp4", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fy7ojirPSxZB6.mp4", lpFilePart=0x0) returned 0x42
	[0092.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fy7ojirPSxZB6.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fy7ojirpsxzb6.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.812] GetFileType (hFile=0x220) returned 0x1
	[0092.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.812] GetFileType (hFile=0x220) returned 0x1
	[0092.812] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x16d3f
	[0092.813] ReadFile (in: hFile=0x220, lpBuffer=0x36ad1e8, nNumberOfBytesToRead=0x16d3f, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x36ad1e8*, lpNumberOfBytesRead=0x26ee84*=0x16d3f, lpOverlapped=0x0) returned 1
	[0092.820] CloseHandle (hObject=0x220) returned 1
	[0092.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fy7ojirPSxZB6.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fy7ojirPSxZB6.mp4.KEKW", lpFilePart=0x0) returned 0x47
	[0092.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fy7ojirPSxZB6.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fy7ojirpsxzb6.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.821] GetFileType (hFile=0x220) returned 0x1
	[0092.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.822] GetFileType (hFile=0x220) returned 0x1
	[0092.822] WriteFile (in: hFile=0x220, lpBuffer=0x263eec4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x263eec4*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.827] CloseHandle (hObject=0x220) returned 1
	[0092.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fy7ojirPSxZB6.mp4", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fy7ojirPSxZB6.mp4", lpFilePart=0x0) returned 0x42
	[0092.828] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Fy7ojirPSxZB6.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fy7ojirpsxzb6.mp4")) returned 1
	[0092.832] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea94b5a0, ftCreationTime.dwHighDateTime=0x1d5e5ea, ftLastAccessTime.dwLowDateTime=0x6e594d70, ftLastAccessTime.dwHighDateTime=0x1d5da9b, ftLastWriteTime.dwLowDateTime=0x6e594d70, ftLastWriteTime.dwHighDateTime=0x1d5da9b, nFileSizeHigh=0x0, nFileSizeLow=0x34b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="G7xtpu-tcctiadIKAdC.wav", cAlternateFileName="G7XTPU~1.WAV")) returned 1
	[0092.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\G7xtpu-tcctiadIKAdC.wav", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\G7xtpu-tcctiadIKAdC.wav", lpFilePart=0x0) returned 0x48
	[0092.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\G7xtpu-tcctiadIKAdC.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\g7xtpu-tcctiadikadc.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.833] GetFileType (hFile=0x220) returned 0x1
	[0092.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.833] GetFileType (hFile=0x220) returned 0x1
	[0092.834] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x34b9
	[0092.834] ReadFile (in: hFile=0x220, lpBuffer=0x26404a0, nNumberOfBytesToRead=0x34b9, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26404a0*, lpNumberOfBytesRead=0x26ee84*=0x34b9, lpOverlapped=0x0) returned 1
	[0092.837] CloseHandle (hObject=0x220) returned 1
	[0092.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\G7xtpu-tcctiadIKAdC.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\G7xtpu-tcctiadIKAdC.wav.KEKW", lpFilePart=0x0) returned 0x4d
	[0092.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.837] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\G7xtpu-tcctiadIKAdC.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\g7xtpu-tcctiadikadc.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.840] GetFileType (hFile=0x220) returned 0x1
	[0092.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.840] GetFileType (hFile=0x220) returned 0x1
	[0092.841] WriteFile (in: hFile=0x220, lpBuffer=0x2645084*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2645084*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.843] CloseHandle (hObject=0x220) returned 1
	[0092.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\G7xtpu-tcctiadIKAdC.wav", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\G7xtpu-tcctiadIKAdC.wav", lpFilePart=0x0) returned 0x48
	[0092.844] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\G7xtpu-tcctiadIKAdC.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\g7xtpu-tcctiadikadc.wav")) returned 1
	[0092.847] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda945220, ftCreationTime.dwHighDateTime=0x1d5df0d, ftLastAccessTime.dwLowDateTime=0x15ac07c0, ftLastAccessTime.dwHighDateTime=0x1d5e514, ftLastWriteTime.dwLowDateTime=0x15ac07c0, ftLastWriteTime.dwHighDateTime=0x1d5e514, nFileSizeHigh=0x0, nFileSizeLow=0x11ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gfr4isOlW6S_.xls", cAlternateFileName="GFR4IS~1.XLS")) returned 1
	[0092.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Gfr4isOlW6S_.xls", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Gfr4isOlW6S_.xls", lpFilePart=0x0) returned 0x41
	[0092.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Gfr4isOlW6S_.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gfr4isolw6s_.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.848] GetFileType (hFile=0x220) returned 0x1
	[0092.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.848] GetFileType (hFile=0x220) returned 0x1
	[0092.848] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x11ab
	[0092.849] ReadFile (in: hFile=0x220, lpBuffer=0x26465f8, nNumberOfBytesToRead=0x11ab, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26465f8*, lpNumberOfBytesRead=0x26ee84*=0x11ab, lpOverlapped=0x0) returned 1
	[0092.851] CloseHandle (hObject=0x220) returned 1
	[0092.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Gfr4isOlW6S_.xls.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Gfr4isOlW6S_.xls.KEKW", lpFilePart=0x0) returned 0x46
	[0092.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Gfr4isOlW6S_.xls.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gfr4isolw6s_.xls.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.853] GetFileType (hFile=0x220) returned 0x1
	[0092.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.853] GetFileType (hFile=0x220) returned 0x1
	[0092.854] WriteFile (in: hFile=0x220, lpBuffer=0x2648ea4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2648ea4*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.857] CloseHandle (hObject=0x220) returned 1
	[0092.857] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Gfr4isOlW6S_.xls", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Gfr4isOlW6S_.xls", lpFilePart=0x0) returned 0x41
	[0092.857] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Gfr4isOlW6S_.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gfr4isolw6s_.xls")) returned 1
	[0092.860] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x816e3d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x816e3d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0092.861] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x486704b0, ftCreationTime.dwHighDateTime=0x1d5e56b, ftLastAccessTime.dwLowDateTime=0x91466550, ftLastAccessTime.dwHighDateTime=0x1d5e10a, ftLastWriteTime.dwLowDateTime=0x91466550, ftLastWriteTime.dwHighDateTime=0x1d5e10a, nFileSizeHigh=0x0, nFileSizeLow=0x39c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HwxfeDn5Bq68NPyEv.gif", cAlternateFileName="HWXFED~1.GIF")) returned 1
	[0092.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HwxfeDn5Bq68NPyEv.gif", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HwxfeDn5Bq68NPyEv.gif", lpFilePart=0x0) returned 0x46
	[0092.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HwxfeDn5Bq68NPyEv.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hwxfedn5bq68npyev.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.862] GetFileType (hFile=0x220) returned 0x1
	[0092.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.862] GetFileType (hFile=0x220) returned 0x1
	[0092.862] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x39c0
	[0092.862] ReadFile (in: hFile=0x220, lpBuffer=0x264a58c, nNumberOfBytesToRead=0x39c0, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x264a58c*, lpNumberOfBytesRead=0x26ee84*=0x39c0, lpOverlapped=0x0) returned 1
	[0092.865] CloseHandle (hObject=0x220) returned 1
	[0092.865] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HwxfeDn5Bq68NPyEv.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HwxfeDn5Bq68NPyEv.gif.KEKW", lpFilePart=0x0) returned 0x4b
	[0092.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HwxfeDn5Bq68NPyEv.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hwxfedn5bq68npyev.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.867] GetFileType (hFile=0x220) returned 0x1
	[0092.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.867] GetFileType (hFile=0x220) returned 0x1
	[0092.868] WriteFile (in: hFile=0x220, lpBuffer=0x264f668*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x264f668*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.871] CloseHandle (hObject=0x220) returned 1
	[0092.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HwxfeDn5Bq68NPyEv.gif", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HwxfeDn5Bq68NPyEv.gif", lpFilePart=0x0) returned 0x46
	[0092.872] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HwxfeDn5Bq68NPyEv.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hwxfedn5bq68npyev.gif")) returned 1
	[0092.876] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x32ed5810, ftCreationTime.dwHighDateTime=0x1d5dcbe, ftLastAccessTime.dwLowDateTime=0x6f181e90, ftLastAccessTime.dwHighDateTime=0x1d5e378, ftLastWriteTime.dwLowDateTime=0x6f181e90, ftLastWriteTime.dwHighDateTime=0x1d5e378, nFileSizeHigh=0x0, nFileSizeLow=0xdaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="hym0YsegPr3.pdf", cAlternateFileName="HYM0YS~1.PDF")) returned 1
	[0092.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hym0YsegPr3.pdf", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hym0YsegPr3.pdf", lpFilePart=0x0) returned 0x40
	[0092.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hym0YsegPr3.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hym0ysegpr3.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.877] GetFileType (hFile=0x220) returned 0x1
	[0092.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.877] GetFileType (hFile=0x220) returned 0x1
	[0092.877] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xdaa9
	[0092.877] ReadFile (in: hFile=0x220, lpBuffer=0x2650bcc, nNumberOfBytesToRead=0xdaa9, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2650bcc*, lpNumberOfBytesRead=0x26ee84*=0xdaa9, lpOverlapped=0x0) returned 1
	[0092.886] CloseHandle (hObject=0x220) returned 1
	[0092.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hym0YsegPr3.pdf.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hym0YsegPr3.pdf.KEKW", lpFilePart=0x0) returned 0x45
	[0092.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.886] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hym0YsegPr3.pdf.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hym0ysegpr3.pdf.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.888] GetFileType (hFile=0x220) returned 0x1
	[0092.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.888] GetFileType (hFile=0x220) returned 0x1
	[0092.888] WriteFile (in: hFile=0x220, lpBuffer=0x265fd70*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x265fd70*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.891] CloseHandle (hObject=0x220) returned 1
	[0092.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hym0YsegPr3.pdf", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hym0YsegPr3.pdf", lpFilePart=0x0) returned 0x40
	[0092.892] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\hym0YsegPr3.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hym0ysegpr3.pdf")) returned 1
	[0092.896] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd5e97e10, ftCreationTime.dwHighDateTime=0x1d5dbf4, ftLastAccessTime.dwLowDateTime=0x2c71ef00, ftLastAccessTime.dwHighDateTime=0x1d5e3f3, ftLastWriteTime.dwLowDateTime=0x2c71ef00, ftLastWriteTime.dwHighDateTime=0x1d5e3f3, nFileSizeHigh=0x0, nFileSizeLow=0x37f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="h_5k_decEE4iA7R.mp3", cAlternateFileName="H_5K_D~1.MP3")) returned 1
	[0092.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\h_5k_decEE4iA7R.mp3", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\h_5k_decEE4iA7R.mp3", lpFilePart=0x0) returned 0x44
	[0092.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\h_5k_decEE4iA7R.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\h_5k_decee4ia7r.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.897] GetFileType (hFile=0x220) returned 0x1
	[0092.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.897] GetFileType (hFile=0x220) returned 0x1
	[0092.898] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x37f0
	[0092.898] ReadFile (in: hFile=0x220, lpBuffer=0x2661308, nNumberOfBytesToRead=0x37f0, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2661308*, lpNumberOfBytesRead=0x26ee84*=0x37f0, lpOverlapped=0x0) returned 1
	[0092.902] CloseHandle (hObject=0x220) returned 1
	[0092.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\h_5k_decEE4iA7R.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\h_5k_decEE4iA7R.mp3.KEKW", lpFilePart=0x0) returned 0x49
	[0092.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\h_5k_decEE4iA7R.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\h_5k_decee4ia7r.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.904] GetFileType (hFile=0x220) returned 0x1
	[0092.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.904] GetFileType (hFile=0x220) returned 0x1
	[0092.904] WriteFile (in: hFile=0x220, lpBuffer=0x2666208*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2666208*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.907] CloseHandle (hObject=0x220) returned 1
	[0092.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\h_5k_decEE4iA7R.mp3", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\h_5k_decEE4iA7R.mp3", lpFilePart=0x0) returned 0x44
	[0092.907] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\h_5k_decEE4iA7R.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\h_5k_decee4ia7r.mp3")) returned 1
	[0092.911] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9d59cd0, ftCreationTime.dwHighDateTime=0x1d5e0be, ftLastAccessTime.dwLowDateTime=0x188656a0, ftLastAccessTime.dwHighDateTime=0x1d5e7e2, ftLastWriteTime.dwLowDateTime=0x188656a0, ftLastWriteTime.dwHighDateTime=0x1d5e7e2, nFileSizeHigh=0x0, nFileSizeLow=0x3a8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J8Vv7dW_.bmp", cAlternateFileName="")) returned 1
	[0092.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\J8Vv7dW_.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\J8Vv7dW_.bmp", lpFilePart=0x0) returned 0x3d
	[0092.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\J8Vv7dW_.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\j8vv7dw_.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.912] GetFileType (hFile=0x220) returned 0x1
	[0092.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.912] GetFileType (hFile=0x220) returned 0x1
	[0092.912] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x3a8c
	[0092.912] ReadFile (in: hFile=0x220, lpBuffer=0x266770c, nNumberOfBytesToRead=0x3a8c, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x266770c*, lpNumberOfBytesRead=0x26ee84*=0x3a8c, lpOverlapped=0x0) returned 1
	[0092.915] CloseHandle (hObject=0x220) returned 1
	[0092.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\J8Vv7dW_.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\J8Vv7dW_.bmp.KEKW", lpFilePart=0x0) returned 0x42
	[0092.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\J8Vv7dW_.bmp.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\j8vv7dw_.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.917] GetFileType (hFile=0x220) returned 0x1
	[0092.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.917] GetFileType (hFile=0x220) returned 0x1
	[0092.918] WriteFile (in: hFile=0x220, lpBuffer=0x266c880*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x266c880*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.922] CloseHandle (hObject=0x220) returned 1
	[0092.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\J8Vv7dW_.bmp", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\J8Vv7dW_.bmp", lpFilePart=0x0) returned 0x3d
	[0092.923] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\J8Vv7dW_.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\j8vv7dw_.bmp")) returned 1
	[0092.926] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4c89750, ftCreationTime.dwHighDateTime=0x1d5e477, ftLastAccessTime.dwLowDateTime=0x764daff0, ftLastAccessTime.dwHighDateTime=0x1d5e2d2, ftLastWriteTime.dwLowDateTime=0x764daff0, ftLastWriteTime.dwHighDateTime=0x1d5e2d2, nFileSizeHigh=0x0, nFileSizeLow=0x15f31, dwReserved0=0x0, dwReserved1=0x0, cFileName="jMZchOwb.pdf", cAlternateFileName="")) returned 1
	[0092.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jMZchOwb.pdf", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jMZchOwb.pdf", lpFilePart=0x0) returned 0x3d
	[0092.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jMZchOwb.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jmzchowb.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.927] GetFileType (hFile=0x220) returned 0x1
	[0092.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.927] GetFileType (hFile=0x220) returned 0x1
	[0092.927] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x15f31
	[0092.928] ReadFile (in: hFile=0x220, lpBuffer=0x36c3f48, nNumberOfBytesToRead=0x15f31, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x36c3f48*, lpNumberOfBytesRead=0x26ee84*=0x15f31, lpOverlapped=0x0) returned 1
	[0092.938] CloseHandle (hObject=0x220) returned 1
	[0092.938] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jMZchOwb.pdf.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jMZchOwb.pdf.KEKW", lpFilePart=0x0) returned 0x42
	[0092.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jMZchOwb.pdf.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jmzchowb.pdf.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.940] GetFileType (hFile=0x220) returned 0x1
	[0092.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.940] GetFileType (hFile=0x220) returned 0x1
	[0092.941] WriteFile (in: hFile=0x220, lpBuffer=0x266f450*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x266f450*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.944] CloseHandle (hObject=0x220) returned 1
	[0092.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jMZchOwb.pdf", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jMZchOwb.pdf", lpFilePart=0x0) returned 0x3d
	[0092.944] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jMZchOwb.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jmzchowb.pdf")) returned 1
	[0092.948] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xafed3820, ftCreationTime.dwHighDateTime=0x1d5d7fb, ftLastAccessTime.dwLowDateTime=0xa5239150, ftLastAccessTime.dwHighDateTime=0x1d5d7e2, ftLastWriteTime.dwLowDateTime=0xa5239150, ftLastWriteTime.dwHighDateTime=0x1d5d7e2, nFileSizeHigh=0x0, nFileSizeLow=0x8b51, dwReserved0=0x0, dwReserved1=0x0, cFileName="jYIRnb _.avi", cAlternateFileName="JYIRNB~1.AVI")) returned 1
	[0092.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jYIRnb _.avi", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jYIRnb _.avi", lpFilePart=0x0) returned 0x3d
	[0092.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jYIRnb _.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jyirnb _.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.949] GetFileType (hFile=0x220) returned 0x1
	[0092.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.950] GetFileType (hFile=0x220) returned 0x1
	[0092.950] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x8b51
	[0092.950] ReadFile (in: hFile=0x220, lpBuffer=0x267096c, nNumberOfBytesToRead=0x8b51, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x267096c*, lpNumberOfBytesRead=0x26ee84*=0x8b51, lpOverlapped=0x0) returned 1
	[0092.954] CloseHandle (hObject=0x220) returned 1
	[0092.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jYIRnb _.avi.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jYIRnb _.avi.KEKW", lpFilePart=0x0) returned 0x42
	[0092.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jYIRnb _.avi.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jyirnb _.avi.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.955] GetFileType (hFile=0x220) returned 0x1
	[0092.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.955] GetFileType (hFile=0x220) returned 0x1
	[0092.956] WriteFile (in: hFile=0x220, lpBuffer=0x267aba8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x267aba8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.970] CloseHandle (hObject=0x220) returned 1
	[0092.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jYIRnb _.avi", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jYIRnb _.avi", lpFilePart=0x0) returned 0x3d
	[0092.971] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jYIRnb _.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jyirnb _.avi")) returned 1
	[0092.975] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42eb07f0, ftCreationTime.dwHighDateTime=0x1d5df73, ftLastAccessTime.dwLowDateTime=0x12ed88a0, ftLastAccessTime.dwHighDateTime=0x1d5dacf, ftLastWriteTime.dwLowDateTime=0x12ed88a0, ftLastWriteTime.dwHighDateTime=0x1d5dacf, nFileSizeHigh=0x0, nFileSizeLow=0x3176, dwReserved0=0x0, dwReserved1=0x0, cFileName="K5W5aHuYJQeIDdHll.m4a", cAlternateFileName="K5W5AH~1.M4A")) returned 1
	[0092.975] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18e222a0, ftCreationTime.dwHighDateTime=0x1d5e3fa, ftLastAccessTime.dwLowDateTime=0x26428e40, ftLastAccessTime.dwHighDateTime=0x1d5e110, ftLastWriteTime.dwLowDateTime=0x26428e40, ftLastWriteTime.dwHighDateTime=0x1d5e110, nFileSizeHigh=0x0, nFileSizeLow=0xc957, dwReserved0=0x0, dwReserved1=0x0, cFileName="lWTBcFnBpv.bmp", cAlternateFileName="LWTBCF~1.BMP")) returned 1
	[0092.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lWTBcFnBpv.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lWTBcFnBpv.bmp", lpFilePart=0x0) returned 0x3f
	[0092.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lWTBcFnBpv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lwtbcfnbpv.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.976] GetFileType (hFile=0x220) returned 0x1
	[0092.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.976] GetFileType (hFile=0x220) returned 0x1
	[0092.976] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc957
	[0092.977] ReadFile (in: hFile=0x220, lpBuffer=0x267c4d0, nNumberOfBytesToRead=0xc957, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x267c4d0*, lpNumberOfBytesRead=0x26ee84*=0xc957, lpOverlapped=0x0) returned 1
	[0092.980] CloseHandle (hObject=0x220) returned 1
	[0092.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lWTBcFnBpv.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lWTBcFnBpv.bmp.KEKW", lpFilePart=0x0) returned 0x44
	[0092.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lWTBcFnBpv.bmp.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lwtbcfnbpv.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.982] GetFileType (hFile=0x220) returned 0x1
	[0092.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.982] GetFileType (hFile=0x220) returned 0x1
	[0092.983] WriteFile (in: hFile=0x220, lpBuffer=0x268a51c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x268a51c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0092.986] CloseHandle (hObject=0x220) returned 1
	[0092.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lWTBcFnBpv.bmp", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lWTBcFnBpv.bmp", lpFilePart=0x0) returned 0x3f
	[0092.986] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lWTBcFnBpv.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\lwtbcfnbpv.bmp")) returned 1
	[0092.991] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41795930, ftCreationTime.dwHighDateTime=0x1d5e7bb, ftLastAccessTime.dwLowDateTime=0xbf7f9740, ftLastAccessTime.dwHighDateTime=0x1d5db59, ftLastWriteTime.dwLowDateTime=0xbf7f9740, ftLastWriteTime.dwHighDateTime=0x1d5db59, nFileSizeHigh=0x0, nFileSizeLow=0xb18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="O CxWx.mp4", cAlternateFileName="OCXWX~1.MP4")) returned 1
	[0092.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O CxWx.mp4", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O CxWx.mp4", lpFilePart=0x0) returned 0x3b
	[0092.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0092.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O CxWx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o cxwx.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.992] GetFileType (hFile=0x220) returned 0x1
	[0092.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0092.992] GetFileType (hFile=0x220) returned 0x1
	[0092.992] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xb18a
	[0092.992] ReadFile (in: hFile=0x220, lpBuffer=0x268ba18, nNumberOfBytesToRead=0xb18a, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x268ba18*, lpNumberOfBytesRead=0x26ee84*=0xb18a, lpOverlapped=0x0) returned 1
	[0092.996] CloseHandle (hObject=0x220) returned 1
	[0092.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O CxWx.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O CxWx.mp4.KEKW", lpFilePart=0x0) returned 0x40
	[0092.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0092.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O CxWx.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o cxwx.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0092.998] GetFileType (hFile=0x220) returned 0x1
	[0092.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0092.998] GetFileType (hFile=0x220) returned 0x1
	[0092.998] WriteFile (in: hFile=0x220, lpBuffer=0x2698280*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2698280*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0093.002] CloseHandle (hObject=0x220) returned 1
	[0093.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O CxWx.mp4", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O CxWx.mp4", lpFilePart=0x0) returned 0x3b
	[0093.002] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O CxWx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o cxwx.mp4")) returned 1
	[0093.006] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda6a3cf0, ftCreationTime.dwHighDateTime=0x1d5e2d3, ftLastAccessTime.dwLowDateTime=0x3a35d790, ftLastAccessTime.dwHighDateTime=0x1d5e12e, ftLastWriteTime.dwLowDateTime=0x3a35d790, ftLastWriteTime.dwHighDateTime=0x1d5e12e, nFileSizeHigh=0x0, nFileSizeLow=0x1aa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="od2HJ.jpg", cAlternateFileName="")) returned 1
	[0093.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\od2HJ.jpg", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\od2HJ.jpg", lpFilePart=0x0) returned 0x3a
	[0093.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0093.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\od2HJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\od2hj.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.007] GetFileType (hFile=0x220) returned 0x1
	[0093.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0093.008] GetFileType (hFile=0x220) returned 0x1
	[0093.008] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x1aa5
	[0093.008] ReadFile (in: hFile=0x220, lpBuffer=0x2699744, nNumberOfBytesToRead=0x1aa5, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2699744*, lpNumberOfBytesRead=0x26ee84*=0x1aa5, lpOverlapped=0x0) returned 1
	[0093.011] CloseHandle (hObject=0x220) returned 1
	[0093.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\od2HJ.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\od2HJ.jpg.KEKW", lpFilePart=0x0) returned 0x3f
	[0093.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0093.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\od2HJ.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\od2hj.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.017] GetFileType (hFile=0x220) returned 0x1
	[0093.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0093.017] GetFileType (hFile=0x220) returned 0x1
	[0093.018] WriteFile (in: hFile=0x220, lpBuffer=0x269c8c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x269c8c0*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0093.022] CloseHandle (hObject=0x220) returned 1
	[0093.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\od2HJ.jpg", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\od2HJ.jpg", lpFilePart=0x0) returned 0x3a
	[0093.022] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\od2HJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\od2hj.jpg")) returned 1
	[0093.025] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa09fd840, ftCreationTime.dwHighDateTime=0x1d5e085, ftLastAccessTime.dwLowDateTime=0x41d66b60, ftLastAccessTime.dwHighDateTime=0x1d5dad8, ftLastWriteTime.dwLowDateTime=0x41d66b60, ftLastWriteTime.dwHighDateTime=0x1d5dad8, nFileSizeHigh=0x0, nFileSizeLow=0x1346d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIhn.mp4", cAlternateFileName="")) returned 1
	[0093.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\OIhn.mp4", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\OIhn.mp4", lpFilePart=0x0) returned 0x39
	[0093.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0093.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\OIhn.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oihn.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.027] GetFileType (hFile=0x220) returned 0x1
	[0093.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0093.027] GetFileType (hFile=0x220) returned 0x1
	[0093.027] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x1346d
	[0093.027] ReadFile (in: hFile=0x220, lpBuffer=0x269dd70, nNumberOfBytesToRead=0x1346d, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x269dd70*, lpNumberOfBytesRead=0x26ee84*=0x1346d, lpOverlapped=0x0) returned 1
	[0093.031] CloseHandle (hObject=0x220) returned 1
	[0093.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\OIhn.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\OIhn.mp4.KEKW", lpFilePart=0x0) returned 0x3e
	[0093.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0093.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\OIhn.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oihn.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.033] GetFileType (hFile=0x220) returned 0x1
	[0093.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0093.034] GetFileType (hFile=0x220) returned 0x1
	[0093.034] WriteFile (in: hFile=0x220, lpBuffer=0x26b28b0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26b28b0*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0093.037] CloseHandle (hObject=0x220) returned 1
	[0093.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\OIhn.mp4", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\OIhn.mp4", lpFilePart=0x0) returned 0x39
	[0093.038] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\OIhn.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oihn.mp4")) returned 1
	[0093.043] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6904ff90, ftCreationTime.dwHighDateTime=0x1d5e54f, ftLastAccessTime.dwLowDateTime=0x570e01f0, ftLastAccessTime.dwHighDateTime=0x1d5e3b1, ftLastWriteTime.dwLowDateTime=0x570e01f0, ftLastWriteTime.dwHighDateTime=0x1d5e3b1, nFileSizeHigh=0x0, nFileSizeLow=0x8b8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rRoOEbsQAZ-SwPiF.mp3", cAlternateFileName="RROOEB~1.MP3")) returned 1
	[0093.043] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rRoOEbsQAZ-SwPiF.mp3", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rRoOEbsQAZ-SwPiF.mp3", lpFilePart=0x0) returned 0x45
	[0093.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0093.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rRoOEbsQAZ-SwPiF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rrooebsqaz-swpif.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.044] GetFileType (hFile=0x220) returned 0x1
	[0093.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0093.044] GetFileType (hFile=0x220) returned 0x1
	[0093.044] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x8b8f
	[0093.044] ReadFile (in: hFile=0x220, lpBuffer=0x26b3e44, nNumberOfBytesToRead=0x8b8f, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26b3e44*, lpNumberOfBytesRead=0x26ee84*=0x8b8f, lpOverlapped=0x0) returned 1
	[0093.048] CloseHandle (hObject=0x220) returned 1
	[0093.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rRoOEbsQAZ-SwPiF.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rRoOEbsQAZ-SwPiF.mp3.KEKW", lpFilePart=0x0) returned 0x4a
	[0093.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0093.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rRoOEbsQAZ-SwPiF.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rrooebsqaz-swpif.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.049] GetFileType (hFile=0x220) returned 0x1
	[0093.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0093.050] GetFileType (hFile=0x220) returned 0x1
	[0093.050] WriteFile (in: hFile=0x220, lpBuffer=0x26be0ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26be0ec*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0093.054] CloseHandle (hObject=0x220) returned 1
	[0093.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rRoOEbsQAZ-SwPiF.mp3", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rRoOEbsQAZ-SwPiF.mp3", lpFilePart=0x0) returned 0x45
	[0093.054] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\rRoOEbsQAZ-SwPiF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rrooebsqaz-swpif.mp3")) returned 1
	[0093.059] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x67bc24f0, ftCreationTime.dwHighDateTime=0x1d5dd85, ftLastAccessTime.dwLowDateTime=0x99558100, ftLastAccessTime.dwHighDateTime=0x1d5dc36, ftLastWriteTime.dwLowDateTime=0x99558100, ftLastWriteTime.dwHighDateTime=0x1d5dc36, nFileSizeHigh=0x0, nFileSizeLow=0x1665, dwReserved0=0x0, dwReserved1=0x0, cFileName="ruNROWAu.pdf", cAlternateFileName="")) returned 1
	[0093.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ruNROWAu.pdf", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ruNROWAu.pdf", lpFilePart=0x0) returned 0x3d
	[0093.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0093.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ruNROWAu.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\runrowau.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.060] GetFileType (hFile=0x220) returned 0x1
	[0093.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0093.060] GetFileType (hFile=0x220) returned 0x1
	[0093.060] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x1665
	[0093.061] ReadFile (in: hFile=0x220, lpBuffer=0x26bf5f0, nNumberOfBytesToRead=0x1665, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26bf5f0*, lpNumberOfBytesRead=0x26ee84*=0x1665, lpOverlapped=0x0) returned 1
	[0093.063] CloseHandle (hObject=0x220) returned 1
	[0093.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ruNROWAu.pdf.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ruNROWAu.pdf.KEKW", lpFilePart=0x0) returned 0x42
	[0093.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0093.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ruNROWAu.pdf.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\runrowau.pdf.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.065] GetFileType (hFile=0x220) returned 0x1
	[0093.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0093.065] GetFileType (hFile=0x220) returned 0x1
	[0093.066] WriteFile (in: hFile=0x220, lpBuffer=0x26c2340*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26c2340*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0093.068] CloseHandle (hObject=0x220) returned 1
	[0093.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ruNROWAu.pdf", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ruNROWAu.pdf", lpFilePart=0x0) returned 0x3d
	[0093.069] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ruNROWAu.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\runrowau.pdf")) returned 1
	[0093.072] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x617a0c90, ftCreationTime.dwHighDateTime=0x1d5e0a2, ftLastAccessTime.dwLowDateTime=0xc53c4410, ftLastAccessTime.dwHighDateTime=0x1d5e452, ftLastWriteTime.dwLowDateTime=0xc53c4410, ftLastWriteTime.dwHighDateTime=0x1d5e452, nFileSizeHigh=0x0, nFileSizeLow=0x116e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="S 3Gr3 pcheo.png", cAlternateFileName="S3GR3P~1.PNG")) returned 1
	[0093.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S 3Gr3 pcheo.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S 3Gr3 pcheo.png", lpFilePart=0x0) returned 0x41
	[0093.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0093.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S 3Gr3 pcheo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\s 3gr3 pcheo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.073] GetFileType (hFile=0x220) returned 0x1
	[0093.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0093.074] GetFileType (hFile=0x220) returned 0x1
	[0093.074] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x116e3
	[0093.074] ReadFile (in: hFile=0x220, lpBuffer=0x26c389c, nNumberOfBytesToRead=0x116e3, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26c389c*, lpNumberOfBytesRead=0x26ee84*=0x116e3, lpOverlapped=0x0) returned 1
	[0093.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S 3Gr3 pcheo.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S 3Gr3 pcheo.png.KEKW", lpFilePart=0x0) returned 0x46
	[0093.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0093.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S 3Gr3 pcheo.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\s 3gr3 pcheo.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.081] GetFileType (hFile=0x220) returned 0x1
	[0093.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0093.082] GetFileType (hFile=0x220) returned 0x1
	[0093.082] WriteFile (in: hFile=0x220, lpBuffer=0x26d6680*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26d6680*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0093.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S 3Gr3 pcheo.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S 3Gr3 pcheo.png", lpFilePart=0x0) returned 0x41
	[0093.086] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S 3Gr3 pcheo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\s 3gr3 pcheo.png")) returned 1
	[0093.091] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a16a450, ftCreationTime.dwHighDateTime=0x1d5e814, ftLastAccessTime.dwLowDateTime=0x62a956f0, ftLastAccessTime.dwHighDateTime=0x1d5e496, ftLastWriteTime.dwLowDateTime=0x62a956f0, ftLastWriteTime.dwHighDateTime=0x1d5e496, nFileSizeHigh=0x0, nFileSizeLow=0x1543c, dwReserved0=0x0, dwReserved1=0x0, cFileName="snerTA_937NJl-_cV.wav", cAlternateFileName="SNERTA~1.WAV")) returned 1
	[0093.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\snerTA_937NJl-_cV.wav", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\snerTA_937NJl-_cV.wav", lpFilePart=0x0) returned 0x46
	[0093.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0093.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\snerTA_937NJl-_cV.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\snerta_937njl-_cv.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.092] GetFileType (hFile=0x220) returned 0x1
	[0093.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0093.092] GetFileType (hFile=0x220) returned 0x1
	[0093.092] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x1543c
	[0093.093] ReadFile (in: hFile=0x220, lpBuffer=0x36d9e98, nNumberOfBytesToRead=0x1543c, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x36d9e98*, lpNumberOfBytesRead=0x26ee84*=0x1543c, lpOverlapped=0x0) returned 1
	[0093.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\snerTA_937NJl-_cV.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\snerTA_937NJl-_cV.wav.KEKW", lpFilePart=0x0) returned 0x4b
	[0093.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0093.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\snerTA_937NJl-_cV.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\snerta_937njl-_cv.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.101] GetFileType (hFile=0x220) returned 0x1
	[0093.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0093.101] GetFileType (hFile=0x220) returned 0x1
	[0093.102] WriteFile (in: hFile=0x220, lpBuffer=0x26d9348*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26d9348*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0093.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\snerTA_937NJl-_cV.wav", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\snerTA_937NJl-_cV.wav", lpFilePart=0x0) returned 0x46
	[0093.106] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\snerTA_937NJl-_cV.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\snerta_937njl-_cv.wav")) returned 1
	[0093.111] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x137b49a0, ftCreationTime.dwHighDateTime=0x1d5e7c8, ftLastAccessTime.dwLowDateTime=0x5241c900, ftLastAccessTime.dwHighDateTime=0x1d5e2a2, ftLastWriteTime.dwLowDateTime=0x5241c900, ftLastWriteTime.dwHighDateTime=0x1d5e2a2, nFileSizeHigh=0x0, nFileSizeLow=0x4b39, dwReserved0=0x0, dwReserved1=0x0, cFileName="SWRI.jpg", cAlternateFileName="")) returned 1
	[0093.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SWRI.jpg", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SWRI.jpg", lpFilePart=0x0) returned 0x39
	[0093.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0093.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SWRI.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\swri.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.112] GetFileType (hFile=0x220) returned 0x1
	[0093.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0093.112] GetFileType (hFile=0x220) returned 0x1
	[0093.112] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x4b39
	[0093.112] ReadFile (in: hFile=0x220, lpBuffer=0x26da810, nNumberOfBytesToRead=0x4b39, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26da810*, lpNumberOfBytesRead=0x26ee84*=0x4b39, lpOverlapped=0x0) returned 1
	[0093.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SWRI.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SWRI.jpg.KEKW", lpFilePart=0x0) returned 0x3e
	[0093.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0093.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SWRI.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\swri.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.117] GetFileType (hFile=0x220) returned 0x1
	[0093.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0093.117] GetFileType (hFile=0x220) returned 0x1
	[0093.117] WriteFile (in: hFile=0x220, lpBuffer=0x26e0a1c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26e0a1c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0093.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SWRI.jpg", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SWRI.jpg", lpFilePart=0x0) returned 0x39
	[0093.121] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\SWRI.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\swri.jpg")) returned 1
	[0093.124] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x829eed0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x829eed0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0093.124] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4651470, ftCreationTime.dwHighDateTime=0x1d5dc08, ftLastAccessTime.dwLowDateTime=0xfbc1c680, ftLastAccessTime.dwHighDateTime=0x1d5e188, ftLastWriteTime.dwLowDateTime=0xfbc1c680, ftLastWriteTime.dwHighDateTime=0x1d5e188, nFileSizeHigh=0x0, nFileSizeLow=0x349d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vmhaJ8NsVsaY5fSuFZz.m4a", cAlternateFileName="VMHAJ8~1.M4A")) returned 1
	[0093.125] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa40cac60, ftCreationTime.dwHighDateTime=0x1d5d88d, ftLastAccessTime.dwLowDateTime=0xa0797cb0, ftLastAccessTime.dwHighDateTime=0x1d5dac0, ftLastWriteTime.dwLowDateTime=0xa0797cb0, ftLastWriteTime.dwHighDateTime=0x1d5dac0, nFileSizeHigh=0x0, nFileSizeLow=0x9c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VUiR.csv", cAlternateFileName="")) returned 1
	[0093.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VUiR.csv", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VUiR.csv", lpFilePart=0x0) returned 0x39
	[0093.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0093.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VUiR.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vuir.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.126] GetFileType (hFile=0x220) returned 0x1
	[0093.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0093.126] GetFileType (hFile=0x220) returned 0x1
	[0093.126] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x9c1d
	[0093.126] ReadFile (in: hFile=0x220, lpBuffer=0x26e2480, nNumberOfBytesToRead=0x9c1d, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26e2480*, lpNumberOfBytesRead=0x26ee84*=0x9c1d, lpOverlapped=0x0) returned 1
	[0093.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VUiR.csv.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VUiR.csv.KEKW", lpFilePart=0x0) returned 0x3e
	[0093.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0093.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VUiR.csv.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vuir.csv.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.131] GetFileType (hFile=0x220) returned 0x1
	[0093.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0093.131] GetFileType (hFile=0x220) returned 0x1
	[0093.131] WriteFile (in: hFile=0x220, lpBuffer=0x26ed770*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26ed770*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0093.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VUiR.csv", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VUiR.csv", lpFilePart=0x0) returned 0x39
	[0093.134] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VUiR.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vuir.csv")) returned 1
	[0093.138] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5439c80, ftCreationTime.dwHighDateTime=0x1d5e416, ftLastAccessTime.dwLowDateTime=0x33289a0, ftLastAccessTime.dwHighDateTime=0x1d5dfc6, ftLastWriteTime.dwLowDateTime=0x33289a0, ftLastWriteTime.dwHighDateTime=0x1d5dfc6, nFileSizeHigh=0x0, nFileSizeLow=0xc49b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WBIJIQZL7dCwVcHp.odt", cAlternateFileName="WBIJIQ~1.ODT")) returned 1
	[0093.139] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb51728d0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x82c5030, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x82c5030, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1
	[0093.139] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadb6ed50, ftCreationTime.dwHighDateTime=0x1d5dbc3, ftLastAccessTime.dwLowDateTime=0x6400fe0, ftLastAccessTime.dwHighDateTime=0x1d5de96, ftLastWriteTime.dwLowDateTime=0x6400fe0, ftLastWriteTime.dwHighDateTime=0x1d5de96, nFileSizeHigh=0x0, nFileSizeLow=0x88e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="XXam3.png", cAlternateFileName="")) returned 1
	[0093.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XXam3.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XXam3.png", lpFilePart=0x0) returned 0x3a
	[0093.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0093.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XXam3.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xxam3.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.140] GetFileType (hFile=0x220) returned 0x1
	[0093.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0093.140] GetFileType (hFile=0x220) returned 0x1
	[0093.140] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x88e2
	[0093.140] ReadFile (in: hFile=0x220, lpBuffer=0x26ef134, nNumberOfBytesToRead=0x88e2, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26ef134*, lpNumberOfBytesRead=0x26ee84*=0x88e2, lpOverlapped=0x0) returned 1
	[0093.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XXam3.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XXam3.png.KEKW", lpFilePart=0x0) returned 0x3f
	[0093.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0093.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XXam3.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xxam3.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.145] GetFileType (hFile=0x220) returned 0x1
	[0093.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0093.145] GetFileType (hFile=0x220) returned 0x1
	[0093.146] WriteFile (in: hFile=0x220, lpBuffer=0x26f90ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26f90ec*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0093.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XXam3.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XXam3.png", lpFilePart=0x0) returned 0x3a
	[0093.150] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\XXam3.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xxam3.png")) returned 1
	[0093.155] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef030a60, ftCreationTime.dwHighDateTime=0x1d5df96, ftLastAccessTime.dwLowDateTime=0x8d15a00, ftLastAccessTime.dwHighDateTime=0x1d5e816, ftLastWriteTime.dwLowDateTime=0x8d15a00, ftLastWriteTime.dwHighDateTime=0x1d5e816, nFileSizeHigh=0x0, nFileSizeLow=0x185e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ypaxS23.mp3", cAlternateFileName="")) returned 1
	[0093.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ypaxS23.mp3", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ypaxS23.mp3", lpFilePart=0x0) returned 0x3c
	[0093.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0093.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ypaxS23.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ypaxs23.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.155] GetFileType (hFile=0x220) returned 0x1
	[0093.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0093.156] GetFileType (hFile=0x220) returned 0x1
	[0093.156] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x185e3
	[0093.157] ReadFile (in: hFile=0x220, lpBuffer=0x36ef2f0, nNumberOfBytesToRead=0x185e3, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x36ef2f0*, lpNumberOfBytesRead=0x26ee84*=0x185e3, lpOverlapped=0x0) returned 1
	[0093.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ypaxS23.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ypaxS23.mp3.KEKW", lpFilePart=0x0) returned 0x41
	[0093.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0093.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ypaxS23.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ypaxs23.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0093.166] GetFileType (hFile=0x220) returned 0x1
	[0093.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0093.166] GetFileType (hFile=0x220) returned 0x1
	[0093.167] WriteFile (in: hFile=0x220, lpBuffer=0x26fbca4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26fbca4*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0093.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ypaxS23.mp3", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ypaxS23.mp3", lpFilePart=0x0) returned 0x3c
	[0093.170] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\ypaxS23.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ypaxs23.mp3")) returned 1
	[0093.175] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0093.175] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0093.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0093.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0093.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0093.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0093.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0093.177] GetFileType (hFile=0x208) returned 0x1
	[0093.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0093.177] GetFileType (hFile=0x208) returned 0x1
	[0093.177] WriteFile (in: hFile=0x208, lpBuffer=0x26fe38c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26fe38c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0093.181] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0093.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0093.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x44
	[0093.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x45
	[0093.181] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0093.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eee0) returned 1
	[0093.188] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1
	[0093.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0093.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x38
	[0093.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", lpFilePart=0x0) returned 0x39
	[0093.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0093.190] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.191] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.191] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0093.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0093.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0093.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0093.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x38
	[0093.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", lpFilePart=0x0) returned 0x39
	[0093.192] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0093.193] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.194] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.194] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0093.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0093.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0093.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0093.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0093.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\virtualstore\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0093.196] GetFileType (hFile=0x208) returned 0x1
	[0093.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0093.196] GetFileType (hFile=0x208) returned 0x1
	[0093.196] WriteFile (in: hFile=0x208, lpBuffer=0x27029fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27029fc*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0093.200] CloseHandle (hObject=0x208) returned 1
	[0093.200] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0093.200] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0093.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0093.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0093.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0093.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b
	[0093.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c
	[0093.201] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0093.202] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.203] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf7d39ef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7d39ef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0093.203] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0093.204] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7f290d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7f290d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1
	[0093.204] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf7f290d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7f290d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0093.205] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1
	[0093.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT", lpFilePart=0x0) returned 0x3f
	[0093.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0093.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0093.207] GetFileType (hFile=0x208) returned 0x1
	[0093.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0093.207] GetFileType (hFile=0x208) returned 0x1
	[0093.207] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x1a918
	[0093.209] ReadFile (in: hFile=0x208, lpBuffer=0x37078f0, nNumberOfBytesToRead=0x1a918, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x37078f0*, lpNumberOfBytesRead=0x26ef24*=0x1a918, lpOverlapped=0x0) returned 1
	[0093.219] CloseHandle (hObject=0x208) returned 1
	[0093.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.KEKW", lpFilePart=0x0) returned 0x44
	[0093.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0093.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0093.221] GetFileType (hFile=0x208) returned 0x1
	[0093.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0093.221] GetFileType (hFile=0x208) returned 0x1
	[0093.222] WriteFile (in: hFile=0x208, lpBuffer=0x2706230*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2706230*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0093.224] CloseHandle (hObject=0x208) returned 1
	[0093.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT", lpFilePart=0x0) returned 0x3f
	[0093.225] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat")) returned 1
	[0093.230] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xffaa4610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xffaa4610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1
	[0093.231] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0093.231] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8de8eaa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x126da7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0093.232] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x785aff0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x785aff0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0093.232] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0x7881150, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x7881150, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0093.233] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x803d8d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x803d8d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0093.233] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x88201b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x88201b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0093.234] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0093.234] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8846310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8846310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1
	[0093.235] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8846310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8846310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0
	[0093.235] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0093.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0093.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0093.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0093.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0093.237] GetFileType (hFile=0x204) returned 0x1
	[0093.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0093.238] GetFileType (hFile=0x204) returned 0x1
	[0093.238] WriteFile (in: hFile=0x204, lpBuffer=0x2709698*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2709698*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0093.241] CloseHandle (hObject=0x204) returned 1
	[0093.241] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1
	[0093.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0093.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow", lpFilePart=0x0) returned 0x2e
	[0093.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x2f
	[0093.242] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0093.243] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.244] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0093.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0093.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe", lpFilePart=0x0) returned 0x34
	[0093.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", lpFilePart=0x0) returned 0x35
	[0093.245] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0093.247] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.248] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0093.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3c
	[0093.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3d
	[0093.249] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.250] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.250] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0093.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0093.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x41
	[0093.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x42
	[0093.251] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0093.256] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.256] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1
	[0093.257] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1
	[0093.258] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1
	[0093.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", lpFilePart=0x0) returned 0x48
	[0093.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", lpFilePart=0x0) returned 0x49
	[0093.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0093.261] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.261] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.262] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0093.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0093.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0093.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", lpFilePart=0x0) returned 0x48
	[0093.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", lpFilePart=0x0) returned 0x49
	[0093.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0093.263] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.264] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.264] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0093.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0093.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0093.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0093.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0093.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\search\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0093.266] GetFileType (hFile=0x228) returned 0x1
	[0093.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0093.266] GetFileType (hFile=0x228) returned 0x1
	[0093.266] WriteFile (in: hFile=0x228, lpBuffer=0x2710030*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2710030*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0093.269] CloseHandle (hObject=0x228) returned 1
	[0093.270] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0093.270] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0093.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0093.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0093.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0093.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x41
	[0093.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x42
	[0093.271] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0093.272] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.272] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1
	[0093.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFilePart=0x0) returned 0x50
	[0093.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0093.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0093.275] GetFileType (hFile=0x228) returned 0x1
	[0093.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0093.275] GetFileType (hFile=0x228) returned 0x1
	[0093.276] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5ff
	[0093.276] ReadFile (in: hFile=0x228, lpBuffer=0x2711fa4, nNumberOfBytesToRead=0xa5ff, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2711fa4*, lpNumberOfBytesRead=0x26ed44*=0xa5ff, lpOverlapped=0x0) returned 1
	[0093.281] CloseHandle (hObject=0x228) returned 1
	[0093.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.KEKW", lpFilePart=0x0) returned 0x55
	[0093.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0093.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0093.282] GetFileType (hFile=0x228) returned 0x1
	[0093.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0093.283] GetFileType (hFile=0x228) returned 0x1
	[0093.283] WriteFile (in: hFile=0x228, lpBuffer=0x271dcd8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x271dcd8*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0093.289] CloseHandle (hObject=0x228) returned 1
	[0093.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFilePart=0x0) returned 0x50
	[0093.289] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip")) returned 1
	[0093.293] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1
	[0093.294] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x89049f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x89049f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1
	[0093.294] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x89049f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x89049f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 0
	[0093.295] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0093.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0093.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0093.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0093.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0093.296] GetFileType (hFile=0x224) returned 0x1
	[0093.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0093.297] GetFileType (hFile=0x224) returned 0x1
	[0093.297] WriteFile (in: hFile=0x224, lpBuffer=0x2720a0c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2720a0c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0093.300] CloseHandle (hObject=0x224) returned 1
	[0093.301] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0093.301] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3c
	[0093.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3d
	[0093.302] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.302] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.303] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8950cb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8950cb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0093.304] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8950cb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8950cb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0
	[0093.304] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0093.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0093.306] GetFileType (hFile=0x220) returned 0x1
	[0093.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0093.306] GetFileType (hFile=0x220) returned 0x1
	[0093.307] WriteFile (in: hFile=0x220, lpBuffer=0x2723b64*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2723b64*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.309] CloseHandle (hObject=0x220) returned 1
	[0093.310] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1
	[0093.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x40
	[0093.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x41
	[0093.311] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.312] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.312] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1
	[0093.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0093.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4d
	[0093.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4e
	[0093.313] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0093.316] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.316] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1
	[0093.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", lpFilePart=0x0) returned 0x65
	[0093.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpFilePart=0x0) returned 0x66
	[0093.317] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0093.322] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.323] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1
	[0093.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", lpFilePart=0x0) returned 0x69
	[0093.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", lpFilePart=0x0) returned 0x6a
	[0093.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.325] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.325] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.326] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", lpFilePart=0x0) returned 0x69
	[0093.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", lpFilePart=0x0) returned 0x6a
	[0093.327] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.327] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.328] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.328] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\all\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.330] GetFileType (hFile=0x22c) returned 0x1
	[0093.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.330] GetFileType (hFile=0x22c) returned 0x1
	[0093.331] WriteFile (in: hFile=0x22c, lpBuffer=0x272a834*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x272a834*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.334] CloseHandle (hObject=0x22c) returned 1
	[0093.334] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brt", cAlternateFileName="")) returned 1
	[0093.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", lpFilePart=0x0) returned 0x69
	[0093.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", lpFilePart=0x0) returned 0x6a
	[0093.335] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.340] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.340] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.341] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", lpFilePart=0x0) returned 0x69
	[0093.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", lpFilePart=0x0) returned 0x6a
	[0093.342] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.342] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.343] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.343] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.344] GetFileType (hFile=0x22c) returned 0x1
	[0093.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.345] GetFileType (hFile=0x22c) returned 0x1
	[0093.345] WriteFile (in: hFile=0x22c, lpBuffer=0x272ed5c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x272ed5c*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.348] CloseHandle (hObject=0x22c) returned 1
	[0093.348] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brz", cAlternateFileName="")) returned 1
	[0093.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", lpFilePart=0x0) returned 0x69
	[0093.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", lpFilePart=0x0) returned 0x6a
	[0093.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.352] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.352] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.353] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", lpFilePart=0x0) returned 0x69
	[0093.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", lpFilePart=0x0) returned 0x6a
	[0093.354] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.354] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.355] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.355] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brz\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.357] GetFileType (hFile=0x22c) returned 0x1
	[0093.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.357] GetFileType (hFile=0x22c) returned 0x1
	[0093.357] WriteFile (in: hFile=0x22c, lpBuffer=0x2733284*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2733284*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.363] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dan", cAlternateFileName="")) returned 1
	[0093.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", lpFilePart=0x0) returned 0x69
	[0093.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", lpFilePart=0x0) returned 0x6a
	[0093.364] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.365] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.365] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.366] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", lpFilePart=0x0) returned 0x69
	[0093.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", lpFilePart=0x0) returned 0x6a
	[0093.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.367] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.368] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.368] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dan\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.369] GetFileType (hFile=0x22c) returned 0x1
	[0093.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.369] GetFileType (hFile=0x22c) returned 0x1
	[0093.370] WriteFile (in: hFile=0x22c, lpBuffer=0x27377ac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x27377ac*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.373] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dut", cAlternateFileName="")) returned 1
	[0093.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", lpFilePart=0x0) returned 0x69
	[0093.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", lpFilePart=0x0) returned 0x6a
	[0093.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.374] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.375] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.375] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", lpFilePart=0x0) returned 0x69
	[0093.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", lpFilePart=0x0) returned 0x6a
	[0093.376] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.377] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.377] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.377] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dut\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.379] GetFileType (hFile=0x22c) returned 0x1
	[0093.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.379] GetFileType (hFile=0x22c) returned 0x1
	[0093.379] WriteFile (in: hFile=0x22c, lpBuffer=0x273bcd4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x273bcd4*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.382] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eng", cAlternateFileName="")) returned 1
	[0093.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", lpFilePart=0x0) returned 0x69
	[0093.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", lpFilePart=0x0) returned 0x6a
	[0093.383] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.384] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.384] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.385] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", lpFilePart=0x0) returned 0x69
	[0093.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", lpFilePart=0x0) returned 0x6a
	[0093.386] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.387] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.387] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.387] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\eng\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.389] GetFileType (hFile=0x22c) returned 0x1
	[0093.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.389] GetFileType (hFile=0x22c) returned 0x1
	[0093.389] WriteFile (in: hFile=0x22c, lpBuffer=0x27401fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x27401fc*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.393] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="frn", cAlternateFileName="")) returned 1
	[0093.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", lpFilePart=0x0) returned 0x69
	[0093.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", lpFilePart=0x0) returned 0x6a
	[0093.394] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.395] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.395] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.396] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", lpFilePart=0x0) returned 0x69
	[0093.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", lpFilePart=0x0) returned 0x6a
	[0093.396] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.397] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.397] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.398] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\frn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.399] GetFileType (hFile=0x22c) returned 0x1
	[0093.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.399] GetFileType (hFile=0x22c) returned 0x1
	[0093.399] WriteFile (in: hFile=0x22c, lpBuffer=0x2744724*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2744724*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.403] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="grm", cAlternateFileName="")) returned 1
	[0093.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", lpFilePart=0x0) returned 0x69
	[0093.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", lpFilePart=0x0) returned 0x6a
	[0093.404] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.404] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.405] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.405] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", lpFilePart=0x0) returned 0x69
	[0093.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", lpFilePart=0x0) returned 0x6a
	[0093.406] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.407] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.407] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.407] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\grm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.409] GetFileType (hFile=0x22c) returned 0x1
	[0093.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.409] GetFileType (hFile=0x22c) returned 0x1
	[0093.409] WriteFile (in: hFile=0x22c, lpBuffer=0x2748c4c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2748c4c*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.412] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="itl", cAlternateFileName="")) returned 1
	[0093.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", lpFilePart=0x0) returned 0x69
	[0093.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", lpFilePart=0x0) returned 0x6a
	[0093.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.413] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.414] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.414] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", lpFilePart=0x0) returned 0x69
	[0093.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", lpFilePart=0x0) returned 0x6a
	[0093.415] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.415] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.448] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.449] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\itl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.450] GetFileType (hFile=0x22c) returned 0x1
	[0093.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.450] GetFileType (hFile=0x22c) returned 0x1
	[0093.451] WriteFile (in: hFile=0x22c, lpBuffer=0x274d174*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x274d174*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.454] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrw", cAlternateFileName="")) returned 1
	[0093.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", lpFilePart=0x0) returned 0x69
	[0093.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", lpFilePart=0x0) returned 0x6a
	[0093.455] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.455] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.456] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.456] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", lpFilePart=0x0) returned 0x69
	[0093.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", lpFilePart=0x0) returned 0x6a
	[0093.457] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.457] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.458] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.458] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\nrw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.459] GetFileType (hFile=0x22c) returned 0x1
	[0093.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.460] GetFileType (hFile=0x22c) returned 0x1
	[0093.460] WriteFile (in: hFile=0x22c, lpBuffer=0x275169c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x275169c*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.464] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prt", cAlternateFileName="")) returned 1
	[0093.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", lpFilePart=0x0) returned 0x69
	[0093.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", lpFilePart=0x0) returned 0x6a
	[0093.465] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.466] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.466] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.466] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", lpFilePart=0x0) returned 0x69
	[0093.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", lpFilePart=0x0) returned 0x6a
	[0093.469] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.469] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.469] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.470] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\prt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.471] GetFileType (hFile=0x22c) returned 0x1
	[0093.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.471] GetFileType (hFile=0x22c) returned 0x1
	[0093.471] WriteFile (in: hFile=0x22c, lpBuffer=0x2755bc4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2755bc4*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.475] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="spn", cAlternateFileName="")) returned 1
	[0093.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", lpFilePart=0x0) returned 0x69
	[0093.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", lpFilePart=0x0) returned 0x6a
	[0093.475] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.476] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.476] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.477] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", lpFilePart=0x0) returned 0x69
	[0093.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", lpFilePart=0x0) returned 0x6a
	[0093.477] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.478] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.478] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.479] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\spn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.480] GetFileType (hFile=0x22c) returned 0x1
	[0093.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.480] GetFileType (hFile=0x22c) returned 0x1
	[0093.480] WriteFile (in: hFile=0x22c, lpBuffer=0x275a0ec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x275a0ec*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.484] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 1
	[0093.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", lpFilePart=0x0) returned 0x69
	[0093.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", lpFilePart=0x0) returned 0x6a
	[0093.484] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.485] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.485] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.486] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", lpFilePart=0x0) returned 0x69
	[0093.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", lpFilePart=0x0) returned 0x6a
	[0093.486] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0093.487] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.487] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.488] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0093.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0093.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0093.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Decrypt.txt", lpFilePart=0x0) returned 0x75
	[0093.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0093.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\swd\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0093.489] GetFileType (hFile=0x22c) returned 0x1
	[0093.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0093.489] GetFileType (hFile=0x22c) returned 0x1
	[0093.489] WriteFile (in: hFile=0x22c, lpBuffer=0x275e614*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x275e614*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.493] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0093.493] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0093.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0093.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0093.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", lpFilePart=0x0) returned 0x65
	[0093.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpFilePart=0x0) returned 0x66
	[0093.494] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0093.495] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.495] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x899cf70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x899cf70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1
	[0093.496] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x89c30d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x89c30d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brt", cAlternateFileName="")) returned 1
	[0093.496] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x89e9230, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x89e9230, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brz", cAlternateFileName="")) returned 1
	[0093.496] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x89e9230, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x89e9230, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dan", cAlternateFileName="")) returned 1
	[0093.497] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x8a0f390, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8a0f390, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dut", cAlternateFileName="")) returned 1
	[0093.497] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x8a354f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8a354f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eng", cAlternateFileName="")) returned 1
	[0093.498] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x8a354f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8a354f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="frn", cAlternateFileName="")) returned 1
	[0093.498] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x8a5b650, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8a5b650, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="grm", cAlternateFileName="")) returned 1
	[0093.498] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x8acda70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8acda70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="itl", cAlternateFileName="")) returned 1
	[0093.499] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x8acda70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8acda70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrw", cAlternateFileName="")) returned 1
	[0093.499] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x8af3bd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8af3bd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prt", cAlternateFileName="")) returned 1
	[0093.499] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x8b19d30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8b19d30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="spn", cAlternateFileName="")) returned 1
	[0093.500] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x8b19d30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8b19d30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 1
	[0093.500] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x8b19d30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8b19d30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 0
	[0093.500] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0093.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0093.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0093.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Decrypt.txt", lpFilePart=0x0) returned 0x71
	[0093.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0093.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0093.512] GetFileType (hFile=0x228) returned 0x1
	[0093.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0093.512] GetFileType (hFile=0x228) returned 0x1
	[0093.512] WriteFile (in: hFile=0x228, lpBuffer=0x27633a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27633a4*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0093.515] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0093.516] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0093.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0093.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0093.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0093.516] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4d
	[0093.516] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4e
	[0093.516] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0093.517] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.517] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x8b3fe90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8b3fe90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1
	[0093.518] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x8b3fe90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8b3fe90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 0
	[0093.518] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0093.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0093.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0093.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0093.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0093.520] GetFileType (hFile=0x224) returned 0x1
	[0093.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0093.520] GetFileType (hFile=0x224) returned 0x1
	[0093.520] WriteFile (in: hFile=0x224, lpBuffer=0x2766804*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2766804*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0093.523] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0093.524] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x40
	[0093.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x41
	[0093.524] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.526] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.527] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8b65ff0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8b65ff0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1
	[0093.527] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8b65ff0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8b65ff0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0
	[0093.527] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0093.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0093.529] GetFileType (hFile=0x220) returned 0x1
	[0093.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0093.529] GetFileType (hFile=0x220) returned 0x1
	[0093.529] WriteFile (in: hFile=0x220, lpBuffer=0x2769a64*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2769a64*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.532] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0093.532] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0093.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0093.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0093.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0093.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe", lpFilePart=0x0) returned 0x34
	[0093.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", lpFilePart=0x0) returned 0x35
	[0093.533] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0093.533] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.533] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8950cb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8950cb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0093.534] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8b8c150, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8b8c150, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1
	[0093.534] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8b8c150, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8b8c150, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0
	[0093.535] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0093.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0093.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0093.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0093.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0093.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0093.536] GetFileType (hFile=0x208) returned 0x1
	[0093.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0093.536] GetFileType (hFile=0x208) returned 0x1
	[0093.537] WriteFile (in: hFile=0x208, lpBuffer=0x276cc64*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x276cc64*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0093.540] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0093.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0093.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft", lpFilePart=0x0) returned 0x38
	[0093.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpFilePart=0x0) returned 0x39
	[0093.541] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0093.542] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.543] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1
	[0093.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", lpFilePart=0x0) returned 0x49
	[0093.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpFilePart=0x0) returned 0x4a
	[0093.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.544] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.545] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1
	[0093.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0093.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", lpFilePart=0x0) returned 0x51
	[0093.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpFilePart=0x0) returned 0x52
	[0093.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0093.546] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.547] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1
	[0093.548] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1
	[0093.548] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1
	[0093.549] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1
	[0093.549] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1
	[0093.550] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1
	[0093.550] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1
	[0093.551] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1
	[0093.551] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1
	[0093.552] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1
	[0093.553] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1
	[0093.553] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1
	[0093.554] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1
	[0093.554] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1
	[0093.555] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1
	[0093.556] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1
	[0093.557] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1
	[0093.558] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1
	[0093.558] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1
	[0093.559] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1
	[0093.560] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1
	[0093.560] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1
	[0093.561] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1
	[0093.561] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1
	[0093.562] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1
	[0093.562] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1
	[0093.563] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1
	[0093.563] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1
	[0093.564] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1
	[0093.565] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1
	[0093.565] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1
	[0093.566] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1
	[0093.566] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1
	[0093.567] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1
	[0093.567] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1
	[0093.568] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1
	[0093.568] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1
	[0093.569] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1
	[0093.569] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1
	[0093.570] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1
	[0093.570] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1
	[0093.571] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1
	[0093.572] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1
	[0093.572] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1
	[0093.573] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1
	[0093.573] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1
	[0093.574] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1
	[0093.574] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1
	[0093.575] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1
	[0093.576] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1
	[0093.576] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1
	[0093.577] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x0, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1
	[0093.577] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1
	[0093.578] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1
	[0093.578] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1
	[0093.578] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0
	[0093.579] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0093.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0093.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0093.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0093.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", lpFilePart=0x0) returned 0x51
	[0093.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpFilePart=0x0) returned 0x52
	[0093.580] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0093.580] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.581] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1
	[0093.581] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1
	[0093.582] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1
	[0093.582] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1
	[0093.583] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1
	[0093.583] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1
	[0093.584] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1
	[0093.584] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1
	[0093.584] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1
	[0093.585] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1
	[0093.585] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1
	[0093.586] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1
	[0093.586] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1
	[0093.587] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1
	[0093.588] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1
	[0093.588] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1
	[0093.589] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1
	[0093.589] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1
	[0093.589] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1
	[0093.590] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1
	[0093.590] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1
	[0093.591] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1
	[0093.591] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1
	[0093.592] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1
	[0093.592] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1
	[0093.593] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1
	[0093.593] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1
	[0093.593] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1
	[0093.594] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1
	[0093.594] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1
	[0093.595] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1
	[0093.595] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1
	[0093.595] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1
	[0093.596] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1
	[0093.596] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1
	[0093.596] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1
	[0093.597] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1
	[0093.597] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1
	[0093.598] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1
	[0093.607] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0093.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0093.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0093.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0093.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0093.609] GetFileType (hFile=0x224) returned 0x1
	[0093.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0093.609] GetFileType (hFile=0x224) returned 0x1
	[0093.610] WriteFile (in: hFile=0x224, lpBuffer=0x279447c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x279447c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0093.613] CloseHandle (hObject=0x224) returned 1
	[0093.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0093.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", lpFilePart=0x0) returned 0x52
	[0093.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpFilePart=0x0) returned 0x53
	[0093.614] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0093.629] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0093.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0093.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0093.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0093.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", lpFilePart=0x0) returned 0x52
	[0093.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpFilePart=0x0) returned 0x53
	[0093.630] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0093.645] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0093.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0093.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0093.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0093.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0093.647] GetFileType (hFile=0x224) returned 0x1
	[0093.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0093.647] GetFileType (hFile=0x224) returned 0x1
	[0093.647] WriteFile (in: hFile=0x224, lpBuffer=0x27baad8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27baad8*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0093.654] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.655] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", lpFilePart=0x0) returned 0x49
	[0093.655] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpFilePart=0x0) returned 0x4a
	[0093.655] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.656] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8c4a830, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8c4a830, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1
	[0093.656] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8c96af0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8c96af0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 1
	[0093.656] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8c96af0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8c96af0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 0
	[0093.657] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0093.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0093.658] GetFileType (hFile=0x220) returned 0x1
	[0093.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0093.659] GetFileType (hFile=0x220) returned 0x1
	[0093.659] WriteFile (in: hFile=0x220, lpBuffer=0x27bdf90*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27bdf90*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.665] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1
	[0093.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3e
	[0093.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3f
	[0093.665] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.668] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.669] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.669] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3e
	[0093.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3f
	[0093.670] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.670] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.670] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.671] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0093.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\ime12\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0093.672] GetFileType (hFile=0x220) returned 0x1
	[0093.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0093.672] GetFileType (hFile=0x220) returned 0x1
	[0093.673] WriteFile (in: hFile=0x220, lpBuffer=0x27c1ac4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27c1ac4*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.676] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1
	[0093.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3f
	[0093.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x40
	[0093.677] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.678] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.678] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.678] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3f
	[0093.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x40
	[0093.679] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.679] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.680] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.680] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0093.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp12\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0093.682] GetFileType (hFile=0x220) returned 0x1
	[0093.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0093.682] GetFileType (hFile=0x220) returned 0x1
	[0093.682] WriteFile (in: hFile=0x220, lpBuffer=0x27c561c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27c561c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.686] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1
	[0093.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x40
	[0093.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x41
	[0093.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.687] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.687] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.687] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x40
	[0093.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x41
	[0093.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.688] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.689] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.689] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0093.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp8_1\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0093.691] GetFileType (hFile=0x220) returned 0x1
	[0093.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0093.691] GetFileType (hFile=0x220) returned 0x1
	[0093.691] WriteFile (in: hFile=0x220, lpBuffer=0x27c91cc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27c91cc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.694] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1
	[0093.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x40
	[0093.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x41
	[0093.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.695] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.695] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.696] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x40
	[0093.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x41
	[0093.697] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.697] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.698] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.698] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0093.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0093.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0093.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0093.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp9_0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0093.700] GetFileType (hFile=0x220) returned 0x1
	[0093.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0093.700] GetFileType (hFile=0x220) returned 0x1
	[0093.700] WriteFile (in: hFile=0x220, lpBuffer=0x27ccd7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27ccd7c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0093.703] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0093.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0093.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x4a
	[0093.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x4b
	[0093.704] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0093.706] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.706] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1
	[0093.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0093.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x53
	[0093.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x54
	[0093.707] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0093.708] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.708] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="36USA68T", cAlternateFileName="")) returned 1
	[0093.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T", lpFilePart=0x0) returned 0x5c
	[0093.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", lpFilePart=0x0) returned 0x5d
	[0093.708] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0093.709] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.709] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1
	[0093.710] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0
	[0093.710] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0093.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0093.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0093.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0093.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T", lpFilePart=0x0) returned 0x5c
	[0093.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", lpFilePart=0x0) returned 0x5d
	[0093.711] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0093.711] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.712] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1
	[0093.712] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0093.712] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0093.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0093.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0093.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0093.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0093.714] GetFileType (hFile=0x228) returned 0x1
	[0093.714] GetFileType (hFile=0x228) returned 0x1
	[0093.715] WriteFile (in: hFile=0x228, lpBuffer=0x27d31f8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27d31f8*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0093.718] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3O75JDME", cAlternateFileName="")) returned 1
	[0093.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME", lpFilePart=0x0) returned 0x5c
	[0093.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", lpFilePart=0x0) returned 0x5d
	[0093.718] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0093.721] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.721] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1
	[0093.722] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0
	[0093.722] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0093.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME", lpFilePart=0x0) returned 0x5c
	[0093.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", lpFilePart=0x0) returned 0x5d
	[0093.722] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0093.723] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.723] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1
	[0093.724] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0093.724] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0093.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0093.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0093.725] GetFileType (hFile=0x228) returned 0x1
	[0093.725] GetFileType (hFile=0x228) returned 0x1
	[0093.725] WriteFile (in: hFile=0x228, lpBuffer=0x27d7c34*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27d7c34*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0093.729] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0093.729] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UV0DUWVB", cAlternateFileName="")) returned 1
	[0093.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB", lpFilePart=0x0) returned 0x5c
	[0093.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\", lpFilePart=0x0) returned 0x5d
	[0093.730] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0093.730] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.731] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.731] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0093.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB", lpFilePart=0x0) returned 0x5c
	[0093.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\", lpFilePart=0x0) returned 0x5d
	[0093.732] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0093.732] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.733] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0093.733] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0093.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0093.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\uv0duwvb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0093.734] GetFileType (hFile=0x228) returned 0x1
	[0093.734] GetFileType (hFile=0x228) returned 0x1
	[0093.734] WriteFile (in: hFile=0x228, lpBuffer=0x27dc03c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27dc03c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0093.737] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 1
	[0093.738] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09", lpFilePart=0x0) returned 0x5c
	[0093.738] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", lpFilePart=0x0) returned 0x5d
	[0093.738] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0093.739] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.739] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 1
	[0093.739] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0
	[0093.740] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0093.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09", lpFilePart=0x0) returned 0x5c
	[0093.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", lpFilePart=0x0) returned 0x5d
	[0093.740] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0093.740] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.741] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 1
	[0093.741] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0093.741] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0093.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0093.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0093.742] GetFileType (hFile=0x228) returned 0x1
	[0093.743] GetFileType (hFile=0x228) returned 0x1
	[0093.743] WriteFile (in: hFile=0x228, lpBuffer=0x27e0a3c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27e0a3c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0093.746] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0093.746] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0093.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x53
	[0093.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x54
	[0093.747] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0093.747] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0093.749] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8d551d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8d551d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="36USA68T", cAlternateFileName="")) returned 1
	[0093.749] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8d551d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8d551d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3O75JDME", cAlternateFileName="")) returned 1
	[0093.750] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0093.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", lpFilePart=0x0) returned 0x5d
	[0093.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0093.751] GetFileType (hFile=0x228) returned 0x1
	[0093.751] GetFileType (hFile=0x228) returned 0x1
	[0093.751] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x8000
	[0093.751] ReadFile (in: hFile=0x228, lpBuffer=0x27e2f50, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x27e2f50*, lpNumberOfBytesRead=0x26ed44*=0x8000, lpOverlapped=0x0) returned 1
	[0093.773] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.KEKW", lpFilePart=0x0) returned 0x62
	[0093.773] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0093.792] GetFileType (hFile=0x228) returned 0x1
	[0093.792] GetFileType (hFile=0x228) returned 0x1
	[0093.801] WriteFile (in: hFile=0x228, lpBuffer=0x25f432c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x25f432c*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0093.805] CloseHandle (hObject=0x228) returned 1
	[0093.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", lpFilePart=0x0) returned 0x5d
	[0093.805] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat")) returned 1
	[0093.814] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8d7b330, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8d7b330, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UV0DUWVB", cAlternateFileName="")) returned 1
	[0093.814] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8d7b330, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8d7b330, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 1
	[0093.815] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8d7b330, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8d7b330, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 0
	[0093.815] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0093.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0093.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0093.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0093.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0093.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0093.817] GetFileType (hFile=0x224) returned 0x1
	[0093.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0093.817] GetFileType (hFile=0x224) returned 0x1
	[0093.818] WriteFile (in: hFile=0x224, lpBuffer=0x25f6e84*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x25f6e84*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0094.257] CloseHandle (hObject=0x224) returned 1
	[0094.257] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1
	[0094.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", lpFilePart=0x0) returned 0x53
	[0094.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", lpFilePart=0x0) returned 0x54
	[0094.258] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.260] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.260] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.261] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", lpFilePart=0x0) returned 0x53
	[0094.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", lpFilePart=0x0) returned 0x54
	[0094.261] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.262] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.263] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.263] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0094.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0094.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\services\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0094.265] GetFileType (hFile=0x224) returned 0x1
	[0094.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0094.265] GetFileType (hFile=0x224) returned 0x1
	[0094.266] WriteFile (in: hFile=0x224, lpBuffer=0x25fae90*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x25fae90*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0094.269] CloseHandle (hObject=0x224) returned 1
	[0094.269] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.269] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x4a
	[0094.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x4b
	[0094.270] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.271] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.271] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8e39a10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8e39a10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1
	[0094.272] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9264090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9264090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1
	[0094.272] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9264090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9264090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 0
	[0094.273] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0094.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.275] GetFileType (hFile=0x220) returned 0x1
	[0094.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0094.275] GetFileType (hFile=0x220) returned 0x1
	[0094.276] WriteFile (in: hFile=0x220, lpBuffer=0x25fe380*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25fe380*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.279] CloseHandle (hObject=0x220) returned 1
	[0094.279] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.279] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0094.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0094.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0094.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0094.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft", lpFilePart=0x0) returned 0x38
	[0094.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpFilePart=0x0) returned 0x39
	[0094.280] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0094.281] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.282] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8cbcc50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8cbcc50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1
	[0094.282] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8ce2db0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8ce2db0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1
	[0094.283] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8d08f10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8d08f10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1
	[0094.283] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8d08f10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8d08f10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1
	[0094.284] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8d2f070, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8d2f070, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1
	[0094.285] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x928a1f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x928a1f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0094.285] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x928a1f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x928a1f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0
	[0094.286] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0094.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0094.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0094.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0094.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.287] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0094.287] GetFileType (hFile=0x208) returned 0x1
	[0094.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0094.288] GetFileType (hFile=0x208) returned 0x1
	[0094.288] WriteFile (in: hFile=0x208, lpBuffer=0x2601bc8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2601bc8*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0094.293] CloseHandle (hObject=0x208) returned 1
	[0094.294] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1
	[0094.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0094.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun", lpFilePart=0x0) returned 0x32
	[0094.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\", lpFilePart=0x0) returned 0x33
	[0094.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0094.298] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.298] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0094.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java", lpFilePart=0x0) returned 0x37
	[0094.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\", lpFilePart=0x0) returned 0x38
	[0094.299] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.303] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.303] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AU", cAlternateFileName="")) returned 1
	[0094.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU", lpFilePart=0x0) returned 0x3a
	[0094.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\", lpFilePart=0x0) returned 0x3b
	[0094.304] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.306] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.307] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.cab", cAlternateFileName="")) returned 1
	[0094.308] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 1
	[0094.308] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 0
	[0094.308] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU", lpFilePart=0x0) returned 0x3a
	[0094.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\", lpFilePart=0x0) returned 0x3b
	[0094.309] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.310] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.311] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.cab", cAlternateFileName="")) returned 1
	[0094.311] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 1
	[0094.311] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.312] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0094.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0094.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0094.314] GetFileType (hFile=0x224) returned 0x1
	[0094.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0094.314] GetFileType (hFile=0x224) returned 0x1
	[0094.314] WriteFile (in: hFile=0x224, lpBuffer=0x26072e8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26072e8*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0094.317] CloseHandle (hObject=0x224) returned 1
	[0094.318] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0094.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment", lpFilePart=0x0) returned 0x42
	[0094.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\", lpFilePart=0x0) returned 0x43
	[0094.319] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.321] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.322] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1
	[0094.323] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1
	[0094.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security", lpFilePart=0x0) returned 0x4b
	[0094.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\", lpFilePart=0x0) returned 0x4c
	[0094.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.326] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.326] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.327] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security", lpFilePart=0x0) returned 0x4b
	[0094.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\", lpFilePart=0x0) returned 0x4c
	[0094.328] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.328] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.329] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.329] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Decrypt.txt", lpFilePart=0x0) returned 0x57
	[0094.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0094.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\security\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0094.331] GetFileType (hFile=0x228) returned 0x1
	[0094.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0094.331] GetFileType (hFile=0x228) returned 0x1
	[0094.332] WriteFile (in: hFile=0x228, lpBuffer=0x260be88*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x260be88*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0094.335] CloseHandle (hObject=0x228) returned 1
	[0094.335] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tmp", cAlternateFileName="")) returned 1
	[0094.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp", lpFilePart=0x0) returned 0x46
	[0094.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\", lpFilePart=0x0) returned 0x47
	[0094.337] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.338] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.339] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1
	[0094.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0094.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si", lpFilePart=0x0) returned 0x49
	[0094.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\", lpFilePart=0x0) returned 0x4a
	[0094.340] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0094.341] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.342] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.342] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0094.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0094.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0094.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0094.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si", lpFilePart=0x0) returned 0x49
	[0094.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\", lpFilePart=0x0) returned 0x4a
	[0094.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0094.344] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.345] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.345] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0094.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0094.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0094.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0094.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0094.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\si\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0094.347] GetFileType (hFile=0x22c) returned 0x1
	[0094.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0094.348] GetFileType (hFile=0x22c) returned 0x1
	[0094.348] WriteFile (in: hFile=0x22c, lpBuffer=0x26107f8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26107f8*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.351] CloseHandle (hObject=0x22c) returned 1
	[0094.351] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.352] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp", lpFilePart=0x0) returned 0x46
	[0094.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\", lpFilePart=0x0) returned 0x47
	[0094.353] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.353] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.354] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x9322770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9322770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1
	[0094.355] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x9322770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9322770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 0
	[0094.355] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0094.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0094.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0094.357] GetFileType (hFile=0x228) returned 0x1
	[0094.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0094.357] GetFileType (hFile=0x228) returned 0x1
	[0094.357] WriteFile (in: hFile=0x228, lpBuffer=0x2613a94*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2613a94*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0094.360] CloseHandle (hObject=0x228) returned 1
	[0094.361] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.361] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment", lpFilePart=0x0) returned 0x42
	[0094.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\", lpFilePart=0x0) returned 0x43
	[0094.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.369] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.369] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1
	[0094.370] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x92fc610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x92fc610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1
	[0094.371] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x93488d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x93488d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tmp", cAlternateFileName="")) returned 1
	[0094.371] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x93488d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x93488d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tmp", cAlternateFileName="")) returned 0
	[0094.371] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0094.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0094.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0094.373] GetFileType (hFile=0x224) returned 0x1
	[0094.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0094.373] GetFileType (hFile=0x224) returned 0x1
	[0094.373] WriteFile (in: hFile=0x224, lpBuffer=0x26172dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26172dc*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0094.376] CloseHandle (hObject=0x224) returned 1
	[0094.376] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 1
	[0094.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45", lpFilePart=0x0) returned 0x43
	[0094.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", lpFilePart=0x0) returned 0x44
	[0094.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.378] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.379] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data1.cab", cAlternateFileName="")) returned 1
	[0094.379] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 1
	[0094.380] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0
	[0094.380] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45", lpFilePart=0x0) returned 0x43
	[0094.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", lpFilePart=0x0) returned 0x44
	[0094.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.382] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.390] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data1.cab", cAlternateFileName="")) returned 1
	[0094.390] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 1
	[0094.390] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.391] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0094.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0094.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0094.392] GetFileType (hFile=0x224) returned 0x1
	[0094.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0094.393] GetFileType (hFile=0x224) returned 0x1
	[0094.393] WriteFile (in: hFile=0x224, lpBuffer=0x261bb80*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x261bb80*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0094.396] CloseHandle (hObject=0x224) returned 1
	[0094.396] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.397] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java", lpFilePart=0x0) returned 0x37
	[0094.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\", lpFilePart=0x0) returned 0x38
	[0094.398] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.398] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.399] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x92d64b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x92d64b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AU", cAlternateFileName="")) returned 1
	[0094.399] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x936ea30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x936ea30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0094.400] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x9394b90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9394b90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 1
	[0094.401] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x9394b90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9394b90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 0
	[0094.401] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0094.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.402] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.403] GetFileType (hFile=0x220) returned 0x1
	[0094.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0094.403] GetFileType (hFile=0x220) returned 0x1
	[0094.403] WriteFile (in: hFile=0x220, lpBuffer=0x261ef4c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x261ef4c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.409] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.410] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0094.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0094.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0094.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0094.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun", lpFilePart=0x0) returned 0x32
	[0094.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\", lpFilePart=0x0) returned 0x33
	[0094.411] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0094.411] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.412] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x93bacf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x93bacf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0094.412] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x93bacf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x93bacf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0
	[0094.413] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0094.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0094.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0094.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0094.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0094.414] GetFileType (hFile=0x208) returned 0x1
	[0094.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0094.415] GetFileType (hFile=0x208) returned 0x1
	[0094.415] WriteFile (in: hFile=0x208, lpBuffer=0x2621f50*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2621f50*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0094.418] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.418] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0094.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0094.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0094.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0094.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow", lpFilePart=0x0) returned 0x2e
	[0094.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x2f
	[0094.419] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0094.420] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.420] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8b8c150, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x8b8c150, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0094.421] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x928a1f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x928a1f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0094.421] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x93bacf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x93bacf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1
	[0094.422] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x93bacf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x93bacf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0
	[0094.422] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0094.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0094.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0094.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0094.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.423] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0094.423] GetFileType (hFile=0x204) returned 0x1
	[0094.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0094.424] GetFileType (hFile=0x204) returned 0x1
	[0094.424] WriteFile (in: hFile=0x204, lpBuffer=0x2625134*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2625134*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0094.427] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdac06ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdac06ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1
	[0094.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0094.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d
	[0094.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x2e
	[0094.427] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdac06ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdac06ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0094.428] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdac06ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdac06ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.429] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x905ea200, ftCreationTime.dwHighDateTime=0x1d5e2fa, ftLastAccessTime.dwLowDateTime=0x15747df0, ftLastAccessTime.dwHighDateTime=0x1d5d998, ftLastWriteTime.dwLowDateTime=0x15747df0, ftLastWriteTime.dwHighDateTime=0x1d5d998, nFileSizeHigh=0x0, nFileSizeLow=0xb4fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="-lT9_uq1-.flv", cAlternateFileName="-LT9_U~1.FLV")) returned 1
	[0094.498] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x22603100, ftCreationTime.dwHighDateTime=0x1d5dfbd, ftLastAccessTime.dwLowDateTime=0xf30dcf00, ftLastAccessTime.dwHighDateTime=0x1d5e11c, ftLastWriteTime.dwLowDateTime=0xf30dcf00, ftLastWriteTime.dwHighDateTime=0x1d5e11c, nFileSizeHigh=0x0, nFileSizeLow=0x696e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0oMddQ.wav", cAlternateFileName="")) returned 1
	[0094.507] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfd894350, ftCreationTime.dwHighDateTime=0x1d5e339, ftLastAccessTime.dwLowDateTime=0x70799bc0, ftLastAccessTime.dwHighDateTime=0x1d5daa3, ftLastWriteTime.dwLowDateTime=0x70799bc0, ftLastWriteTime.dwHighDateTime=0x1d5daa3, nFileSizeHigh=0x0, nFileSizeLow=0xff6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="62Utxu9NUwhcX.wav", cAlternateFileName="62UTXU~1.WAV")) returned 1
	[0094.524] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1bd88ab0, ftCreationTime.dwHighDateTime=0x1d5e096, ftLastAccessTime.dwLowDateTime=0xbe63f570, ftLastAccessTime.dwHighDateTime=0x1d5e51a, ftLastWriteTime.dwLowDateTime=0xbe63f570, ftLastWriteTime.dwHighDateTime=0x1d5e51a, nFileSizeHigh=0x0, nFileSizeLow=0xb064, dwReserved0=0x0, dwReserved1=0x0, cFileName="7hKMeTzpTC84je4RH.mp4", cAlternateFileName="7HKMET~1.MP4")) returned 1
	[0094.525] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0094.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0094.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33
	[0094.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x34
	[0094.526] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0094.531] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.532] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0094.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b
	[0094.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3c
	[0094.532] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.533] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.534] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0094.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40
	[0094.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x41
	[0094.535] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.535] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.536] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1
	[0094.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47
	[0094.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", lpFilePart=0x0) returned 0x48
	[0094.537] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.537] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.538] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.538] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47
	[0094.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", lpFilePart=0x0) returned 0x48
	[0094.540] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.540] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.541] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.541] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0094.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0094.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\collab\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0094.543] GetFileType (hFile=0x228) returned 0x1
	[0094.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0094.543] GetFileType (hFile=0x228) returned 0x1
	[0094.544] WriteFile (in: hFile=0x228, lpBuffer=0x262bc18*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x262bc18*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0094.547] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1
	[0094.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46
	[0094.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", lpFilePart=0x0) returned 0x47
	[0094.548] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.548] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.549] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.549] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46
	[0094.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", lpFilePart=0x0) returned 0x47
	[0094.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.551] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.551] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.551] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0094.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0094.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\forms\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0094.553] GetFileType (hFile=0x228) returned 0x1
	[0094.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0094.553] GetFileType (hFile=0x228) returned 0x1
	[0094.554] WriteFile (in: hFile=0x228, lpBuffer=0x262f92c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x262f92c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0094.560] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1
	[0094.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c
	[0094.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpFilePart=0x0) returned 0x4d
	[0094.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.562] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.562] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1
	[0094.563] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1
	[0094.563] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0
	[0094.564] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c
	[0094.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpFilePart=0x0) returned 0x4d
	[0094.565] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.565] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.565] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1
	[0094.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", lpFilePart=0x0) returned 0x54
	[0094.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0094.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0094.566] GetFileType (hFile=0x22c) returned 0x1
	[0094.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0094.567] GetFileType (hFile=0x22c) returned 0x1
	[0094.567] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x0
	[0094.567] CloseHandle (hObject=0x22c) returned 1
	[0094.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.KEKW", lpFilePart=0x0) returned 0x59
	[0094.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0094.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0094.568] GetFileType (hFile=0x22c) returned 0x1
	[0094.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0094.569] GetFileType (hFile=0x22c) returned 0x1
	[0094.569] WriteFile (in: hFile=0x22c, lpBuffer=0x2634184*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x2634184*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0094.572] CloseHandle (hObject=0x22c) returned 1
	[0094.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", lpFilePart=0x0) returned 0x54
	[0094.573] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js")) returned 1
	[0094.573] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1
	[0094.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", lpFilePart=0x0) returned 0x5d
	[0094.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0094.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0094.575] GetFileType (hFile=0x22c) returned 0x1
	[0094.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0094.575] GetFileType (hFile=0x22c) returned 0x1
	[0094.575] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xa
	[0094.576] ReadFile (in: hFile=0x22c, lpBuffer=0x263589c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x263589c*, lpNumberOfBytesRead=0x26eca4*=0xa, lpOverlapped=0x0) returned 1
	[0094.580] CloseHandle (hObject=0x22c) returned 1
	[0094.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.KEKW", lpFilePart=0x0) returned 0x62
	[0094.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0094.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0094.587] GetFileType (hFile=0x22c) returned 0x1
	[0094.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0094.588] GetFileType (hFile=0x22c) returned 0x1
	[0094.588] WriteFile (in: hFile=0x22c, lpBuffer=0x263800c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x263800c*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0094.591] CloseHandle (hObject=0x22c) returned 1
	[0094.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", lpFilePart=0x0) returned 0x5d
	[0094.592] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js")) returned 1
	[0094.595] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.595] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Decrypt.txt", lpFilePart=0x0) returned 0x58
	[0094.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0094.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0094.597] GetFileType (hFile=0x228) returned 0x1
	[0094.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0094.597] GetFileType (hFile=0x228) returned 0x1
	[0094.598] WriteFile (in: hFile=0x228, lpBuffer=0x263a7a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x263a7a4*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0094.601] CloseHandle (hObject=0x228) returned 1
	[0094.602] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1
	[0094.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49
	[0094.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpFilePart=0x0) returned 0x4a
	[0094.603] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.603] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.604] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x0, dwReserved1=0x0, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1
	[0094.605] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 1
	[0094.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0094.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", lpFilePart=0x0) returned 0x52
	[0094.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpFilePart=0x0) returned 0x53
	[0094.606] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0094.607] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.608] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 1
	[0094.609] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 1
	[0094.609] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 0
	[0094.610] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0094.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0094.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0094.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0094.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", lpFilePart=0x0) returned 0x52
	[0094.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpFilePart=0x0) returned 0x53
	[0094.611] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0094.611] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.612] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 1
	[0094.612] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 1
	[0094.613] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.613] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0094.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0094.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0094.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0094.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0094.614] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0094.620] GetFileType (hFile=0x22c) returned 0x1
	[0094.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0094.621] GetFileType (hFile=0x22c) returned 0x1
	[0094.621] WriteFile (in: hFile=0x22c, lpBuffer=0x2640864*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2640864*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.624] CloseHandle (hObject=0x22c) returned 1
	[0094.624] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.625] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49
	[0094.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpFilePart=0x0) returned 0x4a
	[0094.626] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.626] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.627] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x0, dwReserved1=0x0, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1
	[0094.627] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x95d0030, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x95d0030, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 1
	[0094.628] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x95d0030, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x95d0030, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 0
	[0094.628] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0094.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0094.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0094.630] GetFileType (hFile=0x228) returned 0x1
	[0094.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0094.630] GetFileType (hFile=0x228) returned 0x1
	[0094.630] WriteFile (in: hFile=0x228, lpBuffer=0x2644088*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2644088*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0094.633] CloseHandle (hObject=0x228) returned 1
	[0094.634] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.634] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40
	[0094.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x41
	[0094.635] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.635] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.636] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x9511950, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9511950, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1
	[0094.637] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x9511950, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9511950, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1
	[0094.637] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x9583d70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9583d70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1
	[0094.638] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x95d0030, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x95d0030, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1
	[0094.638] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x95d0030, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x95d0030, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0
	[0094.639] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0094.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0094.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0094.640] GetFileType (hFile=0x224) returned 0x1
	[0094.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0094.640] GetFileType (hFile=0x224) returned 0x1
	[0094.641] WriteFile (in: hFile=0x224, lpBuffer=0x26476fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26476fc*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0094.644] CloseHandle (hObject=0x224) returned 1
	[0094.644] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.644] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b
	[0094.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3c
	[0094.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.646] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.646] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x95f6190, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x95f6190, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0094.647] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x95f6190, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x95f6190, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0
	[0094.647] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0094.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.649] GetFileType (hFile=0x220) returned 0x1
	[0094.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0094.649] GetFileType (hFile=0x220) returned 0x1
	[0094.649] WriteFile (in: hFile=0x220, lpBuffer=0x264a828*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x264a828*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.652] CloseHandle (hObject=0x220) returned 1
	[0094.653] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1
	[0094.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40
	[0094.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x41
	[0094.654] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.656] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.657] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1
	[0094.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b
	[0094.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpFilePart=0x0) returned 0x4c
	[0094.657] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.658] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.659] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1
	[0094.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54
	[0094.660] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", lpFilePart=0x0) returned 0x55
	[0094.660] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.662] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.663] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.663] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54
	[0094.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", lpFilePart=0x0) returned 0x55
	[0094.664] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.665] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.666] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.666] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0094.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0094.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\d5ntrc6r\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0094.668] GetFileType (hFile=0x228) returned 0x1
	[0094.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0094.668] GetFileType (hFile=0x228) returned 0x1
	[0094.669] WriteFile (in: hFile=0x228, lpBuffer=0x2650054*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2650054*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0094.672] CloseHandle (hObject=0x228) returned 1
	[0094.672] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.672] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b
	[0094.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpFilePart=0x0) returned 0x4c
	[0094.673] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.674] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.674] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x9642450, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9642450, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1
	[0094.674] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x9642450, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9642450, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 0
	[0094.675] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Decrypt.txt", lpFilePart=0x0) returned 0x57
	[0094.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0094.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0094.676] GetFileType (hFile=0x224) returned 0x1
	[0094.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0094.676] GetFileType (hFile=0x224) returned 0x1
	[0094.677] WriteFile (in: hFile=0x224, lpBuffer=0x26533c0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26533c0*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0094.681] CloseHandle (hObject=0x224) returned 1
	[0094.682] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.682] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40
	[0094.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x41
	[0094.683] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.684] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.684] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x9642450, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9642450, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1
	[0094.684] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x9642450, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9642450, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 0
	[0094.685] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0094.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.686] GetFileType (hFile=0x220) returned 0x1
	[0094.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0094.686] GetFileType (hFile=0x220) returned 0x1
	[0094.687] WriteFile (in: hFile=0x220, lpBuffer=0x2656610*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2656610*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.690] CloseHandle (hObject=0x220) returned 1
	[0094.691] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1
	[0094.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e
	[0094.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", lpFilePart=0x0) returned 0x3f
	[0094.691] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.692] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.693] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.693] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e
	[0094.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", lpFilePart=0x0) returned 0x3f
	[0094.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.695] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.696] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.696] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0094.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\headlights\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.698] GetFileType (hFile=0x220) returned 0x1
	[0094.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0094.698] GetFileType (hFile=0x220) returned 0x1
	[0094.698] WriteFile (in: hFile=0x220, lpBuffer=0x265a170*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x265a170*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.701] CloseHandle (hObject=0x220) returned 1
	[0094.702] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1
	[0094.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f
	[0094.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x40
	[0094.702] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.703] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.704] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1
	[0094.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c
	[0094.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4d
	[0094.705] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.706] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.706] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.707] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c
	[0094.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4d
	[0094.708] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.708] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.709] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.709] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0094.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0094.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Decrypt.txt", lpFilePart=0x0) returned 0x58
	[0094.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0094.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\dictionaries\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0094.711] GetFileType (hFile=0x224) returned 0x1
	[0094.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0094.711] GetFileType (hFile=0x224) returned 0x1
	[0094.712] WriteFile (in: hFile=0x224, lpBuffer=0x265eb34*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x265eb34*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0094.715] CloseHandle (hObject=0x224) returned 1
	[0094.715] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.715] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f
	[0094.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x40
	[0094.716] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.716] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.717] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x96b4870, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x96b4870, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1
	[0094.718] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x96b4870, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x96b4870, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0
	[0094.718] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0094.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.719] GetFileType (hFile=0x220) returned 0x1
	[0094.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0094.719] GetFileType (hFile=0x220) returned 0x1
	[0094.720] WriteFile (in: hFile=0x220, lpBuffer=0x2661d68*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2661d68*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.726] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1
	[0094.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41
	[0094.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpFilePart=0x0) returned 0x42
	[0094.728] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.729] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.729] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.730] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41
	[0094.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpFilePart=0x0) returned 0x42
	[0094.730] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.731] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.731] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.732] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0094.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\logtransport2\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.733] GetFileType (hFile=0x220) returned 0x1
	[0094.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0094.733] GetFileType (hFile=0x220) returned 0x1
	[0094.733] WriteFile (in: hFile=0x220, lpBuffer=0x2665964*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2665964*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.736] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.737] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0094.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0094.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0094.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0094.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33
	[0094.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x34
	[0094.738] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0094.738] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.739] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x961c2f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x961c2f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0094.739] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x96685b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x96685b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1
	[0094.740] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x968e710, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x968e710, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1
	[0094.740] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x96b4870, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x96b4870, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1
	[0094.741] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x96da9d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x96da9d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1
	[0094.742] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x96da9d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x96da9d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0
	[0094.743] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0094.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0094.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0094.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0094.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0094.744] GetFileType (hFile=0x208) returned 0x1
	[0094.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0094.744] GetFileType (hFile=0x208) returned 0x1
	[0094.744] WriteFile (in: hFile=0x208, lpBuffer=0x2668f94*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2668f94*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0094.747] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ad185e0, ftCreationTime.dwHighDateTime=0x1d5da9f, ftLastAccessTime.dwLowDateTime=0x259524b0, ftLastAccessTime.dwHighDateTime=0x1d5da14, ftLastWriteTime.dwLowDateTime=0x259524b0, ftLastWriteTime.dwHighDateTime=0x1d5da14, nFileSizeHigh=0x0, nFileSizeLow=0x9876, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ad_8oHDleju7gjQPCKa.doc", cAlternateFileName="AD_8OH~1.DOC")) returned 1
	[0094.750] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbe0ee60, ftCreationTime.dwHighDateTime=0x1d5e1af, ftLastAccessTime.dwLowDateTime=0x8ce6b650, ftLastAccessTime.dwHighDateTime=0x1d5de39, ftLastWriteTime.dwLowDateTime=0x8ce6b650, ftLastWriteTime.dwHighDateTime=0x1d5de39, nFileSizeHigh=0x0, nFileSizeLow=0x3fd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="brGd.bmp", cAlternateFileName="")) returned 1
	[0094.750] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2aefbe00, ftCreationTime.dwHighDateTime=0x1d5df20, ftLastAccessTime.dwLowDateTime=0xe9978c80, ftLastAccessTime.dwHighDateTime=0x1d5da5b, ftLastWriteTime.dwLowDateTime=0xe9978c80, ftLastWriteTime.dwHighDateTime=0x1d5da5b, nFileSizeHigh=0x0, nFileSizeLow=0x15b34, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8-QppsP1gRerkX.docx", cAlternateFileName="E8-QPP~1.DOC")) returned 1
	[0094.751] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaedb9960, ftCreationTime.dwHighDateTime=0x1d5dbd2, ftLastAccessTime.dwLowDateTime=0xe39cc9b0, ftLastAccessTime.dwHighDateTime=0x1d5df62, ftLastWriteTime.dwLowDateTime=0xe39cc9b0, ftLastWriteTime.dwHighDateTime=0x1d5df62, nFileSizeHigh=0x0, nFileSizeLow=0x10729, dwReserved0=0x0, dwReserved1=0x0, cFileName="EdSmxMO3CqQAXI.m4a", cAlternateFileName="EDSMXM~1.M4A")) returned 1
	[0094.751] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xacf5f430, ftCreationTime.dwHighDateTime=0x1d5e34b, ftLastAccessTime.dwLowDateTime=0x94805c40, ftLastAccessTime.dwHighDateTime=0x1d5d957, ftLastWriteTime.dwLowDateTime=0x94805c40, ftLastWriteTime.dwHighDateTime=0x1d5d957, nFileSizeHigh=0x0, nFileSizeLow=0x17896, dwReserved0=0x0, dwReserved1=0x0, cFileName="gFCGzFABqRtfbthg.jpg", cAlternateFileName="GFCGZF~1.JPG")) returned 1
	[0094.752] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfde73610, ftCreationTime.dwHighDateTime=0x1d5d95a, ftLastAccessTime.dwLowDateTime=0xcc8b6ec0, ftLastAccessTime.dwHighDateTime=0x1d5e3ea, ftLastWriteTime.dwLowDateTime=0xcc8b6ec0, ftLastWriteTime.dwHighDateTime=0x1d5e3ea, nFileSizeHigh=0x0, nFileSizeLow=0x12af8, dwReserved0=0x0, dwReserved1=0x0, cFileName="heRZc55brEskdRX.flv", cAlternateFileName="HERZC5~1.FLV")) returned 1
	[0094.752] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc5835560, ftCreationTime.dwHighDateTime=0x1d5e274, ftLastAccessTime.dwLowDateTime=0xf3f29e70, ftLastAccessTime.dwHighDateTime=0x1d5e345, ftLastWriteTime.dwLowDateTime=0xf3f29e70, ftLastWriteTime.dwHighDateTime=0x1d5e345, nFileSizeHigh=0x0, nFileSizeLow=0x130df, dwReserved0=0x0, dwReserved1=0x0, cFileName="HPtpTBGwP6FaWD8QXb.m4a", cAlternateFileName="HPTPTB~1.M4A")) returned 1
	[0094.753] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1
	[0094.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0094.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38
	[0094.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x39
	[0094.754] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0094.755] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.755] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1
	[0094.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f
	[0094.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpFilePart=0x0) returned 0x60
	[0094.756] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.757] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.758] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.758] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f
	[0094.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpFilePart=0x0) returned 0x60
	[0094.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.759] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.760] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.760] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0094.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0094.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Decrypt.txt", lpFilePart=0x0) returned 0x6b
	[0094.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.761] GetFileType (hFile=0x220) returned 0x1
	[0094.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0094.762] GetFileType (hFile=0x220) returned 0x1
	[0094.762] WriteFile (in: hFile=0x220, lpBuffer=0x266e7f4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x266e7f4*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.765] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.765] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0094.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0094.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0094.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0094.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38
	[0094.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x39
	[0094.766] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0094.767] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.767] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9726c90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9726c90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1
	[0094.768] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9726c90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9726c90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0
	[0094.768] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0094.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0094.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0094.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0094.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0094.770] GetFileType (hFile=0x208) returned 0x1
	[0094.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0094.770] GetFileType (hFile=0x208) returned 0x1
	[0094.770] WriteFile (in: hFile=0x208, lpBuffer=0x2671a14*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2671a14*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0094.774] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4a24d850, ftCreationTime.dwHighDateTime=0x1d5e0ec, ftLastAccessTime.dwLowDateTime=0x3c4c8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e74f, ftLastWriteTime.dwLowDateTime=0x3c4c8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e74f, nFileSizeHigh=0x0, nFileSizeLow=0x17146, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdNpk1x8AE0NOqJjSc5n.avi", cAlternateFileName="JDNPK1~1.AVI")) returned 1
	[0094.775] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfead4f20, ftCreationTime.dwHighDateTime=0x1d5de92, ftLastAccessTime.dwLowDateTime=0xf29b3630, ftLastAccessTime.dwHighDateTime=0x1d5dabd, ftLastWriteTime.dwLowDateTime=0xf29b3630, ftLastWriteTime.dwHighDateTime=0x1d5dabd, nFileSizeHigh=0x0, nFileSizeLow=0xa8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="KJoZDisMXpQ3iE.png", cAlternateFileName="KJOZDI~1.PNG")) returned 1
	[0094.776] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x390d1330, ftCreationTime.dwHighDateTime=0x1d5dc45, ftLastAccessTime.dwLowDateTime=0x2eed16f0, ftLastAccessTime.dwHighDateTime=0x1d5db89, ftLastWriteTime.dwLowDateTime=0x2eed16f0, ftLastWriteTime.dwHighDateTime=0x1d5db89, nFileSizeHigh=0x0, nFileSizeLow=0xc1e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="knyNca0z5S0Hn-BxZd.mp4", cAlternateFileName="KNYNCA~1.MP4")) returned 1
	[0094.776] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee2d9f30, ftCreationTime.dwHighDateTime=0x1d5de68, ftLastAccessTime.dwLowDateTime=0xdc8a8860, ftLastAccessTime.dwHighDateTime=0x1d5dc92, ftLastWriteTime.dwLowDateTime=0xdc8a8860, ftLastWriteTime.dwHighDateTime=0x1d5dc92, nFileSizeHigh=0x0, nFileSizeLow=0x1fb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQ9twrZw46PHSgjvD.mkv", cAlternateFileName="KQ9TWR~1.MKV")) returned 1
	[0094.777] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83bc6110, ftCreationTime.dwHighDateTime=0x1d5ddf3, ftLastAccessTime.dwLowDateTime=0x3b2cd890, ftLastAccessTime.dwHighDateTime=0x1d5e16c, ftLastWriteTime.dwLowDateTime=0x3b2cd890, ftLastWriteTime.dwHighDateTime=0x1d5e16c, nFileSizeHigh=0x0, nFileSizeLow=0x2ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="lz2-7X1s4UwpH lnp.png", cAlternateFileName="LZ2-7X~1.PNG")) returned 1
	[0094.777] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1
	[0094.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0094.778] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38
	[0094.778] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", lpFilePart=0x0) returned 0x39
	[0094.778] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0094.779] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.780] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1
	[0094.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0094.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45
	[0094.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpFilePart=0x0) returned 0x46
	[0094.780] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.781] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.781] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1
	[0094.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0094.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54
	[0094.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpFilePart=0x0) returned 0x55
	[0094.782] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.785] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.785] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1
	[0094.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d
	[0094.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", lpFilePart=0x0) returned 0x5e
	[0094.786] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.788] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.788] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.789] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0094.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0094.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0094.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d
	[0094.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", lpFilePart=0x0) returned 0x5e
	[0094.789] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.790] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.790] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.790] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0094.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\p7y3f7qb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0094.792] GetFileType (hFile=0x228) returned 0x1
	[0094.792] GetFileType (hFile=0x228) returned 0x1
	[0094.792] WriteFile (in: hFile=0x228, lpBuffer=0x2678864*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2678864*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0094.795] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.795] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54
	[0094.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpFilePart=0x0) returned 0x55
	[0094.796] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.796] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.797] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x9772f50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9772f50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1
	[0094.797] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x9772f50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9772f50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0
	[0094.798] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0094.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0094.799] GetFileType (hFile=0x224) returned 0x1
	[0094.799] GetFileType (hFile=0x224) returned 0x1
	[0094.799] WriteFile (in: hFile=0x224, lpBuffer=0x267bd0c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x267bd0c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0094.802] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1
	[0094.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54
	[0094.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpFilePart=0x0) returned 0x55
	[0094.803] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.804] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.805] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1
	[0094.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c
	[0094.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpFilePart=0x0) returned 0x5d
	[0094.806] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.806] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.807] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1
	[0094.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x68
	[0094.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpFilePart=0x0) returned 0x69
	[0094.807] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0094.809] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.810] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 1
	[0094.810] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x6c
	[0094.810] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpFilePart=0x0) returned 0x6d
	[0094.810] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0094.811] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.812] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 1
	[0094.812] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 0
	[0094.812] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0094.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x6c
	[0094.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpFilePart=0x0) returned 0x6d
	[0094.813] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0094.813] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.814] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 1
	[0094.814] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.814] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0094.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Decrypt.txt", lpFilePart=0x0) returned 0x78
	[0094.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0094.815] GetFileType (hFile=0x230) returned 0x1
	[0094.815] GetFileType (hFile=0x230) returned 0x1
	[0094.816] WriteFile (in: hFile=0x230, lpBuffer=0x2683704*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x2683704*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0094.821] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.821] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0094.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x68
	[0094.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpFilePart=0x0) returned 0x69
	[0094.822] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0094.822] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.823] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x97990b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x97990b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 1
	[0094.823] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x97990b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x97990b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 0
	[0094.823] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0094.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Decrypt.txt", lpFilePart=0x0) returned 0x74
	[0094.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0094.824] GetFileType (hFile=0x22c) returned 0x1
	[0094.824] GetFileType (hFile=0x22c) returned 0x1
	[0094.825] WriteFile (in: hFile=0x22c, lpBuffer=0x2686e2c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2686e2c*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.828] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.828] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c
	[0094.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpFilePart=0x0) returned 0x5d
	[0094.828] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.829] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.829] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x97bf210, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x97bf210, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1
	[0094.830] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x97bf210, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x97bf210, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 0
	[0094.830] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0094.830] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0094.831] GetFileType (hFile=0x228) returned 0x1
	[0094.831] GetFileType (hFile=0x228) returned 0x1
	[0094.831] WriteFile (in: hFile=0x228, lpBuffer=0x268a43c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x268a43c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0094.834] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.834] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.835] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54
	[0094.835] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpFilePart=0x0) returned 0x55
	[0094.839] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.840] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.840] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x97bf210, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x97bf210, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1
	[0094.841] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x97bf210, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x97bf210, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 0
	[0094.841] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0094.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0094.842] GetFileType (hFile=0x224) returned 0x1
	[0094.842] GetFileType (hFile=0x224) returned 0x1
	[0094.842] WriteFile (in: hFile=0x224, lpBuffer=0x268d8dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x268d8dc*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0094.845] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.845] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45
	[0094.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpFilePart=0x0) returned 0x46
	[0094.846] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.846] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.847] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x9772f50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9772f50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1
	[0094.847] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x97e5370, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x97e5370, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1
	[0094.848] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x97e5370, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x97e5370, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0
	[0094.848] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0094.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.849] GetFileType (hFile=0x220) returned 0x1
	[0094.850] GetFileType (hFile=0x220) returned 0x1
	[0094.850] WriteFile (in: hFile=0x220, lpBuffer=0x2690dcc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2690dcc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.855] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.855] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0094.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38
	[0094.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", lpFilePart=0x0) returned 0x39
	[0094.856] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0094.856] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.857] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x97e5370, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x97e5370, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1
	[0094.857] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x97e5370, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x97e5370, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0
	[0094.857] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0094.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0094.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0094.858] GetFileType (hFile=0x208) returned 0x1
	[0094.858] GetFileType (hFile=0x208) returned 0x1
	[0094.859] WriteFile (in: hFile=0x208, lpBuffer=0x2693f1c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2693f1c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0094.862] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0094.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37
	[0094.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x38
	[0094.862] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0094.863] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.863] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1
	[0094.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e
	[0094.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x3f
	[0094.864] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.870] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.870] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.871] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e
	[0094.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x3f
	[0094.871] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.872] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.872] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.872] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0094.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\addins\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.873] GetFileType (hFile=0x220) returned 0x1
	[0094.873] GetFileType (hFile=0x220) returned 0x1
	[0094.874] WriteFile (in: hFile=0x220, lpBuffer=0x2698478*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2698478*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.877] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0094.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43
	[0094.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x44
	[0094.877] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.878] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.878] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.879] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.879] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43
	[0094.879] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x44
	[0094.879] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.880] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.880] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0094.880] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0094.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\credentials\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.883] GetFileType (hFile=0x220) returned 0x1
	[0094.883] GetFileType (hFile=0x220) returned 0x1
	[0094.883] WriteFile (in: hFile=0x220, lpBuffer=0x269c0e8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x269c0e8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.887] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0094.887] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e
	[0094.887] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x3f
	[0094.887] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.888] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.889] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0094.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42
	[0094.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x43
	[0094.889] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.890] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.891] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0094.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71
	[0094.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x72
	[0094.891] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.899] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.899] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 1
	[0094.900] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x0, dwReserved1=0x0, cFileName="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="932A2D~1")) returned 1
	[0094.900] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 1
	[0094.900] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 0
	[0094.900] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71
	[0094.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x72
	[0094.903] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.906] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.906] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 1
	[0094.906] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x0, dwReserved1=0x0, cFileName="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="932A2D~1")) returned 1
	[0094.907] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 1
	[0094.907] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.907] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Decrypt.txt", lpFilePart=0x0) returned 0x7d
	[0094.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0094.913] GetFileType (hFile=0x228) returned 0x1
	[0094.913] GetFileType (hFile=0x228) returned 0x1
	[0094.914] WriteFile (in: hFile=0x228, lpBuffer=0x26a4400*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26a4400*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0094.917] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.917] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42
	[0094.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x43
	[0094.917] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.918] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.918] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x987d8f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x987d8f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0094.919] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x987d8f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x987d8f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0094.919] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0094.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0094.920] GetFileType (hFile=0x224) returned 0x1
	[0094.920] GetFileType (hFile=0x224) returned 0x1
	[0094.920] WriteFile (in: hFile=0x224, lpBuffer=0x26a77b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26a77b4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0094.923] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.923] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.923] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e
	[0094.923] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x3f
	[0094.924] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.924] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.924] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x98a3a50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x98a3a50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0094.925] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x98a3a50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x98a3a50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0
	[0094.925] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0094.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.926] GetFileType (hFile=0x220) returned 0x1
	[0094.926] GetFileType (hFile=0x220) returned 0x1
	[0094.926] WriteFile (in: hFile=0x220, lpBuffer=0x26aa948*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26aa948*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0094.969] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1
	[0094.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50
	[0094.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpFilePart=0x0) returned 0x51
	[0094.970] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.971] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.972] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0094.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55
	[0094.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpFilePart=0x0) returned 0x56
	[0094.972] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.973] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.973] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1
	[0094.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58
	[0094.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", lpFilePart=0x0) returned 0x59
	[0094.974] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.976] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.976] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1
	[0094.977] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0
	[0094.977] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58
	[0094.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", lpFilePart=0x0) returned 0x59
	[0094.978] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0094.978] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.978] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1
	[0094.979] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.979] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0094.979] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0094.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0094.980] GetFileType (hFile=0x228) returned 0x1
	[0094.981] GetFileType (hFile=0x228) returned 0x1
	[0094.981] WriteFile (in: hFile=0x228, lpBuffer=0x26b0df4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26b0df4*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0094.984] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.984] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55
	[0094.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpFilePart=0x0) returned 0x56
	[0094.984] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0094.985] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.985] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x993bfd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x993bfd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1
	[0094.985] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x993bfd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x993bfd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0
	[0094.986] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0094.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0094.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0094.987] GetFileType (hFile=0x224) returned 0x1
	[0094.987] GetFileType (hFile=0x224) returned 0x1
	[0094.987] WriteFile (in: hFile=0x224, lpBuffer=0x26b4284*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26b4284*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0094.990] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0094.990] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50
	[0094.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpFilePart=0x0) returned 0x51
	[0094.991] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0094.995] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0094.995] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x993bfd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x993bfd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0094.995] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x993bfd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x993bfd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0094.996] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0094.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Decrypt.txt", lpFilePart=0x0) returned 0x5c
	[0094.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0094.997] GetFileType (hFile=0x220) returned 0x1
	[0094.997] GetFileType (hFile=0x220) returned 0x1
	[0094.997] WriteFile (in: hFile=0x220, lpBuffer=0x26b7684*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26b7684*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.000] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1
	[0095.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d
	[0095.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", lpFilePart=0x0) returned 0x3e
	[0095.001] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.002] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.002] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 1
	[0095.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45
	[0095.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpFilePart=0x0) returned 0x46
	[0095.003] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.004] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.004] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.004] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45
	[0095.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpFilePart=0x0) returned 0x46
	[0095.005] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.005] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.005] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.006] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0095.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\xlstart\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0095.007] GetFileType (hFile=0x224) returned 0x1
	[0095.007] GetFileType (hFile=0x224) returned 0x1
	[0095.008] WriteFile (in: hFile=0x224, lpBuffer=0x26bbdf4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26bbdf4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0095.019] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.019] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d
	[0095.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", lpFilePart=0x0) returned 0x3e
	[0095.019] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.020] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.020] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0x9962130, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9962130, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 1
	[0095.021] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0x9962130, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9962130, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 0
	[0095.021] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0095.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.022] GetFileType (hFile=0x220) returned 0x1
	[0095.022] GetFileType (hFile=0x220) returned 0x1
	[0095.022] WriteFile (in: hFile=0x220, lpBuffer=0x26bef74*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26bef74*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.025] CloseHandle (hObject=0x220) returned 1
	[0095.026] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1
	[0095.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3d
	[0095.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3e
	[0095.026] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.028] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.028] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.028] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3d
	[0095.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3e
	[0095.029] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.030] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.030] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.030] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0095.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ime12\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.043] GetFileType (hFile=0x220) returned 0x1
	[0095.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0095.043] GetFileType (hFile=0x220) returned 0x1
	[0095.043] WriteFile (in: hFile=0x220, lpBuffer=0x26c2a50*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26c2a50*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.047] CloseHandle (hObject=0x220) returned 1
	[0095.047] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1
	[0095.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3e
	[0095.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3f
	[0095.048] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.049] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.049] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.050] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3e
	[0095.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3f
	[0095.051] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.051] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.052] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.052] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0095.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp12\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.054] GetFileType (hFile=0x220) returned 0x1
	[0095.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0095.055] GetFileType (hFile=0x220) returned 0x1
	[0095.055] WriteFile (in: hFile=0x220, lpBuffer=0x26c6588*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26c6588*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.058] CloseHandle (hObject=0x220) returned 1
	[0095.058] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1
	[0095.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3f
	[0095.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x40
	[0095.059] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.060] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.061] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.061] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3f
	[0095.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x40
	[0095.062] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.062] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.062] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.063] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0095.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp8_1\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.065] GetFileType (hFile=0x220) returned 0x1
	[0095.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0095.065] GetFileType (hFile=0x220) returned 0x1
	[0095.065] WriteFile (in: hFile=0x220, lpBuffer=0x26ca0e0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26ca0e0*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.068] CloseHandle (hObject=0x220) returned 1
	[0095.068] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1
	[0095.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3f
	[0095.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x40
	[0095.069] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.070] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.071] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.071] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3f
	[0095.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x40
	[0095.072] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.073] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.073] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.074] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0095.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp9_0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.075] GetFileType (hFile=0x220) returned 0x1
	[0095.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0095.076] GetFileType (hFile=0x220) returned 0x1
	[0095.076] WriteFile (in: hFile=0x220, lpBuffer=0x26cdc38*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26cdc38*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.079] CloseHandle (hObject=0x220) returned 1
	[0095.079] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0095.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x49
	[0095.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x4a
	[0095.080] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.081] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.081] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1
	[0095.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0095.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x56
	[0095.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x57
	[0095.082] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.083] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.083] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0095.084] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1
	[0095.084] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 1
	[0095.085] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1
	[0095.086] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1
	[0095.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62
	[0095.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x63
	[0095.087] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0095.087] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.088] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1
	[0095.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x77
	[0095.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x78
	[0095.089] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.090] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.091] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.091] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x77
	[0095.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x78
	[0095.092] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.093] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.093] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.094] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Decrypt.txt", lpFilePart=0x0) returned 0x83
	[0095.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0095.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0095.099] GetFileType (hFile=0x22c) returned 0x1
	[0095.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0095.099] GetFileType (hFile=0x22c) returned 0x1
	[0095.099] WriteFile (in: hFile=0x22c, lpBuffer=0x26d572c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26d572c*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.102] CloseHandle (hObject=0x22c) returned 1
	[0095.105] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 1
	[0095.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x6a
	[0095.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x6b
	[0095.106] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.107] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.108] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0095.108] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1
	[0095.109] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1
	[0095.109] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1
	[0095.110] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1
	[0095.111] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1
	[0095.111] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0095.112] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1
	[0095.112] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0095.113] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0
	[0095.114] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x6a
	[0095.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x6b
	[0095.115] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.115] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.117] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0095.117] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1
	[0095.117] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1
	[0095.118] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1
	[0095.119] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1
	[0095.119] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1
	[0095.120] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0095.120] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1
	[0095.121] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0095.121] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.121] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Decrypt.txt", lpFilePart=0x0) returned 0x76
	[0095.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0095.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0095.127] GetFileType (hFile=0x22c) returned 0x1
	[0095.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0095.127] GetFileType (hFile=0x22c) returned 0x1
	[0095.127] WriteFile (in: hFile=0x22c, lpBuffer=0x26deb70*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26deb70*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.131] CloseHandle (hObject=0x22c) returned 1
	[0095.132] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.133] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0095.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0095.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0095.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62
	[0095.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x63
	[0095.133] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0095.134] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.135] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9a46970, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9a46970, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1
	[0095.135] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9a92c30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9a92c30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 1
	[0095.136] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9a92c30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9a92c30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 0
	[0095.136] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0095.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0095.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0095.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0095.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0095.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0095.140] GetFileType (hFile=0x228) returned 0x1
	[0095.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0095.140] GetFileType (hFile=0x228) returned 0x1
	[0095.140] WriteFile (in: hFile=0x228, lpBuffer=0x26e2450*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26e2450*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0095.143] CloseHandle (hObject=0x228) returned 1
	[0095.144] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0095.145] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0
	[0095.145] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0095.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0095.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0095.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x56
	[0095.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x57
	[0095.146] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.147] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.148] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0095.148] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1
	[0095.149] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 1
	[0095.149] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1
	[0095.150] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9ab8d90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9ab8d90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1
	[0095.150] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0095.151] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.151] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0095.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0095.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0095.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0095.153] GetFileType (hFile=0x224) returned 0x1
	[0095.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0095.154] GetFileType (hFile=0x224) returned 0x1
	[0095.154] WriteFile (in: hFile=0x224, lpBuffer=0x26e7684*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26e7684*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0095.157] CloseHandle (hObject=0x224) returned 1
	[0095.157] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1
	[0095.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0095.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x52
	[0095.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpFilePart=0x0) returned 0x53
	[0095.158] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.159] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.160] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0095.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x56
	[0095.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpFilePart=0x0) returned 0x57
	[0095.161] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0095.161] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.162] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="65UX3YG0", cAlternateFileName="")) returned 1
	[0095.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", lpFilePart=0x0) returned 0x5f
	[0095.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\", lpFilePart=0x0) returned 0x60
	[0095.164] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.166] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.167] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.167] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", lpFilePart=0x0) returned 0x5f
	[0095.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\", lpFilePart=0x0) returned 0x60
	[0095.168] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.169] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.169] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.170] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Decrypt.txt", lpFilePart=0x0) returned 0x6b
	[0095.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0095.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\65ux3yg0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0095.171] GetFileType (hFile=0x22c) returned 0x1
	[0095.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0095.172] GetFileType (hFile=0x22c) returned 0x1
	[0095.172] WriteFile (in: hFile=0x22c, lpBuffer=0x26ed444*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26ed444*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.177] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AY721QDR", cAlternateFileName="")) returned 1
	[0095.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", lpFilePart=0x0) returned 0x5f
	[0095.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\", lpFilePart=0x0) returned 0x60
	[0095.178] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.179] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.180] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.180] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", lpFilePart=0x0) returned 0x5f
	[0095.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\", lpFilePart=0x0) returned 0x60
	[0095.181] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.182] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.182] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.183] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Decrypt.txt", lpFilePart=0x0) returned 0x6b
	[0095.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0095.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\ay721qdr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0095.184] GetFileType (hFile=0x22c) returned 0x1
	[0095.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0095.185] GetFileType (hFile=0x22c) returned 0x1
	[0095.185] WriteFile (in: hFile=0x22c, lpBuffer=0x26f1720*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26f1720*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.188] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DZBKZBIC", cAlternateFileName="")) returned 1
	[0095.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", lpFilePart=0x0) returned 0x5f
	[0095.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\", lpFilePart=0x0) returned 0x60
	[0095.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.189] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.190] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.190] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", lpFilePart=0x0) returned 0x5f
	[0095.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\", lpFilePart=0x0) returned 0x60
	[0095.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.191] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.192] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.192] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Decrypt.txt", lpFilePart=0x0) returned 0x6b
	[0095.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0095.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\dzbkzbic\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0095.194] GetFileType (hFile=0x22c) returned 0x1
	[0095.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0095.194] GetFileType (hFile=0x22c) returned 0x1
	[0095.194] WriteFile (in: hFile=0x22c, lpBuffer=0x26f59fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26f59fc*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.198] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0095.198] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 1
	[0095.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", lpFilePart=0x0) returned 0x5f
	[0095.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\", lpFilePart=0x0) returned 0x60
	[0095.199] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.200] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.200] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.201] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", lpFilePart=0x0) returned 0x5f
	[0095.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\", lpFilePart=0x0) returned 0x60
	[0095.201] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.202] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.203] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.203] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Decrypt.txt", lpFilePart=0x0) returned 0x6b
	[0095.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0095.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\vrlzoz0e\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0095.204] GetFileType (hFile=0x22c) returned 0x1
	[0095.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0095.205] GetFileType (hFile=0x22c) returned 0x1
	[0095.205] WriteFile (in: hFile=0x22c, lpBuffer=0x26f9eac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x26f9eac*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.208] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.208] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0095.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0095.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0095.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x56
	[0095.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpFilePart=0x0) returned 0x57
	[0095.209] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0095.209] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.211] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9b05050, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9b05050, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="65UX3YG0", cAlternateFileName="")) returned 1
	[0095.211] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AY721QDR", cAlternateFileName="")) returned 1
	[0095.211] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DZBKZBIC", cAlternateFileName="")) returned 1
	[0095.212] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0095.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat", lpFilePart=0x0) returned 0x60
	[0095.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0095.212] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0095.213] GetFileType (hFile=0x22c) returned 0x1
	[0095.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0095.213] GetFileType (hFile=0x22c) returned 0x1
	[0095.213] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x8000
	[0095.213] ReadFile (in: hFile=0x22c, lpBuffer=0x26fc620, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x26fc620*, lpNumberOfBytesRead=0x26eca4*=0x8000, lpOverlapped=0x0) returned 1
	[0095.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.KEKW", lpFilePart=0x0) returned 0x65
	[0095.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0095.218] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0095.223] GetFileType (hFile=0x22c) returned 0x1
	[0095.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0095.223] GetFileType (hFile=0x22c) returned 0x1
	[0095.224] WriteFile (in: hFile=0x22c, lpBuffer=0x2705d8c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x2705d8c*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0095.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat", lpFilePart=0x0) returned 0x60
	[0095.227] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\index.dat")) returned 1
	[0095.231] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9b51310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9b51310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 1
	[0095.231] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9b51310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9b51310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 0
	[0095.231] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0095.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0095.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0095.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0095.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0095.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0095.233] GetFileType (hFile=0x228) returned 0x1
	[0095.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0095.233] GetFileType (hFile=0x228) returned 0x1
	[0095.234] WriteFile (in: hFile=0x228, lpBuffer=0x2708740*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2708740*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0095.237] CloseHandle (hObject=0x228) returned 1
	[0095.237] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.237] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0095.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0095.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0095.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x52
	[0095.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpFilePart=0x0) returned 0x53
	[0095.238] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.239] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.239] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0095.240] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0095.240] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0095.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0095.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0095.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0095.242] GetFileType (hFile=0x224) returned 0x1
	[0095.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0095.243] GetFileType (hFile=0x224) returned 0x1
	[0095.243] WriteFile (in: hFile=0x224, lpBuffer=0x270bb7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x270bb7c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0095.246] CloseHandle (hObject=0x224) returned 1
	[0095.246] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.247] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x49
	[0095.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x4a
	[0095.248] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.249] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.249] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9adeef0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9adeef0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1
	[0095.250] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9bc3730, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9bc3730, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1
	[0095.250] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9bc3730, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9bc3730, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 0
	[0095.251] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0095.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.251] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.253] GetFileType (hFile=0x220) returned 0x1
	[0095.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0095.253] GetFileType (hFile=0x220) returned 0x1
	[0095.254] WriteFile (in: hFile=0x220, lpBuffer=0x270f078*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x270f078*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.258] CloseHandle (hObject=0x220) returned 1
	[0095.258] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1
	[0095.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x3b
	[0095.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\", lpFilePart=0x0) returned 0x3c
	[0095.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.260] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.261] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.261] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x3b
	[0095.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\", lpFilePart=0x0) returned 0x3c
	[0095.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.263] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.264] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.264] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0095.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\mmc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.265] GetFileType (hFile=0x220) returned 0x1
	[0095.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0095.266] GetFileType (hFile=0x220) returned 0x1
	[0095.266] WriteFile (in: hFile=0x220, lpBuffer=0x2712ad8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2712ad8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.271] CloseHandle (hObject=0x220) returned 1
	[0095.271] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1
	[0095.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x42
	[0095.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\", lpFilePart=0x0) returned 0x43
	[0095.272] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.275] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.276] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1
	[0095.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0095.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", lpFilePart=0x0) returned 0x45
	[0095.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\", lpFilePart=0x0) returned 0x46
	[0095.276] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.279] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.279] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0095.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", lpFilePart=0x0) returned 0x4a
	[0095.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\", lpFilePart=0x0) returned 0x4b
	[0095.280] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0095.282] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.283] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT", cAlternateFileName="")) returned 1
	[0095.284] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT", cAlternateFileName="")) returned 0
	[0095.284] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0095.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0095.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0095.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", lpFilePart=0x0) returned 0x4a
	[0095.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\", lpFilePart=0x0) returned 0x4b
	[0095.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0095.285] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.286] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT", cAlternateFileName="")) returned 1
	[0095.286] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.287] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0095.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0095.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0095.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0095.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0095.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0095.288] GetFileType (hFile=0x228) returned 0x1
	[0095.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0095.289] GetFileType (hFile=0x228) returned 0x1
	[0095.289] WriteFile (in: hFile=0x228, lpBuffer=0x27185dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27185dc*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0095.294] CloseHandle (hObject=0x228) returned 1
	[0095.295] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.295] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0095.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0095.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0095.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", lpFilePart=0x0) returned 0x45
	[0095.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\", lpFilePart=0x0) returned 0x46
	[0095.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.296] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.297] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x9c35b50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9c35b50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0095.298] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x9c35b50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9c35b50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0095.298] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0095.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0095.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0095.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0095.299] GetFileType (hFile=0x224) returned 0x1
	[0095.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0095.300] GetFileType (hFile=0x224) returned 0x1
	[0095.300] WriteFile (in: hFile=0x224, lpBuffer=0x271b85c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x271b85c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0095.304] CloseHandle (hObject=0x224) returned 1
	[0095.305] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.305] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x42
	[0095.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\", lpFilePart=0x0) returned 0x43
	[0095.309] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.310] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.311] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x9c35b50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9c35b50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1
	[0095.311] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x9c35b50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9c35b50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0
	[0095.311] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0095.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.313] GetFileType (hFile=0x220) returned 0x1
	[0095.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0095.313] GetFileType (hFile=0x220) returned 0x1
	[0095.314] WriteFile (in: hFile=0x220, lpBuffer=0x271ea70*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x271ea70*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.316] CloseHandle (hObject=0x220) returned 1
	[0095.317] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1
	[0095.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x3f
	[0095.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x40
	[0095.318] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.321] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.321] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1
	[0095.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0095.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x4b
	[0095.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x4c
	[0095.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.323] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.324] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pbk", cAlternateFileName="")) returned 1
	[0095.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x4f
	[0095.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpFilePart=0x0) returned 0x50
	[0095.325] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0095.326] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.326] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1
	[0095.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x5a
	[0095.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpFilePart=0x0) returned 0x5b
	[0095.327] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.328] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.328] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1
	[0095.329] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0
	[0095.329] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x5a
	[0095.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpFilePart=0x0) returned 0x5b
	[0095.330] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0095.331] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.331] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1
	[0095.332] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.332] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0095.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0095.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0095.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0095.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0095.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0095.334] GetFileType (hFile=0x22c) returned 0x1
	[0095.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0095.334] GetFileType (hFile=0x22c) returned 0x1
	[0095.335] WriteFile (in: hFile=0x22c, lpBuffer=0x2725784*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2725784*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.338] CloseHandle (hObject=0x22c) returned 1
	[0095.338] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.339] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0095.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0095.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0095.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x4f
	[0095.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpFilePart=0x0) returned 0x50
	[0095.339] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0095.340] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.341] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9c81e10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9c81e10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1
	[0095.341] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9c81e10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9c81e10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 0
	[0095.341] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0095.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0095.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0095.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0095.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0095.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0095.343] GetFileType (hFile=0x228) returned 0x1
	[0095.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0095.343] GetFileType (hFile=0x228) returned 0x1
	[0095.343] WriteFile (in: hFile=0x228, lpBuffer=0x2728bc8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2728bc8*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0095.346] CloseHandle (hObject=0x228) returned 1
	[0095.347] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.347] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0095.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0095.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0095.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x4b
	[0095.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x4c
	[0095.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.348] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.349] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9ca7f70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9ca7f70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pbk", cAlternateFileName="")) returned 1
	[0095.349] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9ca7f70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9ca7f70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pbk", cAlternateFileName="")) returned 0
	[0095.350] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0095.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0095.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Decrypt.txt", lpFilePart=0x0) returned 0x57
	[0095.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0095.352] GetFileType (hFile=0x224) returned 0x1
	[0095.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0095.352] GetFileType (hFile=0x224) returned 0x1
	[0095.352] WriteFile (in: hFile=0x224, lpBuffer=0x272bf04*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x272bf04*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0095.355] CloseHandle (hObject=0x224) returned 1
	[0095.355] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.356] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x3f
	[0095.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x40
	[0095.357] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.360] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0095.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.362] GetFileType (hFile=0x220) returned 0x1
	[0095.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0095.362] GetFileType (hFile=0x220) returned 0x1
	[0095.362] WriteFile (in: hFile=0x220, lpBuffer=0x272f128*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x272f128*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.365] CloseHandle (hObject=0x220) returned 1
	[0095.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x3e
	[0095.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x3f
	[0095.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0095.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x45
	[0095.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpFilePart=0x0) returned 0x46
	[0095.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.379] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0095.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0095.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0095.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x45
	[0095.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpFilePart=0x0) returned 0x46
	[0095.380] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat", lpFilePart=0x0) returned 0x4f
	[0095.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0095.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0095.384] GetFileType (hFile=0x228) returned 0x1
	[0095.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0095.384] GetFileType (hFile=0x228) returned 0x1
	[0095.384] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x34
	[0095.385] ReadFile (in: hFile=0x228, lpBuffer=0x2733238, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2733238*, lpNumberOfBytesRead=0x26ed44*=0x34, lpOverlapped=0x0) returned 1
	[0095.388] CloseHandle (hObject=0x228) returned 1
	[0095.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.KEKW", lpFilePart=0x0) returned 0x54
	[0095.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0095.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0095.389] GetFileType (hFile=0x228) returned 0x1
	[0095.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0095.390] GetFileType (hFile=0x228) returned 0x1
	[0095.390] WriteFile (in: hFile=0x228, lpBuffer=0x2735964*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2735964*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0095.394] CloseHandle (hObject=0x228) returned 1
	[0095.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat", lpFilePart=0x0) returned 0x4f
	[0095.394] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\index.dat")) returned 1
	[0095.397] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 1
	[0095.398] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.398] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0095.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0095.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0095.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0095.400] GetFileType (hFile=0x224) returned 0x1
	[0095.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0095.400] GetFileType (hFile=0x224) returned 0x1
	[0095.400] WriteFile (in: hFile=0x224, lpBuffer=0x2738518*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2738518*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0095.403] CloseHandle (hObject=0x224) returned 1
	[0095.403] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.404] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x3e
	[0095.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x3f
	[0095.405] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.405] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.406] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ce7b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f6ce7b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f6ce7b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1
	[0095.406] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x9d404f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9d404f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0095.407] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x9d404f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9d404f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 0
	[0095.407] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0095.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.409] GetFileType (hFile=0x220) returned 0x1
	[0095.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0095.409] GetFileType (hFile=0x220) returned 0x1
	[0095.409] WriteFile (in: hFile=0x220, lpBuffer=0x273ba9c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x273ba9c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.412] CloseHandle (hObject=0x220) returned 1
	[0095.413] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1
	[0095.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3f
	[0095.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x40
	[0095.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.416] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.417] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de69980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5de69980, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5e0c9040, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.srs", cAlternateFileName="")) returned 1
	[0095.417] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.xml", cAlternateFileName="")) returned 1
	[0095.418] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.xml", cAlternateFileName="")) returned 0
	[0095.418] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3f
	[0095.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x40
	[0095.419] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.420] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.421] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de69980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5de69980, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5e0c9040, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.srs", cAlternateFileName="")) returned 1
	[0095.421] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.xml", cAlternateFileName="")) returned 1
	[0095.421] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.422] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0095.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.423] GetFileType (hFile=0x220) returned 0x1
	[0095.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0095.424] GetFileType (hFile=0x220) returned 0x1
	[0095.424] WriteFile (in: hFile=0x220, lpBuffer=0x27400a8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27400a8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.427] CloseHandle (hObject=0x220) returned 1
	[0095.427] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1
	[0095.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", lpFilePart=0x0) returned 0x42
	[0095.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpFilePart=0x0) returned 0x43
	[0095.507] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.833] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.835] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.835] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", lpFilePart=0x0) returned 0x42
	[0095.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpFilePart=0x0) returned 0x43
	[0095.837] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.837] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.838] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.838] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.838] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0095.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.839] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\powerpoint\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.840] GetFileType (hFile=0x220) returned 0x1
	[0095.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0095.840] GetFileType (hFile=0x220) returned 0x1
	[0095.840] WriteFile (in: hFile=0x220, lpBuffer=0x2743cf8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2743cf8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.844] CloseHandle (hObject=0x220) returned 1
	[0095.845] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof", cAlternateFileName="")) returned 1
	[0095.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x3d
	[0095.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\", lpFilePart=0x0) returned 0x3e
	[0095.846] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.848] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.849] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.850] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x3d
	[0095.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\", lpFilePart=0x0) returned 0x3e
	[0095.850] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.851] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.851] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0095.851] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0095.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0095.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0095.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0095.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0095.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\proof\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0095.853] GetFileType (hFile=0x220) returned 0x1
	[0095.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0095.853] GetFileType (hFile=0x220) returned 0x1
	[0095.854] WriteFile (in: hFile=0x220, lpBuffer=0x27477d4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27477d4*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0095.856] CloseHandle (hObject=0x220) returned 1
	[0095.857] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1
	[0095.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0095.857] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x3f
	[0095.857] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x40
	[0095.857] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0095.858] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.858] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1
	[0095.858] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1
	[0095.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0095.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x6d
	[0095.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpFilePart=0x0) returned 0x6e
	[0095.859] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.864] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.864] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1
	[0095.864] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1
	[0095.864] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0
	[0095.864] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0095.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0095.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0095.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x6d
	[0095.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpFilePart=0x0) returned 0x6e
	[0095.868] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0095.871] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0095.871] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1
	[0095.871] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1
	[0095.872] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0095.872] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0095.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0095.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0095.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Decrypt.txt", lpFilePart=0x0) returned 0x79
	[0095.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0095.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0095.879] GetFileType (hFile=0x224) returned 0x1
	[0095.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0095.879] GetFileType (hFile=0x224) returned 0x1
	[0095.880] WriteFile (in: hFile=0x224, lpBuffer=0x274dc80*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x274dc80*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0096.182] CloseHandle (hObject=0x224) returned 1
	[0096.182] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x89f07f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x89f07f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~2")) returned 1
	[0096.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0096.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x6e
	[0096.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x6f
	[0096.183] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x89f07f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x89f07f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0096.184] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x89f07f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x89f07f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.184] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf923e050, ftCreationTime.dwHighDateTime=0x1d3aab9, ftLastAccessTime.dwLowDateTime=0xf923e050, ftLastAccessTime.dwHighDateTime=0x1d3aab9, ftLastWriteTime.dwLowDateTime=0xf923e050, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="02540a10-7eb7-4b20-a8c7-470f8986389c", cAlternateFileName="02540A~1")) returned 1
	[0096.184] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xdc5ea830, ftCreationTime.dwHighDateTime=0x1d41fce, ftLastAccessTime.dwLowDateTime=0xdc5ea830, ftLastAccessTime.dwHighDateTime=0x1d41fce, ftLastWriteTime.dwLowDateTime=0xdc5ea830, ftLastWriteTime.dwHighDateTime=0x1d41fce, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="0e15476d-d8fe-46ca-8099-ebdcf80f637c", cAlternateFileName="0E1547~1")) returned 1
	[0096.185] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6409280, ftCreationTime.dwHighDateTime=0x1d4ae2c, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="102a7bc8-3f85-4bb4-840a-38257d2965d2", cAlternateFileName="102A7B~1")) returned 1
	[0096.185] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542b0350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542b0350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x542b0350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="2be989a0-16a1-424b-9211-51aa3bb43e5d", cAlternateFileName="2BE989~1")) returned 1
	[0096.185] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x89f07f80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x89f07f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x89f07f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="915f9e3b-485d-4f89-a291-82a5ad3b0ee7", cAlternateFileName="915F9E~1")) returned 1
	[0096.185] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x17ffec90, ftCreationTime.dwHighDateTime=0x1d3373c, ftLastAccessTime.dwLowDateTime=0x17ffec90, ftLastAccessTime.dwHighDateTime=0x1d3373c, ftLastWriteTime.dwLowDateTime=0x18024df0, ftLastWriteTime.dwHighDateTime=0x1d3373c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="fbbe72db-afd8-443b-88dd-64b20388700d", cAlternateFileName="FBBE72~1")) returned 1
	[0096.185] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x89f54240, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1
	[0096.186] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x89f54240, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0
	[0096.186] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0096.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0096.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0096.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0096.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x6e
	[0096.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x6f
	[0096.187] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x89f07f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x89f07f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0096.187] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x89f07f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x89f07f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.188] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf923e050, ftCreationTime.dwHighDateTime=0x1d3aab9, ftLastAccessTime.dwLowDateTime=0xf923e050, ftLastAccessTime.dwHighDateTime=0x1d3aab9, ftLastWriteTime.dwLowDateTime=0xf923e050, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="02540a10-7eb7-4b20-a8c7-470f8986389c", cAlternateFileName="02540A~1")) returned 1
	[0096.188] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xdc5ea830, ftCreationTime.dwHighDateTime=0x1d41fce, ftLastAccessTime.dwLowDateTime=0xdc5ea830, ftLastAccessTime.dwHighDateTime=0x1d41fce, ftLastWriteTime.dwLowDateTime=0xdc5ea830, ftLastWriteTime.dwHighDateTime=0x1d41fce, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="0e15476d-d8fe-46ca-8099-ebdcf80f637c", cAlternateFileName="0E1547~1")) returned 1
	[0096.188] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6409280, ftCreationTime.dwHighDateTime=0x1d4ae2c, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="102a7bc8-3f85-4bb4-840a-38257d2965d2", cAlternateFileName="102A7B~1")) returned 1
	[0096.188] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542b0350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542b0350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x542b0350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="2be989a0-16a1-424b-9211-51aa3bb43e5d", cAlternateFileName="2BE989~1")) returned 1
	[0096.188] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x89f07f80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x89f07f80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x89f07f80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="915f9e3b-485d-4f89-a291-82a5ad3b0ee7", cAlternateFileName="915F9E~1")) returned 1
	[0096.189] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x17ffec90, ftCreationTime.dwHighDateTime=0x1d3373c, ftLastAccessTime.dwLowDateTime=0x17ffec90, ftLastAccessTime.dwHighDateTime=0x1d3373c, ftLastWriteTime.dwLowDateTime=0x18024df0, ftLastWriteTime.dwHighDateTime=0x1d3373c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="fbbe72db-afd8-443b-88dd-64b20388700d", cAlternateFileName="FBBE72~1")) returned 1
	[0096.189] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x89f54240, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1
	[0096.189] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0096.189] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0096.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0096.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0096.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Decrypt.txt", lpFilePart=0x0) returned 0x7a
	[0096.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0096.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0096.191] GetFileType (hFile=0x224) returned 0x1
	[0096.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0096.192] GetFileType (hFile=0x224) returned 0x1
	[0096.192] WriteFile (in: hFile=0x224, lpBuffer=0x2756650*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2756650*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0096.195] CloseHandle (hObject=0x224) returned 1
	[0096.195] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 1
	[0096.196] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 0
	[0096.196] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x3f
	[0096.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x40
	[0096.197] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.197] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.198] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1
	[0096.198] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa1b6e30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa1b6e30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1
	[0096.198] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa4b09b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa4b09b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~2")) returned 1
	[0096.198] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 1
	[0096.198] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0096.198] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0096.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0096.201] GetFileType (hFile=0x220) returned 0x1
	[0096.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0096.201] GetFileType (hFile=0x220) returned 0x1
	[0096.201] WriteFile (in: hFile=0x220, lpBuffer=0x275a440*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x275a440*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0096.204] CloseHandle (hObject=0x220) returned 1
	[0096.205] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0096.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x41
	[0096.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x42
	[0096.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.216] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.216] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0096.216] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x41
	[0096.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x42
	[0096.217] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.218] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.218] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0096.218] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0096.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0096.220] GetFileType (hFile=0x220) returned 0x1
	[0096.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0096.220] GetFileType (hFile=0x220) returned 0x1
	[0096.220] WriteFile (in: hFile=0x220, lpBuffer=0x275e034*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x275e034*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0096.223] CloseHandle (hObject=0x220) returned 1
	[0096.273] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1
	[0096.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpFilePart=0x0) returned 0x51
	[0096.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", lpFilePart=0x0) returned 0x52
	[0096.274] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.297] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.297] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 1
	[0096.298] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 0
	[0096.298] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpFilePart=0x0) returned 0x51
	[0096.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", lpFilePart=0x0) returned 0x52
	[0096.299] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.299] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.299] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 1
	[0096.300] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0096.300] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0096.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0096.302] GetFileType (hFile=0x220) returned 0x1
	[0096.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0096.302] GetFileType (hFile=0x220) returned 0x1
	[0096.302] WriteFile (in: hFile=0x220, lpBuffer=0x2762748*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2762748*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0096.305] CloseHandle (hObject=0x220) returned 1
	[0096.306] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1
	[0096.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x3e
	[0096.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\", lpFilePart=0x0) returned 0x3f
	[0096.306] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.307] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.307] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0096.308] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x3e
	[0096.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\", lpFilePart=0x0) returned 0x3f
	[0096.308] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.309] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.309] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0096.309] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0096.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\speech\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0096.311] GetFileType (hFile=0x220) returned 0x1
	[0096.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0096.311] GetFileType (hFile=0x220) returned 0x1
	[0096.320] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1
	[0096.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x4a
	[0096.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x4b
	[0096.320] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.322] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.322] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 1
	[0096.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0096.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x4d
	[0096.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpFilePart=0x0) returned 0x4e
	[0096.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0096.323] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.323] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1
	[0096.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x5a
	[0096.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpFilePart=0x0) returned 0x5b
	[0096.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0096.324] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.324] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0096.324] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0096.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0096.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0096.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x5a
	[0096.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpFilePart=0x0) returned 0x5b
	[0096.325] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0096.325] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.326] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0096.326] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0096.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0096.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0096.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0096.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0096.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0096.328] GetFileType (hFile=0x228) returned 0x1
	[0096.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0096.328] GetFileType (hFile=0x228) returned 0x1
	[0096.331] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLs", cAlternateFileName="")) returned 1
	[0096.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x52
	[0096.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpFilePart=0x0) returned 0x53
	[0096.332] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0096.332] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.332] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0096.333] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0096.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0096.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0096.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x52
	[0096.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpFilePart=0x0) returned 0x53
	[0096.338] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0096.338] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.338] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0096.339] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0096.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0096.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0096.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0096.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0096.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0096.340] GetFileType (hFile=0x228) returned 0x1
	[0096.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0096.341] GetFileType (hFile=0x228) returned 0x1
	[0096.344] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 1
	[0096.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x52
	[0096.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpFilePart=0x0) returned 0x53
	[0096.344] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0096.345] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.345] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0096.346] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0096.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0096.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0096.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x52
	[0096.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpFilePart=0x0) returned 0x53
	[0096.346] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0096.346] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.347] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0096.347] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0096.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0096.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0096.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0096.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0096.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0096.353] GetFileType (hFile=0x228) returned 0x1
	[0096.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0096.353] GetFileType (hFile=0x228) returned 0x1
	[0096.356] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0096.356] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0096.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0096.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0096.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0096.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x4d
	[0096.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpFilePart=0x0) returned 0x4e
	[0096.357] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0096.357] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.358] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa607610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa607610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1
	[0096.358] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa62d770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa62d770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLs", cAlternateFileName="")) returned 1
	[0096.358] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa62d770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa62d770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 1
	[0096.358] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa62d770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa62d770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 0
	[0096.358] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0096.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0096.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0096.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0096.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0096.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0096.360] GetFileType (hFile=0x224) returned 0x1
	[0096.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0096.360] GetFileType (hFile=0x224) returned 0x1
	[0096.363] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0096.363] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x4a
	[0096.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x4b
	[0096.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.371] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.371] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6538d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa6538d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 1
	[0096.371] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6538d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa6538d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 0
	[0096.371] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0096.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0096.373] GetFileType (hFile=0x220) returned 0x1
	[0096.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0096.373] GetFileType (hFile=0x220) returned 0x1
	[0096.376] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0096.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x41
	[0096.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", lpFilePart=0x0) returned 0x42
	[0096.376] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.379] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.379] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1
	[0096.379] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 0
	[0096.379] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x41
	[0096.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", lpFilePart=0x0) returned 0x42
	[0096.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.383] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.384] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1
	[0096.384] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0096.384] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0096.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0096.386] GetFileType (hFile=0x220) returned 0x1
	[0096.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0096.386] GetFileType (hFile=0x220) returned 0x1
	[0096.389] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UProof", cAlternateFileName="")) returned 1
	[0096.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x3e
	[0096.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", lpFilePart=0x0) returned 0x3f
	[0096.389] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.392] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.392] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1
	[0096.392] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0
	[0096.392] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x3e
	[0096.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", lpFilePart=0x0) returned 0x3f
	[0096.393] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.393] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.394] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1
	[0096.394] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0096.394] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0096.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0096.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0096.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0096.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0096.398] GetFileType (hFile=0x220) returned 0x1
	[0096.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0096.398] GetFileType (hFile=0x220) returned 0x1
	[0096.401] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0096.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0096.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x3f
	[0096.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x40
	[0096.402] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0096.402] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.402] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0096.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0096.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x47
	[0096.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpFilePart=0x0) returned 0x48
	[0096.403] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0096.403] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.403] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1
	[0096.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 1
	[0096.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 1
	[0096.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 1
	[0096.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1
	[0096.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1
	[0096.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 1
	[0096.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 1
	[0096.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe3e69e70, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0096.405] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0096.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x4b
	[0096.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpFilePart=0x0) returned 0x4c
	[0096.405] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0096.416] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.419] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 1
	[0096.419] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 1
	[0096.419] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 1
	[0096.419] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 1
	[0096.419] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 1
	[0096.420] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 1
	[0096.420] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 1
	[0096.420] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1
	[0096.420] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 1
	[0096.420] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 1
	[0096.420] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 1
	[0096.420] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1
	[0096.420] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 1
	[0096.420] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 1
	[0096.421] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 1
	[0096.421] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 1
	[0096.421] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 1
	[0096.421] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 1
	[0096.421] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 1
	[0096.421] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 1
	[0096.421] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1
	[0096.421] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 1
	[0096.421] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 1
	[0096.422] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 1
	[0096.422] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 1
	[0096.422] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 1
	[0096.422] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 1
	[0096.422] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0096.422] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0096.422] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0096.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0096.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0096.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0096.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x4b
	[0096.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\", lpFilePart=0x0) returned 0x4c
	[0096.425] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0096.469] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.470] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 1
	[0096.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x7c
	[0096.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.471] GetFileType (hFile=0x22c) returned 0x1
	[0096.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.471] GetFileType (hFile=0x22c) returned 0x1
	[0096.471] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x66
	[0096.472] ReadFile (in: hFile=0x22c, lpBuffer=0x278c914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x278c914*, lpNumberOfBytesRead=0x26eca4*=0x66, lpOverlapped=0x0) returned 1
	[0096.478] CloseHandle (hObject=0x22c) returned 1
	[0096.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.KEKW", lpFilePart=0x0) returned 0x81
	[0096.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.479] GetFileType (hFile=0x22c) returned 0x1
	[0096.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.480] GetFileType (hFile=0x22c) returned 0x1
	[0096.480] WriteFile (in: hFile=0x22c, lpBuffer=0x278f13c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x278f13c*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x7c
	[0096.484] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt")) returned 1
	[0096.487] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 1
	[0096.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x77
	[0096.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.488] GetFileType (hFile=0x22c) returned 0x1
	[0096.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.488] GetFileType (hFile=0x22c) returned 0x1
	[0096.489] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x66
	[0096.489] ReadFile (in: hFile=0x22c, lpBuffer=0x2790a90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x2790a90*, lpNumberOfBytesRead=0x26eca4*=0x66, lpOverlapped=0x0) returned 1
	[0096.492] CloseHandle (hObject=0x22c) returned 1
	[0096.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.KEKW", lpFilePart=0x0) returned 0x7c
	[0096.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.494] GetFileType (hFile=0x22c) returned 0x1
	[0096.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.494] GetFileType (hFile=0x22c) returned 0x1
	[0096.495] WriteFile (in: hFile=0x22c, lpBuffer=0x27932a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27932a0*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.498] CloseHandle (hObject=0x22c) returned 1
	[0096.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x77
	[0096.498] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt")) returned 1
	[0096.501] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 1
	[0096.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpFilePart=0x0) returned 0x71
	[0096.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.502] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.504] GetFileType (hFile=0x22c) returned 0x1
	[0096.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.504] GetFileType (hFile=0x22c) returned 0x1
	[0096.504] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x5d
	[0096.504] ReadFile (in: hFile=0x22c, lpBuffer=0x2794b6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x2794b6c*, lpNumberOfBytesRead=0x26eca4*=0x5d, lpOverlapped=0x0) returned 1
	[0096.508] CloseHandle (hObject=0x22c) returned 1
	[0096.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.KEKW", lpFilePart=0x0) returned 0x76
	[0096.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.509] GetFileType (hFile=0x22c) returned 0x1
	[0096.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.509] GetFileType (hFile=0x22c) returned 0x1
	[0096.509] WriteFile (in: hFile=0x22c, lpBuffer=0x2797358*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x2797358*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.512] CloseHandle (hObject=0x22c) returned 1
	[0096.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpFilePart=0x0) returned 0x71
	[0096.513] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt")) returned 1
	[0096.516] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 1
	[0096.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", lpFilePart=0x0) returned 0x6e
	[0096.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.517] GetFileType (hFile=0x22c) returned 0x1
	[0096.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.518] GetFileType (hFile=0x22c) returned 0x1
	[0096.518] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xea
	[0096.518] ReadFile (in: hFile=0x22c, lpBuffer=0x2798c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x2798c80*, lpNumberOfBytesRead=0x26eca4*=0xea, lpOverlapped=0x0) returned 1
	[0096.522] CloseHandle (hObject=0x22c) returned 1
	[0096.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.KEKW", lpFilePart=0x0) returned 0x73
	[0096.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.523] GetFileType (hFile=0x22c) returned 0x1
	[0096.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.523] GetFileType (hFile=0x22c) returned 0x1
	[0096.524] WriteFile (in: hFile=0x22c, lpBuffer=0x279b454*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x279b454*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.526] CloseHandle (hObject=0x22c) returned 1
	[0096.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", lpFilePart=0x0) returned 0x6e
	[0096.527] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt")) returned 1
	[0096.530] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 1
	[0096.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpFilePart=0x0) returned 0x6d
	[0096.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.532] GetFileType (hFile=0x22c) returned 0x1
	[0096.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.533] GetFileType (hFile=0x22c) returned 0x1
	[0096.533] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x242
	[0096.533] ReadFile (in: hFile=0x22c, lpBuffer=0x279ceb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x279ceb4*, lpNumberOfBytesRead=0x26eca4*=0x242, lpOverlapped=0x0) returned 1
	[0096.537] CloseHandle (hObject=0x22c) returned 1
	[0096.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.KEKW", lpFilePart=0x0) returned 0x72
	[0096.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.539] GetFileType (hFile=0x22c) returned 0x1
	[0096.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.540] GetFileType (hFile=0x22c) returned 0x1
	[0096.541] WriteFile (in: hFile=0x22c, lpBuffer=0x279f688*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x279f688*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.544] CloseHandle (hObject=0x22c) returned 1
	[0096.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpFilePart=0x0) returned 0x6d
	[0096.544] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt")) returned 1
	[0096.547] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 1
	[0096.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", lpFilePart=0x0) returned 0x6e
	[0096.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.549] GetFileType (hFile=0x22c) returned 0x1
	[0096.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.549] GetFileType (hFile=0x22c) returned 0x1
	[0096.549] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x65
	[0096.549] ReadFile (in: hFile=0x22c, lpBuffer=0x27a0f24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27a0f24*, lpNumberOfBytesRead=0x26eca4*=0x65, lpOverlapped=0x0) returned 1
	[0096.553] CloseHandle (hObject=0x22c) returned 1
	[0096.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.KEKW", lpFilePart=0x0) returned 0x73
	[0096.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.554] GetFileType (hFile=0x22c) returned 0x1
	[0096.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.555] GetFileType (hFile=0x22c) returned 0x1
	[0096.555] WriteFile (in: hFile=0x22c, lpBuffer=0x27a36f8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27a36f8*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.558] CloseHandle (hObject=0x22c) returned 1
	[0096.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", lpFilePart=0x0) returned 0x6e
	[0096.559] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt")) returned 1
	[0096.592] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 1
	[0096.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpFilePart=0x0) returned 0x6e
	[0096.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.593] GetFileType (hFile=0x22c) returned 0x1
	[0096.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.593] GetFileType (hFile=0x22c) returned 0x1
	[0096.593] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x52
	[0096.594] ReadFile (in: hFile=0x22c, lpBuffer=0x27a4f84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27a4f84*, lpNumberOfBytesRead=0x26eca4*=0x52, lpOverlapped=0x0) returned 1
	[0096.597] CloseHandle (hObject=0x22c) returned 1
	[0096.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.KEKW", lpFilePart=0x0) returned 0x73
	[0096.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.598] GetFileType (hFile=0x22c) returned 0x1
	[0096.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.599] GetFileType (hFile=0x22c) returned 0x1
	[0096.599] WriteFile (in: hFile=0x22c, lpBuffer=0x27a7758*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27a7758*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.603] CloseHandle (hObject=0x22c) returned 1
	[0096.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpFilePart=0x0) returned 0x6e
	[0096.603] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt")) returned 1
	[0096.606] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1
	[0096.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", lpFilePart=0x0) returned 0x73
	[0096.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.608] GetFileType (hFile=0x22c) returned 0x1
	[0096.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.608] GetFileType (hFile=0x22c) returned 0x1
	[0096.608] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x125
	[0096.608] ReadFile (in: hFile=0x22c, lpBuffer=0x27a90fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27a90fc*, lpNumberOfBytesRead=0x26eca4*=0x125, lpOverlapped=0x0) returned 1
	[0096.611] CloseHandle (hObject=0x22c) returned 1
	[0096.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.KEKW", lpFilePart=0x0) returned 0x78
	[0096.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.612] GetFileType (hFile=0x22c) returned 0x1
	[0096.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.613] GetFileType (hFile=0x22c) returned 0x1
	[0096.613] WriteFile (in: hFile=0x22c, lpBuffer=0x27ab8f4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27ab8f4*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.618] CloseHandle (hObject=0x22c) returned 1
	[0096.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", lpFilePart=0x0) returned 0x73
	[0096.618] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt")) returned 1
	[0096.621] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 1
	[0096.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpFilePart=0x0) returned 0x70
	[0096.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.624] GetFileType (hFile=0x22c) returned 0x1
	[0096.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.624] GetFileType (hFile=0x22c) returned 0x1
	[0096.624] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xdd
	[0096.624] ReadFile (in: hFile=0x22c, lpBuffer=0x27ad244, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27ad244*, lpNumberOfBytesRead=0x26eca4*=0xdd, lpOverlapped=0x0) returned 1
	[0096.627] CloseHandle (hObject=0x22c) returned 1
	[0096.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.KEKW", lpFilePart=0x0) returned 0x75
	[0096.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.629] GetFileType (hFile=0x22c) returned 0x1
	[0096.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.629] GetFileType (hFile=0x22c) returned 0x1
	[0096.630] WriteFile (in: hFile=0x22c, lpBuffer=0x27afa24*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27afa24*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.633] CloseHandle (hObject=0x22c) returned 1
	[0096.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpFilePart=0x0) returned 0x70
	[0096.633] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt")) returned 1
	[0096.636] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 1
	[0096.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpFilePart=0x0) returned 0x71
	[0096.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.637] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.637] GetFileType (hFile=0x22c) returned 0x1
	[0096.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.638] GetFileType (hFile=0x22c) returned 0x1
	[0096.638] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x201
	[0096.638] ReadFile (in: hFile=0x22c, lpBuffer=0x27b1498, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27b1498*, lpNumberOfBytesRead=0x26eca4*=0x201, lpOverlapped=0x0) returned 1
	[0096.642] CloseHandle (hObject=0x22c) returned 1
	[0096.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.KEKW", lpFilePart=0x0) returned 0x76
	[0096.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.643] GetFileType (hFile=0x22c) returned 0x1
	[0096.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.643] GetFileType (hFile=0x22c) returned 0x1
	[0096.643] WriteFile (in: hFile=0x22c, lpBuffer=0x27b3c84*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27b3c84*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.647] CloseHandle (hObject=0x22c) returned 1
	[0096.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpFilePart=0x0) returned 0x71
	[0096.647] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt")) returned 1
	[0096.651] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 1
	[0096.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", lpFilePart=0x0) returned 0x6c
	[0096.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.652] GetFileType (hFile=0x22c) returned 0x1
	[0096.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.652] GetFileType (hFile=0x22c) returned 0x1
	[0096.652] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x1ea
	[0096.653] ReadFile (in: hFile=0x22c, lpBuffer=0x27b568c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27b568c*, lpNumberOfBytesRead=0x26eca4*=0x1ea, lpOverlapped=0x0) returned 1
	[0096.656] CloseHandle (hObject=0x22c) returned 1
	[0096.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.KEKW", lpFilePart=0x0) returned 0x71
	[0096.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.657] GetFileType (hFile=0x22c) returned 0x1
	[0096.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.658] GetFileType (hFile=0x22c) returned 0x1
	[0096.658] WriteFile (in: hFile=0x22c, lpBuffer=0x27b7e54*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27b7e54*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.661] CloseHandle (hObject=0x22c) returned 1
	[0096.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", lpFilePart=0x0) returned 0x6c
	[0096.661] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt")) returned 1
	[0096.664] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1
	[0096.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpFilePart=0x0) returned 0x6e
	[0096.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.666] GetFileType (hFile=0x22c) returned 0x1
	[0096.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.666] GetFileType (hFile=0x22c) returned 0x1
	[0096.666] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x1c8
	[0096.667] ReadFile (in: hFile=0x22c, lpBuffer=0x27b9860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27b9860*, lpNumberOfBytesRead=0x26eca4*=0x1c8, lpOverlapped=0x0) returned 1
	[0096.670] CloseHandle (hObject=0x22c) returned 1
	[0096.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.KEKW", lpFilePart=0x0) returned 0x73
	[0096.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.671] GetFileType (hFile=0x22c) returned 0x1
	[0096.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.672] GetFileType (hFile=0x22c) returned 0x1
	[0096.672] WriteFile (in: hFile=0x22c, lpBuffer=0x27bc034*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27bc034*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.675] CloseHandle (hObject=0x22c) returned 1
	[0096.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpFilePart=0x0) returned 0x6e
	[0096.675] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt")) returned 1
	[0096.679] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 1
	[0096.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpFilePart=0x0) returned 0x6d
	[0096.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.682] GetFileType (hFile=0x22c) returned 0x1
	[0096.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.682] GetFileType (hFile=0x22c) returned 0x1
	[0096.682] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x82
	[0096.682] ReadFile (in: hFile=0x22c, lpBuffer=0x27bd8e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27bd8e8*, lpNumberOfBytesRead=0x26eca4*=0x82, lpOverlapped=0x0) returned 1
	[0096.686] CloseHandle (hObject=0x22c) returned 1
	[0096.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.KEKW", lpFilePart=0x0) returned 0x72
	[0096.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.687] GetFileType (hFile=0x22c) returned 0x1
	[0096.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.687] GetFileType (hFile=0x22c) returned 0x1
	[0096.688] WriteFile (in: hFile=0x22c, lpBuffer=0x27c00bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27c00bc*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.691] CloseHandle (hObject=0x22c) returned 1
	[0096.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpFilePart=0x0) returned 0x6d
	[0096.691] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt")) returned 1
	[0096.695] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 1
	[0096.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpFilePart=0x0) returned 0x73
	[0096.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.698] GetFileType (hFile=0x22c) returned 0x1
	[0096.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.698] GetFileType (hFile=0x22c) returned 0x1
	[0096.698] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x110
	[0096.699] ReadFile (in: hFile=0x22c, lpBuffer=0x27c1a44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27c1a44*, lpNumberOfBytesRead=0x26eca4*=0x110, lpOverlapped=0x0) returned 1
	[0096.702] CloseHandle (hObject=0x22c) returned 1
	[0096.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.KEKW", lpFilePart=0x0) returned 0x78
	[0096.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.703] GetFileType (hFile=0x22c) returned 0x1
	[0096.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.703] GetFileType (hFile=0x22c) returned 0x1
	[0096.704] WriteFile (in: hFile=0x22c, lpBuffer=0x27c423c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27c423c*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.707] CloseHandle (hObject=0x22c) returned 1
	[0096.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpFilePart=0x0) returned 0x73
	[0096.709] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt")) returned 1
	[0096.712] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 1
	[0096.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", lpFilePart=0x0) returned 0x6e
	[0096.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.713] GetFileType (hFile=0x22c) returned 0x1
	[0096.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.714] GetFileType (hFile=0x22c) returned 0x1
	[0096.714] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x256
	[0096.714] ReadFile (in: hFile=0x22c, lpBuffer=0x27c5cd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27c5cd4*, lpNumberOfBytesRead=0x26eca4*=0x256, lpOverlapped=0x0) returned 1
	[0096.720] CloseHandle (hObject=0x22c) returned 1
	[0096.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.KEKW", lpFilePart=0x0) returned 0x73
	[0096.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.722] GetFileType (hFile=0x22c) returned 0x1
	[0096.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.722] GetFileType (hFile=0x22c) returned 0x1
	[0096.722] WriteFile (in: hFile=0x22c, lpBuffer=0x27c84a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27c84a8*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.725] CloseHandle (hObject=0x22c) returned 1
	[0096.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", lpFilePart=0x0) returned 0x6e
	[0096.726] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt")) returned 1
	[0096.729] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 1
	[0096.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", lpFilePart=0x0) returned 0x6e
	[0096.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.730] GetFileType (hFile=0x22c) returned 0x1
	[0096.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.730] GetFileType (hFile=0x22c) returned 0x1
	[0096.730] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xc4
	[0096.730] ReadFile (in: hFile=0x22c, lpBuffer=0x27c9da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27c9da4*, lpNumberOfBytesRead=0x26eca4*=0xc4, lpOverlapped=0x0) returned 1
	[0096.733] CloseHandle (hObject=0x22c) returned 1
	[0096.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.KEKW", lpFilePart=0x0) returned 0x73
	[0096.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.734] GetFileType (hFile=0x22c) returned 0x1
	[0096.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.735] GetFileType (hFile=0x22c) returned 0x1
	[0096.735] WriteFile (in: hFile=0x22c, lpBuffer=0x27cc578*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27cc578*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.738] CloseHandle (hObject=0x22c) returned 1
	[0096.738] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", lpFilePart=0x0) returned 0x6e
	[0096.738] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt")) returned 1
	[0096.741] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 1
	[0096.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", lpFilePart=0x0) returned 0x6e
	[0096.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.742] GetFileType (hFile=0x22c) returned 0x1
	[0096.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.742] GetFileType (hFile=0x22c) returned 0x1
	[0096.742] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x21f
	[0096.742] ReadFile (in: hFile=0x22c, lpBuffer=0x27cdfd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27cdfd0*, lpNumberOfBytesRead=0x26eca4*=0x21f, lpOverlapped=0x0) returned 1
	[0096.745] CloseHandle (hObject=0x22c) returned 1
	[0096.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.KEKW", lpFilePart=0x0) returned 0x73
	[0096.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.746] GetFileType (hFile=0x22c) returned 0x1
	[0096.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.746] GetFileType (hFile=0x22c) returned 0x1
	[0096.747] WriteFile (in: hFile=0x22c, lpBuffer=0x27d07a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27d07a4*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", lpFilePart=0x0) returned 0x6e
	[0096.754] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt")) returned 1
	[0096.757] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 1
	[0096.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpFilePart=0x0) returned 0x70
	[0096.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.758] GetFileType (hFile=0x22c) returned 0x1
	[0096.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.759] GetFileType (hFile=0x22c) returned 0x1
	[0096.759] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x110
	[0096.759] ReadFile (in: hFile=0x22c, lpBuffer=0x27d210c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27d210c*, lpNumberOfBytesRead=0x26eca4*=0x110, lpOverlapped=0x0) returned 1
	[0096.762] CloseHandle (hObject=0x22c) returned 1
	[0096.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.KEKW", lpFilePart=0x0) returned 0x75
	[0096.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.763] GetFileType (hFile=0x22c) returned 0x1
	[0096.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.763] GetFileType (hFile=0x22c) returned 0x1
	[0096.763] WriteFile (in: hFile=0x22c, lpBuffer=0x27d48ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27d48ec*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpFilePart=0x0) returned 0x70
	[0096.767] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt")) returned 1
	[0096.770] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 1
	[0096.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpFilePart=0x0) returned 0x71
	[0096.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.771] GetFileType (hFile=0x22c) returned 0x1
	[0096.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.771] GetFileType (hFile=0x22c) returned 0x1
	[0096.771] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x76
	[0096.772] ReadFile (in: hFile=0x22c, lpBuffer=0x27d61d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27d61d8*, lpNumberOfBytesRead=0x26eca4*=0x76, lpOverlapped=0x0) returned 1
	[0096.775] CloseHandle (hObject=0x22c) returned 1
	[0096.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.KEKW", lpFilePart=0x0) returned 0x76
	[0096.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.775] GetFileType (hFile=0x22c) returned 0x1
	[0096.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.776] GetFileType (hFile=0x22c) returned 0x1
	[0096.776] WriteFile (in: hFile=0x22c, lpBuffer=0x27d89c4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27d89c4*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpFilePart=0x0) returned 0x71
	[0096.780] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt")) returned 1
	[0096.783] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 1
	[0096.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", lpFilePart=0x0) returned 0x6b
	[0096.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.784] GetFileType (hFile=0x22c) returned 0x1
	[0096.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.784] GetFileType (hFile=0x22c) returned 0x1
	[0096.784] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x337
	[0096.785] ReadFile (in: hFile=0x22c, lpBuffer=0x27da4fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27da4fc*, lpNumberOfBytesRead=0x26eca4*=0x337, lpOverlapped=0x0) returned 1
	[0096.789] CloseHandle (hObject=0x22c) returned 1
	[0096.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.KEKW", lpFilePart=0x0) returned 0x70
	[0096.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.790] GetFileType (hFile=0x22c) returned 0x1
	[0096.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.791] GetFileType (hFile=0x22c) returned 0x1
	[0096.791] WriteFile (in: hFile=0x22c, lpBuffer=0x27dccc4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27dccc4*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", lpFilePart=0x0) returned 0x6b
	[0096.794] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt")) returned 1
	[0096.797] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1
	[0096.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x79
	[0096.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.798] GetFileType (hFile=0x22c) returned 0x1
	[0096.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.798] GetFileType (hFile=0x22c) returned 0x1
	[0096.799] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xce
	[0096.799] ReadFile (in: hFile=0x22c, lpBuffer=0x27de668, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27de668*, lpNumberOfBytesRead=0x26eca4*=0xce, lpOverlapped=0x0) returned 1
	[0096.802] CloseHandle (hObject=0x22c) returned 1
	[0096.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.KEKW", lpFilePart=0x0) returned 0x7e
	[0096.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.803] GetFileType (hFile=0x22c) returned 0x1
	[0096.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.803] GetFileType (hFile=0x22c) returned 0x1
	[0096.804] WriteFile (in: hFile=0x22c, lpBuffer=0x27e0e84*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27e0e84*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x79
	[0096.806] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt")) returned 1
	[0096.810] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 1
	[0096.810] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpFilePart=0x0) returned 0x78
	[0096.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.811] GetFileType (hFile=0x22c) returned 0x1
	[0096.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.811] GetFileType (hFile=0x22c) returned 0x1
	[0096.811] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x6c
	[0096.811] ReadFile (in: hFile=0x22c, lpBuffer=0x27e27ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27e27ec*, lpNumberOfBytesRead=0x26eca4*=0x6c, lpOverlapped=0x0) returned 1
	[0096.814] CloseHandle (hObject=0x22c) returned 1
	[0096.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.KEKW", lpFilePart=0x0) returned 0x7d
	[0096.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.816] GetFileType (hFile=0x22c) returned 0x1
	[0096.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.816] GetFileType (hFile=0x22c) returned 0x1
	[0096.817] WriteFile (in: hFile=0x22c, lpBuffer=0x27e4ffc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27e4ffc*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpFilePart=0x0) returned 0x78
	[0096.820] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt")) returned 1
	[0096.823] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 1
	[0096.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpFilePart=0x0) returned 0x6f
	[0096.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.824] GetFileType (hFile=0x22c) returned 0x1
	[0096.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.824] GetFileType (hFile=0x22c) returned 0x1
	[0096.824] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x68
	[0096.825] ReadFile (in: hFile=0x22c, lpBuffer=0x27e68b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27e68b4*, lpNumberOfBytesRead=0x26eca4*=0x68, lpOverlapped=0x0) returned 1
	[0096.829] CloseHandle (hObject=0x22c) returned 1
	[0096.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.KEKW", lpFilePart=0x0) returned 0x74
	[0096.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.830] GetFileType (hFile=0x22c) returned 0x1
	[0096.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.831] GetFileType (hFile=0x22c) returned 0x1
	[0096.831] WriteFile (in: hFile=0x22c, lpBuffer=0x27e9094*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27e9094*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpFilePart=0x0) returned 0x6f
	[0096.838] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt")) returned 1
	[0096.841] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 1
	[0096.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpFilePart=0x0) returned 0x74
	[0096.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.842] GetFileType (hFile=0x22c) returned 0x1
	[0096.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.842] GetFileType (hFile=0x22c) returned 0x1
	[0096.843] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xb2
	[0096.843] ReadFile (in: hFile=0x22c, lpBuffer=0x27ea9f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27ea9f0*, lpNumberOfBytesRead=0x26eca4*=0xb2, lpOverlapped=0x0) returned 1
	[0096.846] CloseHandle (hObject=0x22c) returned 1
	[0096.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.KEKW", lpFilePart=0x0) returned 0x79
	[0096.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.849] GetFileType (hFile=0x22c) returned 0x1
	[0096.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.849] GetFileType (hFile=0x22c) returned 0x1
	[0096.849] WriteFile (in: hFile=0x22c, lpBuffer=0x27ed1e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27ed1e8*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpFilePart=0x0) returned 0x74
	[0096.852] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt")) returned 1
	[0096.856] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 1
	[0096.856] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpFilePart=0x0) returned 0x70
	[0096.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.857] GetFileType (hFile=0x22c) returned 0x1
	[0096.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.857] GetFileType (hFile=0x22c) returned 0x1
	[0096.857] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xd7
	[0096.857] ReadFile (in: hFile=0x22c, lpBuffer=0x27eeb34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27eeb34*, lpNumberOfBytesRead=0x26eca4*=0xd7, lpOverlapped=0x0) returned 1
	[0096.861] CloseHandle (hObject=0x22c) returned 1
	[0096.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.KEKW", lpFilePart=0x0) returned 0x75
	[0096.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.862] GetFileType (hFile=0x22c) returned 0x1
	[0096.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.862] GetFileType (hFile=0x22c) returned 0x1
	[0096.862] WriteFile (in: hFile=0x22c, lpBuffer=0x27f1314*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27f1314*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpFilePart=0x0) returned 0x70
	[0096.867] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt")) returned 1
	[0096.870] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 1
	[0096.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpFilePart=0x0) returned 0x74
	[0096.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.870] GetFileType (hFile=0x22c) returned 0x1
	[0096.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.871] GetFileType (hFile=0x22c) returned 0x1
	[0096.871] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xa9
	[0096.871] ReadFile (in: hFile=0x22c, lpBuffer=0x27f2c6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27f2c6c*, lpNumberOfBytesRead=0x26eca4*=0xa9, lpOverlapped=0x0) returned 1
	[0096.874] CloseHandle (hObject=0x22c) returned 1
	[0096.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.KEKW", lpFilePart=0x0) returned 0x79
	[0096.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.875] GetFileType (hFile=0x22c) returned 0x1
	[0096.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.875] GetFileType (hFile=0x22c) returned 0x1
	[0096.880] WriteFile (in: hFile=0x22c, lpBuffer=0x25f6a64*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x25f6a64*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.883] CloseHandle (hObject=0x22c) returned 1
	[0096.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpFilePart=0x0) returned 0x74
	[0096.883] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt")) returned 1
	[0096.887] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 1
	[0096.887] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpFilePart=0x0) returned 0x6f
	[0096.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.888] GetFileType (hFile=0x22c) returned 0x1
	[0096.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.888] GetFileType (hFile=0x22c) returned 0x1
	[0096.888] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x402
	[0096.888] ReadFile (in: hFile=0x22c, lpBuffer=0x25f86c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x25f86c4*, lpNumberOfBytesRead=0x26eca4*=0x402, lpOverlapped=0x0) returned 1
	[0096.895] CloseHandle (hObject=0x22c) returned 1
	[0096.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.KEKW", lpFilePart=0x0) returned 0x74
	[0096.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.896] GetFileType (hFile=0x22c) returned 0x1
	[0096.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.897] GetFileType (hFile=0x22c) returned 0x1
	[0096.897] WriteFile (in: hFile=0x22c, lpBuffer=0x25faea4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x25faea4*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.900] CloseHandle (hObject=0x22c) returned 1
	[0096.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpFilePart=0x0) returned 0x6f
	[0096.900] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt")) returned 1
	[0096.903] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0096.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat", lpFilePart=0x0) returned 0x55
	[0096.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0096.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.905] GetFileType (hFile=0x22c) returned 0x1
	[0096.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0096.905] GetFileType (hFile=0x22c) returned 0x1
	[0096.905] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x8000
	[0096.905] ReadFile (in: hFile=0x22c, lpBuffer=0x25fc50c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x25fc50c*, lpNumberOfBytesRead=0x26eca4*=0x8000, lpOverlapped=0x0) returned 1
	[0096.910] CloseHandle (hObject=0x22c) returned 1
	[0096.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat.KEKW", lpFilePart=0x0) returned 0x5a
	[0096.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0096.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0096.911] GetFileType (hFile=0x22c) returned 0x1
	[0096.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0096.912] GetFileType (hFile=0x22c) returned 0x1
	[0096.912] WriteFile (in: hFile=0x22c, lpBuffer=0x2605c50*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x2605c50*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0096.915] CloseHandle (hObject=0x22c) returned 1
	[0096.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat", lpFilePart=0x0) returned 0x55
	[0096.915] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\index.dat")) returned 1
	[0096.918] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0096.919] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0096.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0096.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0096.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0x57
	[0096.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0096.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0096.920] GetFileType (hFile=0x228) returned 0x1
	[0096.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0096.920] GetFileType (hFile=0x228) returned 0x1
	[0096.920] WriteFile (in: hFile=0x228, lpBuffer=0x26083d0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26083d0*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0096.923] CloseHandle (hObject=0x228) returned 1
	[0096.923] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0096.924] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0096.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0096.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0096.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0096.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x47
	[0096.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpFilePart=0x0) returned 0x48
	[0096.925] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0096.925] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0096.925] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1
	[0096.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", lpFilePart=0x0) returned 0x69
	[0096.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0096.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0096.927] GetFileType (hFile=0x228) returned 0x1
	[0096.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0096.928] GetFileType (hFile=0x228) returned 0x1
	[0096.928] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x53
	[0096.928] ReadFile (in: hFile=0x228, lpBuffer=0x260a59c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x260a59c*, lpNumberOfBytesRead=0x26ed44*=0x53, lpOverlapped=0x0) returned 1
	[0096.931] CloseHandle (hObject=0x228) returned 1
	[0096.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.KEKW", lpFilePart=0x0) returned 0x6e
	[0096.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0096.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0096.933] GetFileType (hFile=0x228) returned 0x1
	[0096.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0096.933] GetFileType (hFile=0x228) returned 0x1
	[0096.934] WriteFile (in: hFile=0x228, lpBuffer=0x260cd60*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x260cd60*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0096.937] CloseHandle (hObject=0x228) returned 1
	[0096.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", lpFilePart=0x0) returned 0x69
	[0096.937] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt")) returned 1
	[0096.940] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 1
	[0096.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", lpFilePart=0x0) returned 0x69
	[0096.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0096.941] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0096.944] GetFileType (hFile=0x228) returned 0x1
	[0096.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0096.944] GetFileType (hFile=0x228) returned 0x1
	[0096.944] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x227
	[0096.944] ReadFile (in: hFile=0x228, lpBuffer=0x260e768, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x260e768*, lpNumberOfBytesRead=0x26ed44*=0x227, lpOverlapped=0x0) returned 1
	[0096.947] CloseHandle (hObject=0x228) returned 1
	[0096.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.KEKW", lpFilePart=0x0) returned 0x6e
	[0096.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0096.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0096.949] GetFileType (hFile=0x228) returned 0x1
	[0096.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0096.949] GetFileType (hFile=0x228) returned 0x1
	[0096.950] WriteFile (in: hFile=0x228, lpBuffer=0x2610f2c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2610f2c*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0096.953] CloseHandle (hObject=0x228) returned 1
	[0096.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", lpFilePart=0x0) returned 0x69
	[0096.953] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt")) returned 1
	[0096.956] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 1
	[0096.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", lpFilePart=0x0) returned 0x6a
	[0096.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0096.958] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0096.960] GetFileType (hFile=0x228) returned 0x1
	[0096.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0096.960] GetFileType (hFile=0x228) returned 0x1
	[0096.960] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xf1
	[0096.961] ReadFile (in: hFile=0x228, lpBuffer=0x261281c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x261281c*, lpNumberOfBytesRead=0x26ed44*=0xf1, lpOverlapped=0x0) returned 1
	[0096.963] CloseHandle (hObject=0x228) returned 1
	[0096.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.KEKW", lpFilePart=0x0) returned 0x6f
	[0096.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0096.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0096.965] GetFileType (hFile=0x228) returned 0x1
	[0096.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0096.966] GetFileType (hFile=0x228) returned 0x1
	[0096.966] WriteFile (in: hFile=0x228, lpBuffer=0x2614fe0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2614fe0*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0096.969] CloseHandle (hObject=0x228) returned 1
	[0096.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", lpFilePart=0x0) returned 0x6a
	[0096.969] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt")) returned 1
	[0096.972] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 1
	[0096.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpFilePart=0x0) returned 0x6e
	[0096.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0096.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0096.973] GetFileType (hFile=0x228) returned 0x1
	[0096.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0096.974] GetFileType (hFile=0x228) returned 0x1
	[0096.974] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x6f
	[0096.974] ReadFile (in: hFile=0x228, lpBuffer=0x26168a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26168a0*, lpNumberOfBytesRead=0x26ed44*=0x6f, lpOverlapped=0x0) returned 1
	[0096.977] CloseHandle (hObject=0x228) returned 1
	[0096.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.KEKW", lpFilePart=0x0) returned 0x73
	[0096.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0096.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0096.978] GetFileType (hFile=0x228) returned 0x1
	[0096.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0096.979] GetFileType (hFile=0x228) returned 0x1
	[0096.979] WriteFile (in: hFile=0x228, lpBuffer=0x261907c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x261907c*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0096.982] CloseHandle (hObject=0x228) returned 1
	[0096.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpFilePart=0x0) returned 0x6e
	[0096.983] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt")) returned 1
	[0096.986] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1
	[0096.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpFilePart=0x0) returned 0x6f
	[0096.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0096.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0096.987] GetFileType (hFile=0x228) returned 0x1
	[0096.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0096.987] GetFileType (hFile=0x228) returned 0x1
	[0096.988] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x6e
	[0096.988] ReadFile (in: hFile=0x228, lpBuffer=0x261a938, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x261a938*, lpNumberOfBytesRead=0x26ed44*=0x6e, lpOverlapped=0x0) returned 1
	[0096.991] CloseHandle (hObject=0x228) returned 1
	[0096.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.KEKW", lpFilePart=0x0) returned 0x74
	[0096.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0096.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0096.993] GetFileType (hFile=0x228) returned 0x1
	[0096.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0096.993] GetFileType (hFile=0x228) returned 0x1
	[0096.993] WriteFile (in: hFile=0x228, lpBuffer=0x261d120*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x261d120*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0096.996] CloseHandle (hObject=0x228) returned 1
	[0096.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpFilePart=0x0) returned 0x6f
	[0096.996] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt")) returned 1
	[0097.000] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1
	[0097.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", lpFilePart=0x0) returned 0x6a
	[0097.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0097.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0097.003] GetFileType (hFile=0x228) returned 0x1
	[0097.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0097.003] GetFileType (hFile=0x228) returned 0x1
	[0097.004] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x114
	[0097.004] ReadFile (in: hFile=0x228, lpBuffer=0x261ea3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x261ea3c*, lpNumberOfBytesRead=0x26ed44*=0x114, lpOverlapped=0x0) returned 1
	[0097.008] CloseHandle (hObject=0x228) returned 1
	[0097.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.KEKW", lpFilePart=0x0) returned 0x6f
	[0097.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0097.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0097.009] GetFileType (hFile=0x228) returned 0x1
	[0097.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0097.010] GetFileType (hFile=0x228) returned 0x1
	[0097.010] WriteFile (in: hFile=0x228, lpBuffer=0x2621200*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2621200*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0097.013] CloseHandle (hObject=0x228) returned 1
	[0097.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", lpFilePart=0x0) returned 0x6a
	[0097.013] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt")) returned 1
	[0097.016] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 1
	[0097.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", lpFilePart=0x0) returned 0x69
	[0097.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0097.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0097.018] GetFileType (hFile=0x228) returned 0x1
	[0097.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0097.018] GetFileType (hFile=0x228) returned 0x1
	[0097.019] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x56
	[0097.019] ReadFile (in: hFile=0x228, lpBuffer=0x2622a3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2622a3c*, lpNumberOfBytesRead=0x26ed44*=0x56, lpOverlapped=0x0) returned 1
	[0097.023] CloseHandle (hObject=0x228) returned 1
	[0097.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.KEKW", lpFilePart=0x0) returned 0x6e
	[0097.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0097.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0097.025] GetFileType (hFile=0x228) returned 0x1
	[0097.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0097.025] GetFileType (hFile=0x228) returned 0x1
	[0097.025] WriteFile (in: hFile=0x228, lpBuffer=0x2625200*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2625200*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0097.029] CloseHandle (hObject=0x228) returned 1
	[0097.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", lpFilePart=0x0) returned 0x69
	[0097.029] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt")) returned 1
	[0097.032] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 1
	[0097.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpFilePart=0x0) returned 0x69
	[0097.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0097.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0097.034] GetFileType (hFile=0x228) returned 0x1
	[0097.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0097.034] GetFileType (hFile=0x228) returned 0x1
	[0097.035] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x19e
	[0097.035] ReadFile (in: hFile=0x228, lpBuffer=0x2626b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2626b80*, lpNumberOfBytesRead=0x26ed44*=0x19e, lpOverlapped=0x0) returned 1
	[0097.038] CloseHandle (hObject=0x228) returned 1
	[0097.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.KEKW", lpFilePart=0x0) returned 0x6e
	[0097.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0097.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0097.041] GetFileType (hFile=0x228) returned 0x1
	[0097.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0097.041] GetFileType (hFile=0x228) returned 0x1
	[0097.041] WriteFile (in: hFile=0x228, lpBuffer=0x2629344*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2629344*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0097.044] CloseHandle (hObject=0x228) returned 1
	[0097.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpFilePart=0x0) returned 0x69
	[0097.044] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt")) returned 1
	[0097.047] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe3e69e70, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0097.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", lpFilePart=0x0) returned 0x51
	[0097.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0097.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0097.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dac8) returned 1
	[0097.054] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xabaea50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xabaea50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0097.054] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xabaea50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xabaea50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0097.055] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0097.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.057] GetFileType (hFile=0x224) returned 0x1
	[0097.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.057] GetFileType (hFile=0x224) returned 0x1
	[0097.057] WriteFile (in: hFile=0x224, lpBuffer=0x262c71c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x262c71c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0097.061] CloseHandle (hObject=0x224) returned 1
	[0097.061] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1
	[0097.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x4d
	[0097.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", lpFilePart=0x0) returned 0x4e
	[0097.062] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.063] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.064] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0097.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x51
	[0097.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", lpFilePart=0x0) returned 0x52
	[0097.065] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.066] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.067] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0097.068] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0097.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0097.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0097.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x51
	[0097.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", lpFilePart=0x0) returned 0x52
	[0097.069] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.069] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.070] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0097.070] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0097.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0097.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0097.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0097.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0097.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\iecompatcache\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0097.072] GetFileType (hFile=0x228) returned 0x1
	[0097.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0097.072] GetFileType (hFile=0x228) returned 0x1
	[0097.072] WriteFile (in: hFile=0x228, lpBuffer=0x2631364*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2631364*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0097.075] CloseHandle (hObject=0x228) returned 1
	[0097.076] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.076] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x4d
	[0097.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", lpFilePart=0x0) returned 0x4e
	[0097.077] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.078] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.078] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xad2b810, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xad2b810, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0097.079] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xad2b810, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xad2b810, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0097.080] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0097.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\iecompatcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.081] GetFileType (hFile=0x224) returned 0x1
	[0097.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.082] GetFileType (hFile=0x224) returned 0x1
	[0097.083] WriteFile (in: hFile=0x224, lpBuffer=0x26346e4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26346e4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0097.087] CloseHandle (hObject=0x224) returned 1
	[0097.087] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1
	[0097.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x4a
	[0097.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", lpFilePart=0x0) returned 0x4b
	[0097.088] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.089] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.090] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb1912e90, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0097.090] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0097.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.091] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x4e
	[0097.091] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", lpFilePart=0x0) returned 0x4f
	[0097.091] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.092] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.093] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0097.093] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0097.094] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0097.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0097.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0097.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x4e
	[0097.095] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", lpFilePart=0x0) returned 0x4f
	[0097.095] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.095] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.096] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0097.097] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat", lpFilePart=0x0) returned 0x58
	[0097.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0097.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0097.097] GetFileType (hFile=0x22c) returned 0x1
	[0097.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0097.098] GetFileType (hFile=0x22c) returned 0x1
	[0097.098] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x40000
	[0097.102] ReadFile (in: hFile=0x22c, lpBuffer=0x3722228, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x3722228*, lpNumberOfBytesRead=0x26eca4*=0x40000, lpOverlapped=0x0) returned 1
	[0097.133] CloseHandle (hObject=0x22c) returned 1
	[0097.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat.KEKW", lpFilePart=0x0) returned 0x5d
	[0097.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0097.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0097.134] GetFileType (hFile=0x22c) returned 0x1
	[0097.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0097.135] GetFileType (hFile=0x22c) returned 0x1
	[0097.135] WriteFile (in: hFile=0x22c, lpBuffer=0x2639ba4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x2639ba4*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0097.138] CloseHandle (hObject=0x22c) returned 1
	[0097.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat", lpFilePart=0x0) returned 0x58
	[0097.138] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\index.dat")) returned 1
	[0097.146] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.147] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0097.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0097.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0097.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0097.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0097.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0097.148] GetFileType (hFile=0x228) returned 0x1
	[0097.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0097.149] GetFileType (hFile=0x228) returned 0x1
	[0097.149] WriteFile (in: hFile=0x228, lpBuffer=0x263c33c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x263c33c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0097.152] CloseHandle (hObject=0x228) returned 1
	[0097.152] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.153] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x4a
	[0097.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", lpFilePart=0x0) returned 0x4b
	[0097.153] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.154] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.155] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb1912e90, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0097.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", lpFilePart=0x0) returned 0x54
	[0097.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0097.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0097.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dac8) returned 1
	[0097.160] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xade9ef0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xade9ef0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0097.161] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xade9ef0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xade9ef0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0097.161] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0097.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.163] GetFileType (hFile=0x224) returned 0x1
	[0097.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.163] GetFileType (hFile=0x224) returned 0x1
	[0097.163] WriteFile (in: hFile=0x224, lpBuffer=0x2640158*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2640158*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0097.166] CloseHandle (hObject=0x224) returned 1
	[0097.167] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1
	[0097.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x49
	[0097.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpFilePart=0x0) returned 0x4a
	[0097.168] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.168] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.169] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0097.170] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d1e12e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1
	[0097.170] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1
	[0097.171] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe23, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1
	[0097.172] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1
	[0097.172] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0
	[0097.173] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x49
	[0097.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpFilePart=0x0) returned 0x4a
	[0097.173] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.174] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.175] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0097.177] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d1e12e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1
	[0097.178] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1
	[0097.178] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe23, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1
	[0097.179] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1
	[0097.179] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.179] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0097.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.183] GetFileType (hFile=0x224) returned 0x1
	[0097.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.183] GetFileType (hFile=0x224) returned 0x1
	[0097.184] WriteFile (in: hFile=0x224, lpBuffer=0x2646078*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2646078*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0097.187] CloseHandle (hObject=0x224) returned 1
	[0097.188] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1
	[0097.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x51
	[0097.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpFilePart=0x0) returned 0x52
	[0097.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.190] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.191] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0097.192] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x51
	[0097.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpFilePart=0x0) returned 0x52
	[0097.192] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.193] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.194] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0097.194] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0097.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\network shortcuts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.196] GetFileType (hFile=0x224) returned 0x1
	[0097.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.196] GetFileType (hFile=0x224) returned 0x1
	[0097.196] WriteFile (in: hFile=0x224, lpBuffer=0x264a03c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x264a03c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0097.199] CloseHandle (hObject=0x224) returned 1
	[0097.199] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1
	[0097.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x51
	[0097.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpFilePart=0x0) returned 0x52
	[0097.200] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.201] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.201] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0097.202] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x51
	[0097.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpFilePart=0x0) returned 0x52
	[0097.203] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.203] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.204] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0097.204] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0097.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\printer shortcuts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.209] GetFileType (hFile=0x224) returned 0x1
	[0097.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.209] GetFileType (hFile=0x224) returned 0x1
	[0097.209] WriteFile (in: hFile=0x224, lpBuffer=0x264e000*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x264e000*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0097.213] CloseHandle (hObject=0x224) returned 1
	[0097.214] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1
	[0097.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x48
	[0097.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpFilePart=0x0) returned 0x49
	[0097.215] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.216] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.217] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x94fde710, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0097.218] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0097.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x4c
	[0097.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", lpFilePart=0x0) returned 0x4d
	[0097.218] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.219] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.220] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0097.221] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0097.221] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0097.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0097.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0097.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x4c
	[0097.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", lpFilePart=0x0) returned 0x4d
	[0097.227] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.228] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.228] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0097.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat", lpFilePart=0x0) returned 0x56
	[0097.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0097.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0097.229] GetFileType (hFile=0x22c) returned 0x1
	[0097.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0097.229] GetFileType (hFile=0x22c) returned 0x1
	[0097.230] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x1c000
	[0097.231] ReadFile (in: hFile=0x22c, lpBuffer=0x3762248, nNumberOfBytesToRead=0x1c000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x3762248*, lpNumberOfBytesRead=0x26eca4*=0x1c000, lpOverlapped=0x0) returned 1
	[0097.241] CloseHandle (hObject=0x22c) returned 1
	[0097.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat.KEKW", lpFilePart=0x0) returned 0x5b
	[0097.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0097.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0097.243] GetFileType (hFile=0x22c) returned 0x1
	[0097.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0097.243] GetFileType (hFile=0x22c) returned 0x1
	[0097.244] WriteFile (in: hFile=0x22c, lpBuffer=0x26533c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x26533c0*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0097.247] CloseHandle (hObject=0x22c) returned 1
	[0097.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat", lpFilePart=0x0) returned 0x56
	[0097.247] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\index.dat")) returned 1
	[0097.252] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.253] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0097.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0097.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0097.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0x58
	[0097.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0097.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0097.254] GetFileType (hFile=0x228) returned 0x1
	[0097.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0097.254] GetFileType (hFile=0x228) returned 0x1
	[0097.255] WriteFile (in: hFile=0x228, lpBuffer=0x2655b4c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2655b4c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0097.258] CloseHandle (hObject=0x228) returned 1
	[0097.258] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.258] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x48
	[0097.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpFilePart=0x0) returned 0x49
	[0097.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.260] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.260] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x94fde710, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0097.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat", lpFilePart=0x0) returned 0x52
	[0097.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0097.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0097.263] GetFileType (hFile=0x228) returned 0x1
	[0097.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0097.263] GetFileType (hFile=0x228) returned 0x1
	[0097.263] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x8000
	[0097.264] ReadFile (in: hFile=0x228, lpBuffer=0x2657b48, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2657b48*, lpNumberOfBytesRead=0x26ed44*=0x8000, lpOverlapped=0x0) returned 1
	[0097.268] CloseHandle (hObject=0x228) returned 1
	[0097.268] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat.KEKW", lpFilePart=0x0) returned 0x57
	[0097.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0097.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0097.270] GetFileType (hFile=0x228) returned 0x1
	[0097.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0097.270] GetFileType (hFile=0x228) returned 0x1
	[0097.270] WriteFile (in: hFile=0x228, lpBuffer=0x266127c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x266127c*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0097.274] CloseHandle (hObject=0x228) returned 1
	[0097.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat", lpFilePart=0x0) returned 0x52
	[0097.274] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")) returned 1
	[0097.278] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaef4890, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xaef4890, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0097.278] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaef4890, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xaef4890, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0097.279] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0097.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.280] GetFileType (hFile=0x224) returned 0x1
	[0097.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.281] GetFileType (hFile=0x224) returned 0x1
	[0097.281] WriteFile (in: hFile=0x224, lpBuffer=0x2663b7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2663b7c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0097.284] CloseHandle (hObject=0x224) returned 1
	[0097.284] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe3ab3380, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3ab3380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0097.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x46
	[0097.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpFilePart=0x0) returned 0x47
	[0097.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe3ab3380, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3ab3380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.286] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe3ab3380, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3ab3380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.286] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe26e9ca0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe26e9ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe26e9ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="-lT9_uq1-.flv.lnk", cAlternateFileName="-LT9_U~1.LNK")) returned 1
	[0097.287] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bf620, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe35320a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe35320a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x973, dwReserved0=0x0, dwReserved1=0x0, cFileName="-UucLCm.lnk", cAlternateFileName="")) returned 1
	[0097.288] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe39ceb40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe39ceb40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe39ceb40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x302, dwReserved0=0x0, dwReserved1=0x0, cFileName="0EbWXe73.lnk", cAlternateFileName="")) returned 1
	[0097.288] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f3e9a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2f3e9a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe30231e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x99d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0GJPN.flv.lnk", cAlternateFileName="0GJPNF~1.LNK")) returned 1
	[0097.289] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1b752c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1b752c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1b752c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa46, dwReserved0=0x0, dwReserved1=0x0, cFileName="0kI16qGYKIWr.lnk", cAlternateFileName="0KI16Q~1.LNK")) returned 1
	[0097.290] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38ea300, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe38ea300, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe38ea300, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x0, cFileName="288dXqBRqJ dmG.lnk", cAlternateFileName="288DXQ~1.LNK")) returned 1
	[0097.290] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe36168e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe36168e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe36168e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x0, dwReserved1=0x0, cFileName="2IWp.lnk", cAlternateFileName="")) returned 1
	[0097.291] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2735f60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2735f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2735f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="2wb0k9funFxm5A6aGy.lnk", cAlternateFileName="2WB0K9~1.LNK")) returned 1
	[0097.291] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b605e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b605e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2b605e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="4R3h1Iwy.lnk", cAlternateFileName="")) returned 1
	[0097.292] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b86740, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b86740, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2b86740, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x153b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4s41QTR7ma-8YN84zJ3G.lnk", cAlternateFileName="4S41QT~1.LNK")) returned 1
	[0097.292] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1477220, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1477220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe149d380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x0, dwReserved1=0x0, cFileName="5pyJ_ 12qn1vPLhsv.lnk", cAlternateFileName="5PYJ_1~1.LNK")) returned 1
	[0097.293] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a09980, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2a09980, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2a09980, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5QlA2SuSZH92 L9.lnk", cAlternateFileName="5QLA2S~1.LNK")) returned 1
	[0097.294] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1febc00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1febc00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1febc00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="5wJxRKjMWEP.lnk", cAlternateFileName="5WJXRK~1.LNK")) returned 1
	[0097.294] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d29660, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2d29660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2d29660, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="6z0nNXnW.flv.lnk", cAlternateFileName="6Z0NNX~1.LNK")) returned 1
	[0097.295] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0ea9c80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe35ca620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe35ca620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xee7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8alGuK51aX.lnk", cAlternateFileName="8ALGUK~1.LNK")) returned 1
	[0097.295] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2651720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2651720, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2651720, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="8wxu8xYGDCdlbG.lnk", cAlternateFileName="8WXU8X~1.LNK")) returned 1
	[0097.296] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe294b2a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe294b2a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe294b2a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="8y2wDARL3.lnk", cAlternateFileName="8Y2WDA~1.LNK")) returned 1
	[0097.297] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3049340, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3049340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3049340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x0, cFileName="9x49PM1E8xONjF84kJ.lnk", cAlternateFileName="9X49PM~1.LNK")) returned 1
	[0097.297] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe35f0780, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe35f0780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe35f0780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ad_8oHDleju7gjQPCKa.lnk", cAlternateFileName="AD_8OH~1.LNK")) returned 1
	[0097.298] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1
	[0097.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x5c
	[0097.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpFilePart=0x0) returned 0x5d
	[0097.298] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.299] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.301] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe2d4e050, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1
	[0097.302] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80e1f4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1
	[0097.302] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 1
	[0097.303] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 0
	[0097.303] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0097.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0097.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0097.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x5c
	[0097.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpFilePart=0x0) returned 0x5d
	[0097.304] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.305] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.306] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe2d4e050, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1
	[0097.306] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80e1f4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1
	[0097.307] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 1
	[0097.307] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.308] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0097.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0097.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0097.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0097.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0097.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0097.310] GetFileType (hFile=0x228) returned 0x1
	[0097.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0097.311] GetFileType (hFile=0x228) returned 0x1
	[0097.311] WriteFile (in: hFile=0x228, lpBuffer=0x266ca7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x266ca7c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0097.314] CloseHandle (hObject=0x228) returned 1
	[0097.314] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23f0120, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe23f0120, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe23f0120, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="b-sZVFKr0qE.lnk", cAlternateFileName="B-SZVF~1.LNK")) returned 1
	[0097.315] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe218eb20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe218eb20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe218eb20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a77, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDSaBnCNcG.lnk", cAlternateFileName="BDSABN~1.LNK")) returned 1
	[0097.316] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2416280, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2416280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2416280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brGd.lnk", cAlternateFileName="")) returned 1
	[0097.316] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d9ba80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3a8d220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3a8d220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x96a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bWJnkhq1ltM.lnk", cAlternateFileName="BWJNKH~1.LNK")) returned 1
	[0097.317] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34015a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe34015a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe34015a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x23e, dwReserved0=0x0, dwReserved1=0x0, cFileName="bzV6a5Pfe.flv.lnk", cAlternateFileName="BZV6A5~1.LNK")) returned 1
	[0097.317] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3851d80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3851d80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3851d80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="C-RcLTpgwLsTNOwu1.lnk", cAlternateFileName="C-RCLT~1.LNK")) returned 1
	[0097.318] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38c41a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe38c41a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe38c41a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdnV4kPFNd2c.flv.lnk", cAlternateFileName="CDNV4K~1.LNK")) returned 1
	[0097.319] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2546d80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2546d80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2546d80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x0, dwReserved1=0x0, cFileName="CKK20aLXbvslgLua3s5d.lnk", cAlternateFileName="CKK20A~1.LNK")) returned 1
	[0097.319] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f797e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f797e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f9f940, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x0, dwReserved1=0x0, cFileName="CKvdvKV-oh.lnk", cAlternateFileName="CKVDVK~1.LNK")) returned 1
	[0097.320] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1
	[0097.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x59
	[0097.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpFilePart=0x0) returned 0x5a
	[0097.321] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.324] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.325] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1
	[0097.326] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1
	[0097.326] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1
	[0097.327] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 1
	[0097.327] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1
	[0097.328] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 1
	[0097.329] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1
	[0097.329] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0
	[0097.330] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0097.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0097.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0097.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x59
	[0097.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpFilePart=0x0) returned 0x5a
	[0097.334] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.337] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.338] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1
	[0097.338] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1
	[0097.339] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1
	[0097.339] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 1
	[0097.340] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1
	[0097.340] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 1
	[0097.341] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1
	[0097.341] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.341] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0097.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0097.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0097.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\Decrypt.txt", lpFilePart=0x0) returned 0x65
	[0097.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0097.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0097.348] GetFileType (hFile=0x228) returned 0x1
	[0097.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0097.349] GetFileType (hFile=0x228) returned 0x1
	[0097.349] WriteFile (in: hFile=0x228, lpBuffer=0x2675dcc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2675dcc*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0097.355] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0097.356] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2cb7240, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2cb7240, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2cb7240, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLk2KrmwO.lnk", cAlternateFileName="DLK2KR~1.LNK")) returned 1
	[0097.357] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29e3820, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe29e3820, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe29e3820, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xaa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="dUMj7GuNWeG1d50zvU-W.lnk", cAlternateFileName="DUMJ7G~1.LNK")) returned 1
	[0097.357] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2357ba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2357ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2357ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1acf, dwReserved0=0x0, dwReserved1=0x0, cFileName="E 2VGlPB8jFk5rmdHt.lnk", cAlternateFileName="E2VGLP~1.LNK")) returned 1
	[0097.358] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe230b8e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe230b8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2331a40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8-QppsP1gRerkX.lnk", cAlternateFileName="E8-QPP~1.LNK")) returned 1
	[0097.358] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe39f4ca0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe39f4ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3a1ae00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="EaGMVKx99tO38Ada6zp.lnk", cAlternateFileName="EAGMVK~1.LNK")) returned 1
	[0097.359] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe39365c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe39365c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe39365c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EdDq2m7lNBxZX.lnk", cAlternateFileName="EDDQ2M~1.LNK")) returned 1
	[0097.360] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2aa1f00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2aa1f00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2aa1f00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eez-t7cYZD.lnk", cAlternateFileName="EEZ-T7~1.LNK")) returned 1
	[0097.360] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24886a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24886a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe24886a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERZf4Y5RBkSUzVt.lnk", cAlternateFileName="ERZF4Y~1.LNK")) returned 1
	[0097.361] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b86740, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b86740, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2b86740, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="f46Ms.lnk", cAlternateFileName="")) returned 1
	[0097.361] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe27a8380, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe27a8380, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe27a8380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FIgAgA4hj5B3F2rQ-ow.lnk", cAlternateFileName="FIGAGA~1.LNK")) returned 1
	[0097.361] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe123bd80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe34739c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe34739c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa06, dwReserved0=0x0, dwReserved1=0x0, cFileName="fJWc1mtAmAsE8H FQtfy.lnk", cAlternateFileName="FJWC1M~1.LNK")) returned 1
	[0097.362] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a6a920, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1a6a920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1a6a920, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x0, dwReserved1=0x0, cFileName="FNuzNIqniMp8p.lnk", cAlternateFileName="FNUZNI~1.LNK")) returned 1
	[0097.362] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe11a3800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3982880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3982880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x991, dwReserved0=0x0, dwReserved1=0x0, cFileName="f__WJP1S.lnk", cAlternateFileName="")) returned 1
	[0097.363] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3805ac0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3805ac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3805ac0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa88, dwReserved0=0x0, dwReserved1=0x0, cFileName="g3IGI_8_b20Ns0MOJ9.lnk", cAlternateFileName="G3IGI_~1.LNK")) returned 1
	[0097.363] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe256cee0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe256cee0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe256cee0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="gFCGzFABqRtfbthg.lnk", cAlternateFileName="GFCGZF~1.LNK")) returned 1
	[0097.363] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a90a80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1a90a80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1a90a80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x0, dwReserved1=0x0, cFileName="heRZc55brEskdRX.flv.lnk", cAlternateFileName="HERZC5~1.LNK")) returned 1
	[0097.364] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3427700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3427700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3427700, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hkZL9L9ylQ4CBtgJNAF.lnk", cAlternateFileName="HKZL9L~1.LNK")) returned 1
	[0097.364] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe35ca620, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe35ca620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe35ca620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0x0, dwReserved1=0x0, cFileName="ItgQf9oCsRCV.lnk", cAlternateFileName="ITGQF9~1.LNK")) returned 1
	[0097.365] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe28d8e80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe28d8e80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe28fefe0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1397, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmKdf2U.lnk", cAlternateFileName="")) returned 1
	[0097.365] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe211c700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bac8a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2bac8a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="jQne6sDTP0gLRRMM9w.lnk", cAlternateFileName="JQNE6S~1.LNK")) returned 1
	[0097.366] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe00f9e00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe39f4ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe39f4ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x207, dwReserved0=0x0, dwReserved1=0x0, cFileName="JVBNjkN-Qb39_TBQ4y.lnk", cAlternateFileName="JVBNJK~1.LNK")) returned 1
	[0097.366] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32aa940, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe32aa940, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe32aa940, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="k qlWax.lnk", cAlternateFileName="KQLWAX~1.LNK")) returned 1
	[0097.366] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe275c0c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe275c0c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe275c0c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="k9pFxS6ebZN.lnk", cAlternateFileName="K9PFXS~1.LNK")) returned 1
	[0097.367] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31c6100, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe31c6100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe31c6100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x0, dwReserved1=0x0, cFileName="KJoZDisMXpQ3iE.lnk", cAlternateFileName="KJOZDI~1.LNK")) returned 1
	[0097.367] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ea6420, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ea6420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2ea6420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQ9twrZw46PHSgjvD.mkv.lnk", cAlternateFileName="KQ9TWR~1.LNK")) returned 1
	[0097.368] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3342ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3342ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3342ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ldcnj_-F.lnk", cAlternateFileName="")) returned 1
	[0097.368] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c7fc60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1c7fc60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1c7fc60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xaa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="LejfGFmzj3PSoclK1Dyf.lnk", cAlternateFileName="LEJFGF~1.LNK")) returned 1
	[0097.369] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0a33340, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe389e040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe389e040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lssfz5.lnk", cAlternateFileName="")) returned 1
	[0097.369] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe357e360, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe357e360, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe357e360, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x0, cFileName="lUk_FImwRQDs69.mkv.lnk", cAlternateFileName="LUK_FI~1.LNK")) returned 1
	[0097.369] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2aa1f00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2aa1f00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2aa1f00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="lz2-7X1s4UwpH lnp.lnk", cAlternateFileName="LZ2-7X~1.LNK")) returned 1
	[0097.370] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a40f60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3a40f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3a40f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a31, dwReserved0=0x0, dwReserved1=0x0, cFileName="maCM.lnk", cAlternateFileName="")) returned 1
	[0097.370] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34e5de0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe34e5de0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe34e5de0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mc9jttJNds c6wX8O-L.lnk", cAlternateFileName="MC9JTT~1.LNK")) returned 1
	[0097.371] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c7fc60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe31c6100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe31c6100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x0, dwReserved1=0x0, cFileName="mh86.lnk", cAlternateFileName="")) returned 1
	[0097.371] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3721280, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3721280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3721280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MWK5d1zBuYM.lnk", cAlternateFileName="MWK5D1~1.LNK")) returned 1
	[0097.372] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe28b2d20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3910460, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3910460, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 1
	[0097.372] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0e5d9c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe363ca40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe363ca40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 1
	[0097.372] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe11313e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3ab3380, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3ab3380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 1
	[0097.373] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0fb4620, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0fb4620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0fb4620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x141b, dwReserved0=0x0, dwReserved1=0x0, cFileName="N-j-EX_PS9INrbRVKPt.lnk", cAlternateFileName="N-J-EX~1.LNK")) returned 1
	[0097.373] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0fda780, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0fda780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe10008e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="N28MvGiCVwSz7l-D2f.lnk", cAlternateFileName="N28MVG~1.LNK")) returned 1
	[0097.374] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe17bd060, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe17bd060, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe17bd060, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="n5xbvFHN50k ei.flv.lnk", cAlternateFileName="N5XBVF~1.LNK")) returned 1
	[0097.374] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3910460, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3910460, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3910460, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAAh92c2O4I.mkv.lnk", cAlternateFileName="NAAH92~1.LNK")) returned 1
	[0097.375] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24faac0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24faac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2520c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="NabPcDM35oz3x.lnk", cAlternateFileName="NABPCD~1.LNK")) returned 1
	[0097.375] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3153ce0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3153ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3153ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ngUDipaXNO.lnk", cAlternateFileName="NGUDIP~1.LNK")) returned 1
	[0097.376] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a55c40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2a55c40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2a55c40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="NX MfFno Qo.lnk", cAlternateFileName="NXMFFN~1.LNK")) returned 1
	[0097.376] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19d23a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe19d23a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1a6a920, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nYIyxD_m.flv.lnk", cAlternateFileName="NYIYXD~1.LNK")) returned 1
	[0097.377] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bf8b60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bf8b60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2bf8b60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="odsU6e1_1_zLFVicos.mkv.lnk", cAlternateFileName="ODSU6E~1.LNK")) returned 1
	[0097.377] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe30bb760, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe30bb760, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe30bb760, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xefc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ojoUWQSFlWHqnLEwX.lnk", cAlternateFileName="OJOUWQ~1.LNK")) returned 1
	[0097.377] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3982880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3982880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3982880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf14, dwReserved0=0x0, dwReserved1=0x0, cFileName="oKaEbwcOgsPSBH.lnk", cAlternateFileName="OKAEBW~1.LNK")) returned 1
	[0097.378] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe395c720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe395c720, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe395c720, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORcela0_Hj.mkv.lnk", cAlternateFileName="ORCELA~1.LNK")) returned 1
	[0097.379] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ac8060, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ac8060, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2ac8060, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ot2dToqM.lnk", cAlternateFileName="")) returned 1
	[0097.379] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe363ca40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe363ca40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe363ca40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa05, dwReserved0=0x0, dwReserved1=0x0, cFileName="OZr_PU6S.lnk", cAlternateFileName="")) returned 1
	[0097.379] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0fda780, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b605e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2b605e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe06, dwReserved0=0x0, dwReserved1=0x0, cFileName="pb9DrQgx.lnk", cAlternateFileName="")) returned 1
	[0097.380] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe28fefe0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe28fefe0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe28fefe0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJkN.lnk", cAlternateFileName="")) returned 1
	[0097.380] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37473e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37473e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe37473e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="q2 l_fsC5nR1.lnk", cAlternateFileName="Q2L_FS~1.LNK")) returned 1
	[0097.381] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37936a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37936a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe37936a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa46, dwReserved0=0x0, dwReserved1=0x0, cFileName="qGQUmgkwXp46izd31hJn.mkv.lnk", cAlternateFileName="QGQUMG~1.LNK")) returned 1
	[0097.381] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe389e040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe389e040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe389e040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="QoTMlAH_YZPnU_nsY49.lnk", cAlternateFileName="QOTMLA~1.LNK")) returned 1
	[0097.382] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1770da0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2cdd3a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2cdd3a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="QphIe7J3JTVAb6lMkmEX.lnk", cAlternateFileName="QPHIE7~1.LNK")) returned 1
	[0097.382] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2605460, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2605460, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2605460, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="qT7rZtiHuleR.flv.lnk", cAlternateFileName="QT7RZT~1.LNK")) returned 1
	[0097.382] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3179e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3179e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe319ffa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x0, dwReserved1=0x0, cFileName="RgkXT7U3sMAKrn4DC1R3.lnk", cAlternateFileName="RGKXT7~1.LNK")) returned 1
	[0097.383] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe39a89e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe39a89e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe39ceb40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="rHnnn.lnk", cAlternateFileName="")) returned 1
	[0097.383] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe262b5c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe262b5c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe262b5c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="rJMVpzJX7aYmRu3CC.lnk", cAlternateFileName="RJMVPZ~1.LNK")) returned 1
	[0097.384] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0d79180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3877ee0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3877ee0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming.lnk", cAlternateFileName="")) returned 1
	[0097.385] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a2fae0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2a2fae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2a2fae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQf-VYAAU.lnk", cAlternateFileName="RQF-VY~1.LNK")) returned 1
	[0097.385] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe05bca00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe05bca00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe05bca00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="rRGx3-ADGD Q7osenff.lnk", cAlternateFileName="RRGX3-~1.LNK")) returned 1
	[0097.386] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e94fa0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1e94fa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1e94fa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a68, dwReserved0=0x0, dwReserved1=0x0, cFileName="s91SwGFHR.lnk", cAlternateFileName="S91SWG~1.LNK")) returned 1
	[0097.386] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe35320a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe35320a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe35320a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x23e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAG_M6ElF.mkv.lnk", cAlternateFileName="SAG_M6~1.LNK")) returned 1
	[0097.387] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe195ff80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe195ff80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe195ff80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfAwhHD-lx.lnk", cAlternateFileName="SFAWHH~1.LNK")) returned 1
	[0097.387] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe14510c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe38c41a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe38c41a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x0, dwReserved1=0x0, cFileName="sfCIPM_LIy8Lq5LU.lnk", cAlternateFileName="SFCIPM~1.LNK")) returned 1
	[0097.388] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe36d4fc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe36d4fc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe36d4fc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x992, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sgbe.mkv.lnk", cAlternateFileName="SGBEMK~1.LNK")) returned 1
	[0097.388] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe376d540, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe376d540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe376d540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk0Kq.lnk", cAlternateFileName="")) returned 1
	[0097.389] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c1ecc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2c1ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2c1ecc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLnbw98BN0OZqVzk9.lnk", cAlternateFileName="SLNBW9~1.LNK")) returned 1
	[0097.389] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bf620, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe22bf620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe22bf620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Srk8Uh.lnk", cAlternateFileName="")) returned 1
	[0097.390] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3095600, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3095600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3095600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xee7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVgPOkZod7XGGc.lnk", cAlternateFileName="SVGPOK~1.LNK")) returned 1
	[0097.390] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe30e18c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe30e18c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe30e18c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa51, dwReserved0=0x0, dwReserved1=0x0, cFileName="TJowR7p3onxdwUlc.ots.lnk", cAlternateFileName="TJOWR7~1.LNK")) returned 1
	[0097.391] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe382bc20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe382bc20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe382bc20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="tM0e4eTi2T7dYo-EKo.lnk", cAlternateFileName="TM0E4E~1.LNK")) returned 1
	[0097.391] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b14320, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b14320, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2b14320, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpYm1C_C.lnk", cAlternateFileName="")) returned 1
	[0097.391] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe35320a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe35320a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe35320a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xeaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="tT7hDOlV_i.lnk", cAlternateFileName="TT7HDO~1.LNK")) returned 1
	[0097.392] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3238520, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3238520, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3238520, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="txXHEm8A.lnk", cAlternateFileName="")) returned 1
	[0097.392] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2dc1be0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2dc1be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2de7d40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="tY-Hbt1Tur.lnk", cAlternateFileName="TY-HBT~1.LNK")) returned 1
	[0097.392] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10e5120, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe39a89e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe39a89e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x98f, dwReserved0=0x0, dwReserved1=0x0, cFileName="u8c QRVcJJVI3A.lnk", cAlternateFileName="U8CQRV~1.LNK")) returned 1
	[0097.392] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3877ee0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3877ee0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3877ee0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="uc3b5mzL6Hsz.lnk", cAlternateFileName="UC3B5M~1.LNK")) returned 1
	[0097.393] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe270fe00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe270fe00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe270fe00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x0, dwReserved1=0x0, cFileName="UFL_16HpW2_deIEVlBEl.lnk", cAlternateFileName="UFL_16~1.LNK")) returned 1
	[0097.393] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2782220, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2782220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2782220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1527, dwReserved0=0x0, dwReserved1=0x0, cFileName="VjlnNgrmZO0sS_.lnk", cAlternateFileName="VJLNNG~1.LNK")) returned 1
	[0097.393] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2aee1c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2aee1c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2aee1c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1ab9, dwReserved0=0x0, dwReserved1=0x0, cFileName="VJXpF4pwBzNNdc85.lnk", cAlternateFileName="VJXPF4~1.LNK")) returned 1
	[0097.393] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2925140, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2925140, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2925140, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0x0, dwReserved1=0x0, cFileName="VlDWNqZ9Oy-yQqpS.lnk", cAlternateFileName="VLDWNQ~1.LNK")) returned 1
	[0097.395] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe319ffa0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe319ffa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe319ffa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe36, dwReserved0=0x0, dwReserved1=0x0, cFileName="vRKk.lnk", cAlternateFileName="")) returned 1
	[0097.395] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0ef5f40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0ef5f40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0ef5f40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="VsMue.lnk", cAlternateFileName="")) returned 1
	[0097.395] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ebb100, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3a670c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3a670c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDmALjK8.lnk", cAlternateFileName="")) returned 1
	[0097.395] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0b3dce0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3107a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3107a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0x0, dwReserved1=0x0, cFileName="WJNv.lnk", cAlternateFileName="")) returned 1
	[0097.396] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe344d860, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe344d860, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe344d860, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WKSj.lnk", cAlternateFileName="")) returned 1
	[0097.396] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe243c3e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe243c3e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe243c3e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xaa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="wUXc6EhnWHZbuYOaWjpH.lnk", cAlternateFileName="WUXC6E~1.LNK")) returned 1
	[0097.396] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe11a3800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe11a3800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe11a3800, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xec7, dwReserved0=0x0, dwReserved1=0x0, cFileName="wWd4kF1RArO.ots.lnk", cAlternateFileName="WWD4KF~1.LNK")) returned 1
	[0097.396] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bd2a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bd2a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2bd2a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xeb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X508s_NGV.lnk", cAlternateFileName="X508S_~1.LNK")) returned 1
	[0097.397] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdff56ee0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe331cd60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe331cd60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe45, dwReserved0=0x0, dwReserved1=0x0, cFileName="xAMGL.lnk", cAlternateFileName="")) returned 1
	[0097.397] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2cdd3a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2cdd3a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2cdd3a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="xcfcY-q63z.lnk", cAlternateFileName="XCFCY-~1.LNK")) returned 1
	[0097.397] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe382bc20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe382bc20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3851d80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="XE0 jUKMfFjCtfmBzTF.lnk", cAlternateFileName="XE0JUK~1.LNK")) returned 1
	[0097.397] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe25b91a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe25b91a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe25b91a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="XJsm_wz.lnk", cAlternateFileName="")) returned 1
	[0097.398] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a55c40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2a55c40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2a55c40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="XJxyezyLbOpsuYa.mkv.lnk", cAlternateFileName="XJXYEZ~1.LNK")) returned 1
	[0097.398] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37b9800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37b9800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe37b9800, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf35, dwReserved0=0x0, dwReserved1=0x0, cFileName="xy2kYiRdnAtf-Vy3k.lnk", cAlternateFileName="XY2KYI~1.LNK")) returned 1
	[0097.398] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe123bd80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe123bd80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe123bd80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf55, dwReserved0=0x0, dwReserved1=0x0, cFileName="yBRVF.lnk", cAlternateFileName="")) returned 1
	[0097.398] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d03500, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2d03500, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2d03500, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZhvS4lX.lnk", cAlternateFileName="")) returned 1
	[0097.398] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ef26e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ef26e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2f18840, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZjN0.lnk", cAlternateFileName="")) returned 1
	[0097.398] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22e5780, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe22e5780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe22e5780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZjW5mk1OGDP3a2UPxB.lnk", cAlternateFileName="ZJW5MK~1.LNK")) returned 1
	[0097.398] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3688d00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3688d00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe36aee60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZnJGTgjvmiO4bs5S1.lnk", cAlternateFileName="ZNJGTG~1.LNK")) returned 1
	[0097.399] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe306f4a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe306f4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe306f4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZRKQr vDI2XvOo.flv.lnk", cAlternateFileName="ZRKQRV~1.LNK")) returned 1
	[0097.399] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37df960, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37df960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe37df960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="_2upRs39Y05.mkv.lnk", cAlternateFileName="_2UPRS~1.LNK")) returned 1
	[0097.399] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37df960, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37df960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe37df960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="_2upRs39Y05.mkv.lnk", cAlternateFileName="_2UPRS~1.LNK")) returned 0
	[0097.399] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x46
	[0097.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpFilePart=0x0) returned 0x47
	[0097.400] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe3ab3380, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3ab3380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.400] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe3ab3380, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3ab3380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.400] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe26e9ca0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe26e9ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe26e9ca0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="-lT9_uq1-.flv.lnk", cAlternateFileName="-LT9_U~1.LNK")) returned 1
	[0097.400] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bf620, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe35320a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe35320a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x973, dwReserved0=0x0, dwReserved1=0x0, cFileName="-UucLCm.lnk", cAlternateFileName="")) returned 1
	[0097.401] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe39ceb40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe39ceb40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe39ceb40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x302, dwReserved0=0x0, dwReserved1=0x0, cFileName="0EbWXe73.lnk", cAlternateFileName="")) returned 1
	[0097.401] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f3e9a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2f3e9a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe30231e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x99d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0GJPN.flv.lnk", cAlternateFileName="0GJPNF~1.LNK")) returned 1
	[0097.401] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1b752c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1b752c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1b752c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa46, dwReserved0=0x0, dwReserved1=0x0, cFileName="0kI16qGYKIWr.lnk", cAlternateFileName="0KI16Q~1.LNK")) returned 1
	[0097.401] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38ea300, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe38ea300, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe38ea300, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x0, cFileName="288dXqBRqJ dmG.lnk", cAlternateFileName="288DXQ~1.LNK")) returned 1
	[0097.401] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe36168e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe36168e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe36168e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x0, dwReserved1=0x0, cFileName="2IWp.lnk", cAlternateFileName="")) returned 1
	[0097.401] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2735f60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2735f60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2735f60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="2wb0k9funFxm5A6aGy.lnk", cAlternateFileName="2WB0K9~1.LNK")) returned 1
	[0097.401] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b605e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b605e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2b605e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="4R3h1Iwy.lnk", cAlternateFileName="")) returned 1
	[0097.401] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b86740, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b86740, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2b86740, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x153b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4s41QTR7ma-8YN84zJ3G.lnk", cAlternateFileName="4S41QT~1.LNK")) returned 1
	[0097.402] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1477220, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1477220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe149d380, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x0, dwReserved1=0x0, cFileName="5pyJ_ 12qn1vPLhsv.lnk", cAlternateFileName="5PYJ_1~1.LNK")) returned 1
	[0097.402] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a09980, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2a09980, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2a09980, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5QlA2SuSZH92 L9.lnk", cAlternateFileName="5QLA2S~1.LNK")) returned 1
	[0097.402] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1febc00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1febc00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1febc00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="5wJxRKjMWEP.lnk", cAlternateFileName="5WJXRK~1.LNK")) returned 1
	[0097.402] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d29660, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2d29660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2d29660, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="6z0nNXnW.flv.lnk", cAlternateFileName="6Z0NNX~1.LNK")) returned 1
	[0097.402] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0ea9c80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe35ca620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe35ca620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xee7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8alGuK51aX.lnk", cAlternateFileName="8ALGUK~1.LNK")) returned 1
	[0097.402] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2651720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2651720, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2651720, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="8wxu8xYGDCdlbG.lnk", cAlternateFileName="8WXU8X~1.LNK")) returned 1
	[0097.402] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe294b2a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe294b2a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe294b2a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="8y2wDARL3.lnk", cAlternateFileName="8Y2WDA~1.LNK")) returned 1
	[0097.403] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3049340, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3049340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3049340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x0, dwReserved1=0x0, cFileName="9x49PM1E8xONjF84kJ.lnk", cAlternateFileName="9X49PM~1.LNK")) returned 1
	[0097.403] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe35f0780, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe35f0780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe35f0780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ad_8oHDleju7gjQPCKa.lnk", cAlternateFileName="AD_8OH~1.LNK")) returned 1
	[0097.403] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaf66cb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xaf66cb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1
	[0097.403] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23f0120, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe23f0120, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe23f0120, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="b-sZVFKr0qE.lnk", cAlternateFileName="B-SZVF~1.LNK")) returned 1
	[0097.403] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe218eb20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe218eb20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe218eb20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a77, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDSaBnCNcG.lnk", cAlternateFileName="BDSABN~1.LNK")) returned 1
	[0097.403] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2416280, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2416280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2416280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brGd.lnk", cAlternateFileName="")) returned 1
	[0097.403] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d9ba80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3a8d220, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3a8d220, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x96a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bWJnkhq1ltM.lnk", cAlternateFileName="BWJNKH~1.LNK")) returned 1
	[0097.403] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34015a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe34015a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe34015a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x23e, dwReserved0=0x0, dwReserved1=0x0, cFileName="bzV6a5Pfe.flv.lnk", cAlternateFileName="BZV6A5~1.LNK")) returned 1
	[0097.403] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3851d80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3851d80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3851d80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="C-RcLTpgwLsTNOwu1.lnk", cAlternateFileName="C-RCLT~1.LNK")) returned 1
	[0097.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38c41a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe38c41a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe38c41a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdnV4kPFNd2c.flv.lnk", cAlternateFileName="CDNV4K~1.LNK")) returned 1
	[0097.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2546d80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2546d80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2546d80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x0, dwReserved1=0x0, cFileName="CKK20aLXbvslgLua3s5d.lnk", cAlternateFileName="CKK20A~1.LNK")) returned 1
	[0097.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f797e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f797e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f9f940, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x0, dwReserved1=0x0, cFileName="CKvdvKV-oh.lnk", cAlternateFileName="CKVDVK~1.LNK")) returned 1
	[0097.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xafb2f70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xafb2f70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1
	[0097.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0097.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2cb7240, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2cb7240, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2cb7240, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLk2KrmwO.lnk", cAlternateFileName="DLK2KR~1.LNK")) returned 1
	[0097.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29e3820, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe29e3820, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe29e3820, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xaa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="dUMj7GuNWeG1d50zvU-W.lnk", cAlternateFileName="DUMJ7G~1.LNK")) returned 1
	[0097.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2357ba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2357ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2357ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1acf, dwReserved0=0x0, dwReserved1=0x0, cFileName="E 2VGlPB8jFk5rmdHt.lnk", cAlternateFileName="E2VGLP~1.LNK")) returned 1
	[0097.405] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe230b8e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe230b8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2331a40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8-QppsP1gRerkX.lnk", cAlternateFileName="E8-QPP~1.LNK")) returned 1
	[0097.405] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe39f4ca0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe39f4ca0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3a1ae00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="EaGMVKx99tO38Ada6zp.lnk", cAlternateFileName="EAGMVK~1.LNK")) returned 1
	[0097.405] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe39365c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe39365c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe39365c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EdDq2m7lNBxZX.lnk", cAlternateFileName="EDDQ2M~1.LNK")) returned 1
	[0097.405] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2aa1f00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2aa1f00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2aa1f00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eez-t7cYZD.lnk", cAlternateFileName="EEZ-T7~1.LNK")) returned 1
	[0097.406] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0097.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.407] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.409] GetFileType (hFile=0x224) returned 0x1
	[0097.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.409] GetFileType (hFile=0x224) returned 0x1
	[0097.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x46
	[0097.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpFilePart=0x0) returned 0x47
	[0097.416] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.421] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x46
	[0097.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpFilePart=0x0) returned 0x47
	[0097.424] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.453] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0097.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.460] GetFileType (hFile=0x224) returned 0x1
	[0097.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.461] GetFileType (hFile=0x224) returned 0x1
	[0097.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x4a
	[0097.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x4b
	[0097.472] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x53
	[0097.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x54
	[0097.473] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x5f
	[0097.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x60
	[0097.474] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0097.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0097.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x6d
	[0097.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x6e
	[0097.475] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0097.475] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0097.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0097.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0097.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0097.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x6d
	[0097.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x6e
	[0097.476] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0097.476] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0097.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0097.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0097.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt", lpFilePart=0x0) returned 0x79
	[0097.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0097.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0097.480] GetFileType (hFile=0x230) returned 0x1
	[0097.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0097.480] GetFileType (hFile=0x230) returned 0x1
	[0097.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0097.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x6c
	[0097.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x6d
	[0097.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0097.485] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0097.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0097.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0097.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0097.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x6c
	[0097.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x6d
	[0097.486] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0097.486] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0097.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0097.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0097.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x78
	[0097.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0097.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0097.490] GetFileType (hFile=0x230) returned 0x1
	[0097.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0097.490] GetFileType (hFile=0x230) returned 0x1
	[0097.494] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0097.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0097.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0097.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.495] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x5f
	[0097.495] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x60
	[0097.495] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0097.495] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0097.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0097.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0097.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt", lpFilePart=0x0) returned 0x6b
	[0097.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0097.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0097.499] GetFileType (hFile=0x22c) returned 0x1
	[0097.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0097.499] GetFileType (hFile=0x22c) returned 0x1
	[0097.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x68
	[0097.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x69
	[0097.504] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0097.504] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0097.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0097.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0097.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x68
	[0097.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x69
	[0097.505] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0097.505] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0097.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0097.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0097.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x74
	[0097.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0097.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0097.509] GetFileType (hFile=0x22c) returned 0x1
	[0097.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0097.509] GetFileType (hFile=0x22c) returned 0x1
	[0097.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x5f
	[0097.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x60
	[0097.513] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0097.513] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0097.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0097.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0097.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x5f
	[0097.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x60
	[0097.514] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0097.514] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0097.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0097.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0097.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt", lpFilePart=0x0) returned 0x6b
	[0097.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0097.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0097.518] GetFileType (hFile=0x22c) returned 0x1
	[0097.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0097.518] GetFileType (hFile=0x22c) returned 0x1
	[0097.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b
	[0097.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x5c
	[0097.524] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0097.524] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0097.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0097.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0097.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b
	[0097.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x5c
	[0097.525] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0097.525] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0097.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0097.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0097.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0097.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0097.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0097.528] GetFileType (hFile=0x22c) returned 0x1
	[0097.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0097.529] GetFileType (hFile=0x22c) returned 0x1
	[0097.533] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0097.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0097.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0097.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x53
	[0097.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x54
	[0097.533] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.534] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0097.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0097.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0097.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0097.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0097.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0097.538] GetFileType (hFile=0x228) returned 0x1
	[0097.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0097.538] GetFileType (hFile=0x228) returned 0x1
	[0097.542] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x4a
	[0097.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x4b
	[0097.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.543] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0097.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.546] GetFileType (hFile=0x224) returned 0x1
	[0097.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.546] GetFileType (hFile=0x224) returned 0x1
	[0097.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x49
	[0097.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x4a
	[0097.551] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.552] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x49
	[0097.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x4a
	[0097.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.553] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0097.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\templates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.554] GetFileType (hFile=0x224) returned 0x1
	[0097.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.554] GetFileType (hFile=0x224) returned 0x1
	[0097.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x46
	[0097.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x47
	[0097.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.559] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x46
	[0097.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x47
	[0097.560] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x5e
	[0097.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0097.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0097.560] GetFileType (hFile=0x228) returned 0x1
	[0097.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0097.561] GetFileType (hFile=0x228) returned 0x1
	[0097.561] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x9cfab
	[0097.567] ReadFile (in: hFile=0x228, lpBuffer=0x377e268, nNumberOfBytesToRead=0x9cfab, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x377e268*, lpNumberOfBytesRead=0x26ed44*=0x9cfab, lpOverlapped=0x0) returned 1
	[0097.610] CloseHandle (hObject=0x228) returned 1
	[0097.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.KEKW", lpFilePart=0x0) returned 0x63
	[0097.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0097.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0097.612] GetFileType (hFile=0x228) returned 0x1
	[0097.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0097.612] GetFileType (hFile=0x228) returned 0x1
	[0097.613] WriteFile (in: hFile=0x228, lpBuffer=0x26e8608*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26e8608*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0097.616] CloseHandle (hObject=0x228) returned 1
	[0097.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x5e
	[0097.616] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 1
	[0097.643] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0097.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.646] GetFileType (hFile=0x224) returned 0x1
	[0097.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.646] GetFileType (hFile=0x224) returned 0x1
	[0097.647] WriteFile (in: hFile=0x224, lpBuffer=0x26ead8c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26ead8c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0097.650] CloseHandle (hObject=0x224) returned 1
	[0097.651] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.651] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0097.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0097.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0097.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0097.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x3f
	[0097.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x40
	[0097.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0097.653] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.653] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xad056b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xad056b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0097.654] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xad2b810, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xad2b810, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1
	[0097.655] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xae10050, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xae10050, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1
	[0097.655] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xae361b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xae361b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1
	[0097.656] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xae5c310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xae5c310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1
	[0097.656] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xae5c310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xae5c310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1
	[0097.657] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaf1a9f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xaf1a9f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1
	[0097.658] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb04b4f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb04b4f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0097.658] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb0e3a70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb0e3a70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0097.659] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb1a2150, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb1a2150, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0097.660] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb1c82b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb1c82b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0097.661] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb2acaf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb2acaf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0097.662] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb2acaf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb2acaf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0
	[0097.662] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0097.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0097.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0097.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0097.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0097.665] GetFileType (hFile=0x220) returned 0x1
	[0097.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0097.665] GetFileType (hFile=0x220) returned 0x1
	[0097.665] WriteFile (in: hFile=0x220, lpBuffer=0x26ef098*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26ef098*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0097.668] CloseHandle (hObject=0x220) returned 1
	[0097.669] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 1
	[0097.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0097.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x3c
	[0097.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\", lpFilePart=0x0) returned 0x3d
	[0097.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0097.673] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.673] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STARTUP", cAlternateFileName="")) returned 1
	[0097.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.674] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x44
	[0097.674] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", lpFilePart=0x0) returned 0x45
	[0097.675] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.677] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.677] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0097.678] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x44
	[0097.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", lpFilePart=0x0) returned 0x45
	[0097.679] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.679] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.680] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0097.680] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0097.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\startup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.682] GetFileType (hFile=0x224) returned 0x1
	[0097.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.682] GetFileType (hFile=0x224) returned 0x1
	[0097.683] WriteFile (in: hFile=0x224, lpBuffer=0x26f37d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26f37d8*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0097.686] CloseHandle (hObject=0x224) returned 1
	[0097.686] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.686] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0097.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0097.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0097.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0097.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x3c
	[0097.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\", lpFilePart=0x0) returned 0x3d
	[0097.687] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0097.688] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.688] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0xb2f8db0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb2f8db0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STARTUP", cAlternateFileName="")) returned 1
	[0097.689] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0xb2f8db0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb2f8db0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STARTUP", cAlternateFileName="")) returned 0
	[0097.689] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0097.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0097.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0097.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0097.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0097.691] GetFileType (hFile=0x220) returned 0x1
	[0097.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0097.691] GetFileType (hFile=0x220) returned 0x1
	[0097.692] WriteFile (in: hFile=0x220, lpBuffer=0x26f6948*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26f6948*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0097.695] CloseHandle (hObject=0x220) returned 1
	[0097.695] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.695] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0097.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0097.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0097.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0097.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37
	[0097.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x38
	[0097.696] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0097.697] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.697] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x9831630, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9831630, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1
	[0097.698] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9831630, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9831630, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0097.698] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x98a3a50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x98a3a50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0097.699] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x9962130, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9962130, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1
	[0097.699] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x9988290, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9988290, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1
	[0097.700] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x99ae3f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x99ae3f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1
	[0097.701] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x99d4550, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x99d4550, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1
	[0097.701] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x99fa6b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x99fa6b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1
	[0097.702] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x9a20810, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9a20810, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1
	[0097.702] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9bc3730, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9bc3730, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0097.703] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x9be9890, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9be9890, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1
	[0097.703] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x9c5bcb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1
	[0097.704] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9cce0d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9cce0d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1
	[0097.704] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x9d404f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9d404f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0097.705] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x9d66650, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9d66650, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1
	[0097.706] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa16ab70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa16ab70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1
	[0097.707] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa190cd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa190cd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof", cAlternateFileName="")) returned 1
	[0097.707] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa4d6b10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa4d6b10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1
	[0097.708] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa4fcc70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa4fcc70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0097.709] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa5bb350, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa5bb350, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1
	[0097.709] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa5e14b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa5e14b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1
	[0097.710] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa679a30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa679a30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1
	[0097.710] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa69fb90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa69fb90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0097.711] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa69fb90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xa69fb90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UProof", cAlternateFileName="")) returned 1
	[0097.712] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb2d2c50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb2d2c50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0097.712] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb31ef10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb31ef10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 1
	[0097.713] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb31ef10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb31ef10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 0
	[0097.713] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0097.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0097.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0097.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0097.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0097.715] GetFileType (hFile=0x208) returned 0x1
	[0097.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0097.716] GetFileType (hFile=0x208) returned 0x1
	[0097.716] WriteFile (in: hFile=0x208, lpBuffer=0x26fbc94*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26fbc94*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0097.719] CloseHandle (hObject=0x208) returned 1
	[0097.720] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0097.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0097.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x35
	[0097.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\", lpFilePart=0x0) returned 0x36
	[0097.720] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0097.722] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.723] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1
	[0097.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0097.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x40
	[0097.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\", lpFilePart=0x0) returned 0x41
	[0097.724] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0097.726] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.727] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0097.728] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0097.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0097.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0097.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0097.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x40
	[0097.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\", lpFilePart=0x0) returned 0x41
	[0097.728] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0097.729] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.729] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0097.730] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0097.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0097.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0097.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0097.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\extensions\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0097.732] GetFileType (hFile=0x220) returned 0x1
	[0097.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0097.732] GetFileType (hFile=0x220) returned 0x1
	[0097.732] WriteFile (in: hFile=0x220, lpBuffer=0x2700230*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2700230*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0097.735] CloseHandle (hObject=0x220) returned 1
	[0097.736] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1
	[0097.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0097.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3d
	[0097.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3e
	[0097.737] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0097.739] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.740] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crash Reports", cAlternateFileName="CRASHR~1")) returned 1
	[0097.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x4b
	[0097.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpFilePart=0x0) returned 0x4c
	[0097.741] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.743] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.744] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 1
	[0097.744] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 0
	[0097.745] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x4b
	[0097.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpFilePart=0x0) returned 0x4c
	[0097.746] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.746] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.747] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 1
	[0097.747] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.749] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0097.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0097.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0097.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Decrypt.txt", lpFilePart=0x0) returned 0x57
	[0097.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0097.750] GetFileType (hFile=0x224) returned 0x1
	[0097.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0097.751] GetFileType (hFile=0x224) returned 0x1
	[0097.751] WriteFile (in: hFile=0x224, lpBuffer=0x270528c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x270528c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0097.754] CloseHandle (hObject=0x224) returned 1
	[0097.754] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0097.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0097.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46
	[0097.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x47
	[0097.755] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0097.757] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.758] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1
	[0097.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0097.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x57
	[0097.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpFilePart=0x0) returned 0x58
	[0097.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0097.765] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.769] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb76a6d10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb76a6d10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb76a6d10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 1
	[0097.770] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bookmarkbackups", cAlternateFileName="BOOKMA~1")) returned 1
	[0097.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", lpFilePart=0x0) returned 0x67
	[0097.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\", lpFilePart=0x0) returned 0x68
	[0097.770] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0097.777] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.778] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc37c9330, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc37c9330, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc37df2c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bookmarks-2017-06-05_5.json", cAlternateFileName="BOOKMA~1.JSO")) returned 1
	[0097.778] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 1
	[0097.779] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 0
	[0097.779] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0097.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0097.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0097.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", lpFilePart=0x0) returned 0x67
	[0097.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\", lpFilePart=0x0) returned 0x68
	[0097.782] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0097.786] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.786] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc37c9330, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc37c9330, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc37df2c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bookmarks-2017-06-05_5.json", cAlternateFileName="BOOKMA~1.JSO")) returned 1
	[0097.787] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 1
	[0097.787] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.787] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0097.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0097.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0097.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Decrypt.txt", lpFilePart=0x0) returned 0x73
	[0097.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0097.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0097.794] GetFileType (hFile=0x22c) returned 0x1
	[0097.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0097.794] GetFileType (hFile=0x22c) returned 0x1
	[0097.795] WriteFile (in: hFile=0x22c, lpBuffer=0x270c5b8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x270c5b8*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0097.798] CloseHandle (hObject=0x22c) returned 1
	[0097.798] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb47c9bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb47c9bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cert8.db", cAlternateFileName="")) returned 1
	[0097.799] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 1
	[0097.799] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5e8ce50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5e8ce50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb639bd10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-prefs.sqlite", cAlternateFileName="CONTEN~1.SQL")) returned 1
	[0097.800] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5ad4bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5ad4bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x83256a10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cookies.sqlite", cAlternateFileName="COOKIE~1.SQL")) returned 1
	[0097.800] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc374ed0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc374ed0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbc555e20, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="downloads.sqlite", cAlternateFileName="DOWNLO~1.SQL")) returned 1
	[0097.801] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4b81e50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4b81e50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b81e50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensions.ini", cAlternateFileName="EXTENS~1.INI")) returned 1
	[0097.802] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb45b48b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b0fa30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x70000, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensions.sqlite", cAlternateFileName="EXTENS~1.SQL")) returned 1
	[0097.802] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="indexedDB", cAlternateFileName="INDEXE~1")) returned 1
	[0097.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0097.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", lpFilePart=0x0) returned 0x61
	[0097.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\", lpFilePart=0x0) returned 0x62
	[0097.803] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0097.805] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.806] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 1
	[0097.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0097.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x75
	[0097.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\", lpFilePart=0x0) returned 0x76
	[0097.807] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0097.807] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.808] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1
	[0097.808] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="idb", cAlternateFileName="")) returned 1
	[0097.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0097.809] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x79
	[0097.809] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", lpFilePart=0x0) returned 0x7a
	[0097.809] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0097.815] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.815] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="818200132aebmoouht", cAlternateFileName="818200~1")) returned 1
	[0097.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0097.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x8c
	[0097.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", lpFilePart=0x0) returned 0x8d
	[0097.816] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0097.820] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.821] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0097.821] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0097.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0097.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0097.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0097.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x26e5c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x8c
	[0097.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", nBufferLength=0x105, lpBuffer=0x26e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", lpFilePart=0x0) returned 0x8d
	[0097.822] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x26e7e4 | out: lpFindFileData=0x26e7e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5e30
	[0097.823] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.823] FindNextFileW (in: hFindFile=0x5f5e30, lpFindFileData=0x26e83c | out: lpFindFileData=0x26e83c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0097.824] FindClose (in: hFindFile=0x5f5e30 | out: hFindFile=0x5f5e30) returned 1
	[0097.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eac4) returned 1
	[0097.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ead0) returned 1
	[0097.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e488, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Decrypt.txt", lpFilePart=0x0) returned 0x98
	[0097.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e97c) returned 1
	[0097.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x218
	[0097.826] GetFileType (hFile=0x218) returned 0x1
	[0097.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26e978) returned 1
	[0097.826] GetFileType (hFile=0x218) returned 0x1
	[0097.826] WriteFile (in: hFile=0x218, lpBuffer=0x27156f8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ea14, lpOverlapped=0x0 | out: lpBuffer=0x27156f8*, lpNumberOfBytesWritten=0x26ea14*=0xa5, lpOverlapped=0x0) returned 1
	[0097.836] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 1
	[0097.836] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 0
	[0097.836] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0097.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0097.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0097.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0097.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x79
	[0097.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", lpFilePart=0x0) returned 0x7a
	[0097.837] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0097.838] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.838] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb44fa10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb44fa10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="818200132aebmoouht", cAlternateFileName="818200~1")) returned 1
	[0097.839] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 1
	[0097.839] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.839] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0097.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0097.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0097.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Decrypt.txt", lpFilePart=0x0) returned 0x85
	[0097.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0097.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0097.841] GetFileType (hFile=0x234) returned 0x1
	[0097.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0097.841] GetFileType (hFile=0x234) returned 0x1
	[0097.842] WriteFile (in: hFile=0x234, lpBuffer=0x2719b14*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x2719b14*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0097.845] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.845] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0097.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0097.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0097.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0097.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x75
	[0097.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\", lpFilePart=0x0) returned 0x76
	[0097.846] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0097.847] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.847] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1
	[0097.847] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb475b70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb475b70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="idb", cAlternateFileName="")) returned 1
	[0097.848] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb475b70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb475b70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="idb", cAlternateFileName="")) returned 0
	[0097.848] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0097.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0097.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Decrypt.txt", lpFilePart=0x0) returned 0x81
	[0097.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0097.850] GetFileType (hFile=0x230) returned 0x1
	[0097.850] GetFileType (hFile=0x230) returned 0x1
	[0097.850] WriteFile (in: hFile=0x230, lpBuffer=0x271da04*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x271da04*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0097.853] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0097.853] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0097.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", lpFilePart=0x0) returned 0x61
	[0097.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\", lpFilePart=0x0) returned 0x62
	[0097.854] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0097.854] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0097.854] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb49bcd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb49bcd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 1
	[0097.855] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb49bcd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb49bcd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 0
	[0097.855] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0097.856] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Decrypt.txt", lpFilePart=0x0) returned 0x6d
	[0097.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0097.857] GetFileType (hFile=0x22c) returned 0x1
	[0097.857] GetFileType (hFile=0x22c) returned 0x1
	[0097.857] WriteFile (in: hFile=0x22c, lpBuffer=0x27210ec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x27210ec*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0097.861] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4815eb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4815eb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="key3.db", cAlternateFileName="")) returned 1
	[0097.861] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x850d63f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x850d63f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x850d63f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x501, dwReserved0=0x0, dwReserved1=0x0, cFileName="localstore.rdf", cAlternateFileName="LOCALS~1.RDF")) returned 1
	[0098.235] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x0, dwReserved1=0x0, cFileName="marionette.log", cAlternateFileName="MARION~1.LOG")) returned 1
	[0098.235] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb50b6e70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5175550, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb5175550, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="mimeTypes.rdf", cAlternateFileName="MIMETY~1.RDF")) returned 1
	[0098.240] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="minidumps", cAlternateFileName="MINIDU~1")) returned 1
	[0098.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", lpFilePart=0x0) returned 0x61
	[0098.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\", lpFilePart=0x0) returned 0x62
	[0098.241] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0098.245] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.245] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.245] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0098.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", lpFilePart=0x0) returned 0x61
	[0098.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\", lpFilePart=0x0) returned 0x62
	[0098.249] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0098.250] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.250] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0098.250] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0098.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Decrypt.txt", lpFilePart=0x0) returned 0x6d
	[0098.251] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\minidumps\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0098.252] GetFileType (hFile=0x22c) returned 0x1
	[0098.252] GetFileType (hFile=0x22c) returned 0x1
	[0098.252] WriteFile (in: hFile=0x22c, lpBuffer=0x2725c7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2725c7c*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0098.256] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 1
	[0098.256] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb43eb830, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb43eb830, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3b3f6e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="permissions.sqlite", cAlternateFileName="PERMIS~1.SQL")) returned 1
	[0098.256] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4c1a3d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4c1a3d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x82b58970, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa00000, dwReserved0=0x0, dwReserved1=0x0, cFileName="places.sqlite", cAlternateFileName="PLACES~1.SQL")) returned 1
	[0098.257] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81fbde30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81fbde30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81fbde30, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 1
	[0098.257] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84c85c10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x853f60d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x12069be0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0xfde, dwReserved0=0x0, dwReserved1=0x0, cFileName="prefs.js", cAlternateFileName="")) returned 1
	[0098.258] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4183, dwReserved0=0x0, dwReserved1=0x0, cFileName="search.json", cAlternateFileName="SEARCH~1.JSO")) returned 1
	[0098.258] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb477d930, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb477d930, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb47c9bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="secmod.db", cAlternateFileName="")) returned 1
	[0098.259] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc3787480, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3787480, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="sessionstore.bak", cAlternateFileName="SESSIO~1.BAK")) returned 1
	[0098.259] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x84e029d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x84e029d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 1
	[0098.260] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6f36850, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x50000, dwReserved0=0x0, dwReserved1=0x0, cFileName="signons.sqlite", cAlternateFileName="SIGNON~1.SQL")) returned 1
	[0098.260] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 1
	[0098.261] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="webapps", cAlternateFileName="")) returned 1
	[0098.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", lpFilePart=0x0) returned 0x5f
	[0098.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\", lpFilePart=0x0) returned 0x60
	[0098.261] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0098.263] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.264] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 1
	[0098.264] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 0
	[0098.265] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0098.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", lpFilePart=0x0) returned 0x5f
	[0098.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\", lpFilePart=0x0) returned 0x60
	[0098.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0098.266] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.266] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 1
	[0098.266] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.267] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0098.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Decrypt.txt", lpFilePart=0x0) returned 0x6b
	[0098.267] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0098.268] GetFileType (hFile=0x22c) returned 0x1
	[0098.268] GetFileType (hFile=0x22c) returned 0x1
	[0098.269] WriteFile (in: hFile=0x22c, lpBuffer=0x272bda0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x272bda0*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0098.272] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 1
	[0098.272] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 0
	[0098.273] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0098.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x57
	[0098.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpFilePart=0x0) returned 0x58
	[0098.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0098.274] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.274] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb76a6d10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb76a6d10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb76a6d10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 1
	[0098.274] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb403750, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb403750, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bookmarkbackups", cAlternateFileName="BOOKMA~1")) returned 1
	[0098.275] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb47c9bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb47c9bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cert8.db", cAlternateFileName="")) returned 1
	[0098.275] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 1
	[0098.276] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5e8ce50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5e8ce50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb639bd10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-prefs.sqlite", cAlternateFileName="CONTEN~1.SQL")) returned 1
	[0098.276] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5ad4bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5ad4bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x83256a10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cookies.sqlite", cAlternateFileName="COOKIE~1.SQL")) returned 1
	[0098.276] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc374ed0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc374ed0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbc555e20, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="downloads.sqlite", cAlternateFileName="DOWNLO~1.SQL")) returned 1
	[0098.277] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4b81e50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4b81e50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b81e50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensions.ini", cAlternateFileName="EXTENS~1.INI")) returned 1
	[0098.277] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb45b48b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b0fa30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x70000, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensions.sqlite", cAlternateFileName="EXTENS~1.SQL")) returned 1
	[0098.278] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb49bcd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb49bcd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="indexedDB", cAlternateFileName="INDEXE~1")) returned 1
	[0098.278] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4815eb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4815eb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="key3.db", cAlternateFileName="")) returned 1
	[0098.278] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x850d63f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x850d63f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x850d63f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x501, dwReserved0=0x0, dwReserved1=0x0, cFileName="localstore.rdf", cAlternateFileName="LOCALS~1.RDF")) returned 1
	[0098.284] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x0, dwReserved1=0x0, cFileName="marionette.log", cAlternateFileName="MARION~1.LOG")) returned 1
	[0098.284] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb50b6e70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5175550, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb5175550, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="mimeTypes.rdf", cAlternateFileName="MIMETY~1.RDF")) returned 1
	[0098.284] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb853f30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb853f30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="minidumps", cAlternateFileName="MINIDU~1")) returned 1
	[0098.285] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 1
	[0098.285] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb43eb830, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb43eb830, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3b3f6e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="permissions.sqlite", cAlternateFileName="PERMIS~1.SQL")) returned 1
	[0098.285] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4c1a3d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4c1a3d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x82b58970, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa00000, dwReserved0=0x0, dwReserved1=0x0, cFileName="places.sqlite", cAlternateFileName="PLACES~1.SQL")) returned 1
	[0098.285] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81fbde30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81fbde30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81fbde30, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 1
	[0098.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat", lpFilePart=0x0) returned 0x65
	[0098.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0098.286] GetFileType (hFile=0x22c) returned 0x1
	[0098.286] GetFileType (hFile=0x22c) returned 0x1
	[0098.286] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xe14
	[0098.287] ReadFile (in: hFile=0x22c, lpBuffer=0x2734460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x2734460*, lpNumberOfBytesRead=0x26eca4*=0xe14, lpOverlapped=0x0) returned 1
	[0098.291] CloseHandle (hObject=0x22c) returned 1
	[0098.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat.KEKW", lpFilePart=0x0) returned 0x6a
	[0098.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0098.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0098.293] GetFileType (hFile=0x22c) returned 0x1
	[0098.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0098.294] GetFileType (hFile=0x22c) returned 0x1
	[0098.294] WriteFile (in: hFile=0x22c, lpBuffer=0x2736bec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x2736bec*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0098.297] CloseHandle (hObject=0x22c) returned 1
	[0098.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat", lpFilePart=0x0) returned 0x65
	[0098.297] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\pluginreg.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\pluginreg.dat")) returned 1
	[0098.300] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84c85c10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x853f60d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x12069be0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0xfde, dwReserved0=0x0, dwReserved1=0x0, cFileName="prefs.js", cAlternateFileName="")) returned 1
	[0098.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", lpFilePart=0x0) returned 0x60
	[0098.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0098.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0098.303] GetFileType (hFile=0x22c) returned 0x1
	[0098.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0098.303] GetFileType (hFile=0x22c) returned 0x1
	[0098.304] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xfde
	[0098.304] ReadFile (in: hFile=0x22c, lpBuffer=0x27392c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27392c8*, lpNumberOfBytesRead=0x26eca4*=0xfde, lpOverlapped=0x0) returned 1
	[0098.308] CloseHandle (hObject=0x22c) returned 1
	[0098.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.KEKW", lpFilePart=0x0) returned 0x65
	[0098.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0098.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0098.309] GetFileType (hFile=0x22c) returned 0x1
	[0098.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0098.310] GetFileType (hFile=0x22c) returned 0x1
	[0098.310] WriteFile (in: hFile=0x22c, lpBuffer=0x273ba30*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x273ba30*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0098.313] CloseHandle (hObject=0x22c) returned 1
	[0098.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", lpFilePart=0x0) returned 0x60
	[0098.314] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js")) returned 1
	[0098.317] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4183, dwReserved0=0x0, dwReserved1=0x0, cFileName="search.json", cAlternateFileName="SEARCH~1.JSO")) returned 1
	[0098.318] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb477d930, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb477d930, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb47c9bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="secmod.db", cAlternateFileName="")) returned 1
	[0098.318] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc3787480, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3787480, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="sessionstore.bak", cAlternateFileName="SESSIO~1.BAK")) returned 1
	[0098.319] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x84e029d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x84e029d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 1
	[0098.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", lpFilePart=0x0) returned 0x67
	[0098.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0098.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0098.325] GetFileType (hFile=0x22c) returned 0x1
	[0098.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0098.325] GetFileType (hFile=0x22c) returned 0x1
	[0098.325] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xbc5
	[0098.325] ReadFile (in: hFile=0x22c, lpBuffer=0x273ec94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x273ec94*, lpNumberOfBytesRead=0x26eca4*=0xbc5, lpOverlapped=0x0) returned 1
	[0098.330] CloseHandle (hObject=0x22c) returned 1
	[0098.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.KEKW", lpFilePart=0x0) returned 0x6c
	[0098.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0098.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0098.332] GetFileType (hFile=0x22c) returned 0x1
	[0098.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0098.332] GetFileType (hFile=0x22c) returned 0x1
	[0098.332] WriteFile (in: hFile=0x22c, lpBuffer=0x274142c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x274142c*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0098.335] CloseHandle (hObject=0x22c) returned 1
	[0098.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", lpFilePart=0x0) returned 0x67
	[0098.335] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js")) returned 1
	[0098.338] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6f36850, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x50000, dwReserved0=0x0, dwReserved1=0x0, cFileName="signons.sqlite", cAlternateFileName="SIGNON~1.SQL")) returned 1
	[0098.339] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 1
	[0098.339] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8a01f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb8a01f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="webapps", cAlternateFileName="")) returned 1
	[0098.340] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 1
	[0098.341] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.341] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0098.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0098.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0098.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0098.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0098.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0098.343] GetFileType (hFile=0x228) returned 0x1
	[0098.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0098.343] GetFileType (hFile=0x228) returned 0x1
	[0098.343] WriteFile (in: hFile=0x228, lpBuffer=0x2744d70*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2744d70*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0098.347] CloseHandle (hObject=0x228) returned 1
	[0098.347] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.347] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0098.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0098.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0098.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0098.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46
	[0098.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x47
	[0098.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0098.349] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.349] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb938770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb938770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1
	[0098.350] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb938770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb938770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0
	[0098.350] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0098.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0098.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0098.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0098.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0098.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0098.352] GetFileType (hFile=0x224) returned 0x1
	[0098.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0098.352] GetFileType (hFile=0x224) returned 0x1
	[0098.352] WriteFile (in: hFile=0x224, lpBuffer=0x27480cc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27480cc*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0098.355] CloseHandle (hObject=0x224) returned 1
	[0098.356] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="profiles.ini", cAlternateFileName="")) returned 1
	[0098.356] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="profiles.ini", cAlternateFileName="")) returned 0
	[0098.357] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0098.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0098.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0098.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0098.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3d
	[0098.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3e
	[0098.358] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0098.358] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.359] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb391330, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb391330, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crash Reports", cAlternateFileName="CRASHR~1")) returned 1
	[0098.359] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb95e8d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb95e8d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0098.360] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="profiles.ini", cAlternateFileName="")) returned 1
	[0098.360] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.364] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0098.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0098.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0098.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0098.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0098.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0098.366] GetFileType (hFile=0x220) returned 0x1
	[0098.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0098.366] GetFileType (hFile=0x220) returned 0x1
	[0098.366] WriteFile (in: hFile=0x220, lpBuffer=0x274b968*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x274b968*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0098.369] CloseHandle (hObject=0x220) returned 1
	[0098.369] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.370] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0098.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0098.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0098.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0098.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x35
	[0098.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\", lpFilePart=0x0) returned 0x36
	[0098.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0098.371] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.372] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb36b1d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb36b1d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1
	[0098.373] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb984a30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb984a30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1
	[0098.373] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb984a30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb984a30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 0
	[0098.373] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0098.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0098.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0098.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0098.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0098.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0098.375] GetFileType (hFile=0x208) returned 0x1
	[0098.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0098.375] GetFileType (hFile=0x208) returned 0x1
	[0098.376] WriteFile (in: hFile=0x208, lpBuffer=0x274eb50*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x274eb50*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0098.379] CloseHandle (hObject=0x208) returned 1
	[0098.379] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58ee33f0, ftCreationTime.dwHighDateTime=0x1d5e4bf, ftLastAccessTime.dwLowDateTime=0xf9cf1620, ftLastAccessTime.dwHighDateTime=0x1d5d9a4, ftLastWriteTime.dwLowDateTime=0xf9cf1620, ftLastWriteTime.dwHighDateTime=0x1d5d9a4, nFileSizeHigh=0x0, nFileSizeLow=0xf4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NX MfFno Qo.csv", cAlternateFileName="NXMFFN~1.CSV")) returned 1
	[0098.380] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76403ac0, ftCreationTime.dwHighDateTime=0x1d5da74, ftLastAccessTime.dwLowDateTime=0xb6a49030, ftLastAccessTime.dwHighDateTime=0x1d5e1c6, ftLastWriteTime.dwLowDateTime=0xb6a49030, ftLastWriteTime.dwHighDateTime=0x1d5e1c6, nFileSizeHigh=0x0, nFileSizeLow=0xf63a, dwReserved0=0x0, dwReserved1=0x0, cFileName="nYIyxD_m.flv", cAlternateFileName="")) returned 1
	[0098.380] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc934d6d0, ftCreationTime.dwHighDateTime=0x1d5dcf1, ftLastAccessTime.dwLowDateTime=0x81298d00, ftLastAccessTime.dwHighDateTime=0x1d5e49d, ftLastWriteTime.dwLowDateTime=0x81298d00, ftLastWriteTime.dwHighDateTime=0x1d5e49d, nFileSizeHigh=0x0, nFileSizeLow=0x186a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="oaXCLvTR.png", cAlternateFileName="")) returned 1
	[0098.381] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a5eeb50, ftCreationTime.dwHighDateTime=0x1d5dcb8, ftLastAccessTime.dwLowDateTime=0x507a98a0, ftLastAccessTime.dwHighDateTime=0x1d5dac2, ftLastWriteTime.dwLowDateTime=0x507a98a0, ftLastWriteTime.dwHighDateTime=0x1d5dac2, nFileSizeHigh=0x0, nFileSizeLow=0x59b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="odsU6e1_1_zLFVicos.mkv", cAlternateFileName="ODSU6E~1.MKV")) returned 1
	[0098.381] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd535b330, ftCreationTime.dwHighDateTime=0x1d5da9b, ftLastAccessTime.dwLowDateTime=0x55d1e8b0, ftLastAccessTime.dwHighDateTime=0x1d5e744, ftLastWriteTime.dwLowDateTime=0x55d1e8b0, ftLastWriteTime.dwHighDateTime=0x1d5e744, nFileSizeHigh=0x0, nFileSizeLow=0xc5dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pdl SJ2-ibz3Kq9zAy.avi", cAlternateFileName="PDLSJ2~1.AVI")) returned 1
	[0098.382] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1aeb16c0, ftCreationTime.dwHighDateTime=0x1d5df80, ftLastAccessTime.dwLowDateTime=0xc9c1290, ftLastAccessTime.dwHighDateTime=0x1d5e471, ftLastWriteTime.dwLowDateTime=0xc9c1290, ftLastWriteTime.dwHighDateTime=0x1d5e471, nFileSizeHigh=0x0, nFileSizeLow=0x3821, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph0y5eXuleMd2w.mp3", cAlternateFileName="PH0Y5E~1.MP3")) returned 1
	[0098.382] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9956ac0, ftCreationTime.dwHighDateTime=0x1d5e488, ftLastAccessTime.dwLowDateTime=0x9679ad40, ftLastAccessTime.dwHighDateTime=0x1d5e3b5, ftLastWriteTime.dwLowDateTime=0x9679ad40, ftLastWriteTime.dwHighDateTime=0x1d5e3b5, nFileSizeHigh=0x0, nFileSizeLow=0xf4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="rJMVpzJX7aYmRu3CC.csv", cAlternateFileName="RJMVPZ~1.CSV")) returned 1
	[0098.383] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea29b230, ftCreationTime.dwHighDateTime=0x1d5da8e, ftLastAccessTime.dwLowDateTime=0x4ad66590, ftLastAccessTime.dwHighDateTime=0x1d5e7b1, ftLastWriteTime.dwLowDateTime=0x4ad66590, ftLastWriteTime.dwHighDateTime=0x1d5e7b1, nFileSizeHigh=0x0, nFileSizeLow=0x7ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S8hDa.wav", cAlternateFileName="")) returned 1
	[0098.384] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3fe3130, ftCreationTime.dwHighDateTime=0x1d5e0c8, ftLastAccessTime.dwLowDateTime=0x86a27e50, ftLastAccessTime.dwHighDateTime=0x1d5e7e9, ftLastWriteTime.dwLowDateTime=0x86a27e50, ftLastWriteTime.dwHighDateTime=0x1d5e7e9, nFileSizeHigh=0x0, nFileSizeLow=0x8483, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfAwhHD-lx.odp", cAlternateFileName="SFAWHH~1.ODP")) returned 1
	[0098.384] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28fd5db0, ftCreationTime.dwHighDateTime=0x1d5e690, ftLastAccessTime.dwLowDateTime=0x1379e9b0, ftLastAccessTime.dwHighDateTime=0x1d5e50d, ftLastWriteTime.dwLowDateTime=0x1379e9b0, ftLastWriteTime.dwHighDateTime=0x1d5e50d, nFileSizeHigh=0x0, nFileSizeLow=0x10408, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk0Kq.jpg", cAlternateFileName="")) returned 1
	[0098.385] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54142570, ftCreationTime.dwHighDateTime=0x1d5e67b, ftLastAccessTime.dwLowDateTime=0x261f8dc0, ftLastAccessTime.dwHighDateTime=0x1d5da3d, ftLastWriteTime.dwLowDateTime=0x261f8dc0, ftLastWriteTime.dwHighDateTime=0x1d5da3d, nFileSizeHigh=0x0, nFileSizeLow=0x21d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="tM0e4eTi2T7dYo-EKo.gif", cAlternateFileName="TM0E4E~1.GIF")) returned 1
	[0098.385] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9809e80, ftCreationTime.dwHighDateTime=0x1d5df64, ftLastAccessTime.dwLowDateTime=0x2e6a2730, ftLastAccessTime.dwHighDateTime=0x1d5dacc, ftLastWriteTime.dwLowDateTime=0x2e6a2730, ftLastWriteTime.dwHighDateTime=0x1d5dacc, nFileSizeHigh=0x0, nFileSizeLow=0x89fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tn1bYj1wt.mkv", cAlternateFileName="TN1BYJ~1.MKV")) returned 1
	[0098.386] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4b145e60, ftCreationTime.dwHighDateTime=0x1d5dfad, ftLastAccessTime.dwLowDateTime=0xfd2c5a30, ftLastAccessTime.dwHighDateTime=0x1d5e642, ftLastWriteTime.dwLowDateTime=0xfd2c5a30, ftLastWriteTime.dwHighDateTime=0x1d5e642, nFileSizeHigh=0x0, nFileSizeLow=0x8d06, dwReserved0=0x0, dwReserved1=0x0, cFileName="tY-Hbt1Tur.bmp", cAlternateFileName="TY-HBT~1.BMP")) returned 1
	[0098.387] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93f575c0, ftCreationTime.dwHighDateTime=0x1d5d7b4, ftLastAccessTime.dwLowDateTime=0xfb965fe0, ftLastAccessTime.dwHighDateTime=0x1d5e59d, ftLastWriteTime.dwLowDateTime=0xfb965fe0, ftLastWriteTime.dwHighDateTime=0x1d5e59d, nFileSizeHigh=0x0, nFileSizeLow=0x16096, dwReserved0=0x0, dwReserved1=0x0, cFileName="uc3b5mzL6Hsz.gif", cAlternateFileName="UC3B5M~1.GIF")) returned 1
	[0098.387] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b4027f0, ftCreationTime.dwHighDateTime=0x1d5db01, ftLastAccessTime.dwLowDateTime=0xdf8d25b0, ftLastAccessTime.dwHighDateTime=0x1d5dfe2, ftLastWriteTime.dwLowDateTime=0xdf8d25b0, ftLastWriteTime.dwHighDateTime=0x1d5dfe2, nFileSizeHigh=0x0, nFileSizeLow=0x189d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="W0hOuwKQL6 VMole2oOx.wav", cAlternateFileName="W0HOUW~1.WAV")) returned 1
	[0098.388] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45de0340, ftCreationTime.dwHighDateTime=0x1d5e3d3, ftLastAccessTime.dwLowDateTime=0x46a0b3e0, ftLastAccessTime.dwHighDateTime=0x1d5e7ed, ftLastWriteTime.dwLowDateTime=0x46a0b3e0, ftLastWriteTime.dwHighDateTime=0x1d5e7ed, nFileSizeHigh=0x0, nFileSizeLow=0xbd49, dwReserved0=0x0, dwReserved1=0x0, cFileName="XJsm_wz.jpg", cAlternateFileName="")) returned 1
	[0098.388] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x73a4d470, ftCreationTime.dwHighDateTime=0x1d5e0cc, ftLastAccessTime.dwLowDateTime=0xb025b850, ftLastAccessTime.dwHighDateTime=0x1d5de11, ftLastWriteTime.dwLowDateTime=0xb025b850, ftLastWriteTime.dwHighDateTime=0x1d5de11, nFileSizeHigh=0x0, nFileSizeLow=0xcef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZnJGTgjvmiO4bs5S1.csv", cAlternateFileName="ZNJGTG~1.CSV")) returned 1
	[0098.389] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadd79a50, ftCreationTime.dwHighDateTime=0x1d5d8c6, ftLastAccessTime.dwLowDateTime=0xd6f41a90, ftLastAccessTime.dwHighDateTime=0x1d5dc94, ftLastWriteTime.dwLowDateTime=0xd6f41a90, ftLastWriteTime.dwHighDateTime=0x1d5dc94, nFileSizeHigh=0x0, nFileSizeLow=0xbb5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="_soZEeiKVmqW7eH4Z3.gif", cAlternateFileName="_SOZEE~1.GIF")) returned 1
	[0098.389] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadd79a50, ftCreationTime.dwHighDateTime=0x1d5d8c6, ftLastAccessTime.dwLowDateTime=0xd6f41a90, ftLastAccessTime.dwHighDateTime=0x1d5dc94, ftLastWriteTime.dwLowDateTime=0xd6f41a90, ftLastWriteTime.dwHighDateTime=0x1d5dc94, nFileSizeHigh=0x0, nFileSizeLow=0xbb5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="_soZEeiKVmqW7eH4Z3.gif", cAlternateFileName="_SOZEE~1.GIF")) returned 0
	[0098.390] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0098.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0098.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0098.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0098.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d
	[0098.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x2e
	[0098.391] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdac06ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdac06ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0098.392] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdac06ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdac06ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.392] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x905ea200, ftCreationTime.dwHighDateTime=0x1d5e2fa, ftLastAccessTime.dwLowDateTime=0x15747df0, ftLastAccessTime.dwHighDateTime=0x1d5d998, ftLastWriteTime.dwLowDateTime=0x15747df0, ftLastWriteTime.dwHighDateTime=0x1d5d998, nFileSizeHigh=0x0, nFileSizeLow=0xb4fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="-lT9_uq1-.flv", cAlternateFileName="-LT9_U~1.FLV")) returned 1
	[0098.393] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x22603100, ftCreationTime.dwHighDateTime=0x1d5dfbd, ftLastAccessTime.dwLowDateTime=0xf30dcf00, ftLastAccessTime.dwHighDateTime=0x1d5e11c, ftLastWriteTime.dwLowDateTime=0xf30dcf00, ftLastWriteTime.dwHighDateTime=0x1d5e11c, nFileSizeHigh=0x0, nFileSizeLow=0x696e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0oMddQ.wav", cAlternateFileName="")) returned 1
	[0098.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0oMddQ.wav", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0oMddQ.wav", lpFilePart=0x0) returned 0x38
	[0098.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0oMddQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0omddq.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.394] GetFileType (hFile=0x208) returned 0x1
	[0098.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.394] GetFileType (hFile=0x208) returned 0x1
	[0098.395] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x696e
	[0098.395] ReadFile (in: hFile=0x208, lpBuffer=0x27525ac, nNumberOfBytesToRead=0x696e, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27525ac*, lpNumberOfBytesRead=0x26ef24*=0x696e, lpOverlapped=0x0) returned 1
	[0098.398] CloseHandle (hObject=0x208) returned 1
	[0098.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0oMddQ.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0oMddQ.wav.KEKW", lpFilePart=0x0) returned 0x3d
	[0098.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0oMddQ.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0omddq.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.400] GetFileType (hFile=0x208) returned 0x1
	[0098.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.401] GetFileType (hFile=0x208) returned 0x1
	[0098.401] WriteFile (in: hFile=0x208, lpBuffer=0x275a5e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x275a5e8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.404] CloseHandle (hObject=0x208) returned 1
	[0098.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0oMddQ.wav", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0oMddQ.wav", lpFilePart=0x0) returned 0x38
	[0098.405] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0oMddQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0omddq.wav")) returned 1
	[0098.419] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfd894350, ftCreationTime.dwHighDateTime=0x1d5e339, ftLastAccessTime.dwLowDateTime=0x70799bc0, ftLastAccessTime.dwHighDateTime=0x1d5daa3, ftLastWriteTime.dwLowDateTime=0x70799bc0, ftLastWriteTime.dwHighDateTime=0x1d5daa3, nFileSizeHigh=0x0, nFileSizeLow=0xff6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="62Utxu9NUwhcX.wav", cAlternateFileName="62UTXU~1.WAV")) returned 1
	[0098.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62Utxu9NUwhcX.wav", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62Utxu9NUwhcX.wav", lpFilePart=0x0) returned 0x3f
	[0098.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62Utxu9NUwhcX.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\62utxu9nuwhcx.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.420] GetFileType (hFile=0x208) returned 0x1
	[0098.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.420] GetFileType (hFile=0x208) returned 0x1
	[0098.420] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xff6f
	[0098.421] ReadFile (in: hFile=0x208, lpBuffer=0x275bb24, nNumberOfBytesToRead=0xff6f, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x275bb24*, lpNumberOfBytesRead=0x26ef24*=0xff6f, lpOverlapped=0x0) returned 1
	[0098.425] CloseHandle (hObject=0x208) returned 1
	[0098.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62Utxu9NUwhcX.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62Utxu9NUwhcX.wav.KEKW", lpFilePart=0x0) returned 0x44
	[0098.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62Utxu9NUwhcX.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\62utxu9nuwhcx.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.427] GetFileType (hFile=0x208) returned 0x1
	[0098.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.427] GetFileType (hFile=0x208) returned 0x1
	[0098.427] WriteFile (in: hFile=0x208, lpBuffer=0x276d190*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x276d190*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.430] CloseHandle (hObject=0x208) returned 1
	[0098.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62Utxu9NUwhcX.wav", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62Utxu9NUwhcX.wav", lpFilePart=0x0) returned 0x3f
	[0098.431] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\62Utxu9NUwhcX.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\62utxu9nuwhcx.wav")) returned 1
	[0098.435] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1bd88ab0, ftCreationTime.dwHighDateTime=0x1d5e096, ftLastAccessTime.dwLowDateTime=0xbe63f570, ftLastAccessTime.dwHighDateTime=0x1d5e51a, ftLastWriteTime.dwLowDateTime=0xbe63f570, ftLastWriteTime.dwHighDateTime=0x1d5e51a, nFileSizeHigh=0x0, nFileSizeLow=0xb064, dwReserved0=0x0, dwReserved1=0x0, cFileName="7hKMeTzpTC84je4RH.mp4", cAlternateFileName="7HKMET~1.MP4")) returned 1
	[0098.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7hKMeTzpTC84je4RH.mp4", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7hKMeTzpTC84je4RH.mp4", lpFilePart=0x0) returned 0x43
	[0098.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.436] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7hKMeTzpTC84je4RH.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7hkmetzptc84je4rh.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.436] GetFileType (hFile=0x208) returned 0x1
	[0098.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.436] GetFileType (hFile=0x208) returned 0x1
	[0098.437] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xb064
	[0098.437] ReadFile (in: hFile=0x208, lpBuffer=0x276e718, nNumberOfBytesToRead=0xb064, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x276e718*, lpNumberOfBytesRead=0x26ef24*=0xb064, lpOverlapped=0x0) returned 1
	[0098.467] CloseHandle (hObject=0x208) returned 1
	[0098.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7hKMeTzpTC84je4RH.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7hKMeTzpTC84je4RH.mp4.KEKW", lpFilePart=0x0) returned 0x48
	[0098.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7hKMeTzpTC84je4RH.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7hkmetzptc84je4rh.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.470] GetFileType (hFile=0x208) returned 0x1
	[0098.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.470] GetFileType (hFile=0x208) returned 0x1
	[0098.470] WriteFile (in: hFile=0x208, lpBuffer=0x277ae90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x277ae90*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.474] CloseHandle (hObject=0x208) returned 1
	[0098.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7hKMeTzpTC84je4RH.mp4", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7hKMeTzpTC84je4RH.mp4", lpFilePart=0x0) returned 0x43
	[0098.474] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7hKMeTzpTC84je4RH.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7hkmetzptc84je4rh.mp4")) returned 1
	[0098.479] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x9700b30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9700b30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0098.479] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ad185e0, ftCreationTime.dwHighDateTime=0x1d5da9f, ftLastAccessTime.dwLowDateTime=0x259524b0, ftLastAccessTime.dwHighDateTime=0x1d5da14, ftLastWriteTime.dwLowDateTime=0x259524b0, ftLastWriteTime.dwHighDateTime=0x1d5da14, nFileSizeHigh=0x0, nFileSizeLow=0x9876, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ad_8oHDleju7gjQPCKa.doc", cAlternateFileName="AD_8OH~1.DOC")) returned 1
	[0098.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ad_8oHDleju7gjQPCKa.doc", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ad_8oHDleju7gjQPCKa.doc", lpFilePart=0x0) returned 0x45
	[0098.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ad_8oHDleju7gjQPCKa.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ad_8ohdleju7gjqpcka.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.480] GetFileType (hFile=0x208) returned 0x1
	[0098.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.481] GetFileType (hFile=0x208) returned 0x1
	[0098.481] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x9876
	[0098.481] ReadFile (in: hFile=0x208, lpBuffer=0x277c554, nNumberOfBytesToRead=0x9876, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x277c554*, lpNumberOfBytesRead=0x26ef24*=0x9876, lpOverlapped=0x0) returned 1
	[0098.485] CloseHandle (hObject=0x208) returned 1
	[0098.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ad_8oHDleju7gjQPCKa.doc.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ad_8oHDleju7gjQPCKa.doc.KEKW", lpFilePart=0x0) returned 0x4a
	[0098.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ad_8oHDleju7gjQPCKa.doc.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ad_8ohdleju7gjqpcka.doc.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.495] GetFileType (hFile=0x208) returned 0x1
	[0098.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.496] GetFileType (hFile=0x208) returned 0x1
	[0098.496] WriteFile (in: hFile=0x208, lpBuffer=0x27874ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27874ec*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.499] CloseHandle (hObject=0x208) returned 1
	[0098.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ad_8oHDleju7gjQPCKa.doc", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ad_8oHDleju7gjQPCKa.doc", lpFilePart=0x0) returned 0x45
	[0098.500] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ad_8oHDleju7gjQPCKa.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ad_8ohdleju7gjqpcka.doc")) returned 1
	[0098.508] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbe0ee60, ftCreationTime.dwHighDateTime=0x1d5e1af, ftLastAccessTime.dwLowDateTime=0x8ce6b650, ftLastAccessTime.dwHighDateTime=0x1d5de39, ftLastWriteTime.dwLowDateTime=0x8ce6b650, ftLastWriteTime.dwHighDateTime=0x1d5de39, nFileSizeHigh=0x0, nFileSizeLow=0x3fd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="brGd.bmp", cAlternateFileName="")) returned 1
	[0098.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brGd.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brGd.bmp", lpFilePart=0x0) returned 0x36
	[0098.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brGd.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\brgd.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.509] GetFileType (hFile=0x208) returned 0x1
	[0098.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.509] GetFileType (hFile=0x208) returned 0x1
	[0098.509] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x3fd1
	[0098.510] ReadFile (in: hFile=0x208, lpBuffer=0x2788994, nNumberOfBytesToRead=0x3fd1, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2788994*, lpNumberOfBytesRead=0x26ef24*=0x3fd1, lpOverlapped=0x0) returned 1
	[0098.512] CloseHandle (hObject=0x208) returned 1
	[0098.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brGd.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brGd.bmp.KEKW", lpFilePart=0x0) returned 0x3b
	[0098.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brGd.bmp.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\brgd.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.515] GetFileType (hFile=0x208) returned 0x1
	[0098.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.515] GetFileType (hFile=0x208) returned 0x1
	[0098.515] WriteFile (in: hFile=0x208, lpBuffer=0x278e028*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x278e028*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.519] CloseHandle (hObject=0x208) returned 1
	[0098.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brGd.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brGd.bmp", lpFilePart=0x0) returned 0x36
	[0098.519] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brGd.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\brgd.bmp")) returned 1
	[0098.525] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2aefbe00, ftCreationTime.dwHighDateTime=0x1d5df20, ftLastAccessTime.dwLowDateTime=0xe9978c80, ftLastAccessTime.dwHighDateTime=0x1d5da5b, ftLastWriteTime.dwLowDateTime=0xe9978c80, ftLastWriteTime.dwHighDateTime=0x1d5da5b, nFileSizeHigh=0x0, nFileSizeLow=0x15b34, dwReserved0=0x0, dwReserved1=0x0, cFileName="e8-QppsP1gRerkX.docx", cAlternateFileName="E8-QPP~1.DOC")) returned 1
	[0098.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e8-QppsP1gRerkX.docx", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e8-QppsP1gRerkX.docx", lpFilePart=0x0) returned 0x42
	[0098.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e8-QppsP1gRerkX.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e8-qppsp1grerkx.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.526] GetFileType (hFile=0x208) returned 0x1
	[0098.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.526] GetFileType (hFile=0x208) returned 0x1
	[0098.527] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x15b34
	[0098.528] ReadFile (in: hFile=0x208, lpBuffer=0x381b230, nNumberOfBytesToRead=0x15b34, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x381b230*, lpNumberOfBytesRead=0x26ef24*=0x15b34, lpOverlapped=0x0) returned 1
	[0098.537] CloseHandle (hObject=0x208) returned 1
	[0098.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e8-QppsP1gRerkX.docx.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e8-QppsP1gRerkX.docx.KEKW", lpFilePart=0x0) returned 0x47
	[0098.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e8-QppsP1gRerkX.docx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e8-qppsp1grerkx.docx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.539] GetFileType (hFile=0x208) returned 0x1
	[0098.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.540] GetFileType (hFile=0x208) returned 0x1
	[0098.540] WriteFile (in: hFile=0x208, lpBuffer=0x2790c9c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2790c9c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.543] CloseHandle (hObject=0x208) returned 1
	[0098.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e8-QppsP1gRerkX.docx", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e8-QppsP1gRerkX.docx", lpFilePart=0x0) returned 0x42
	[0098.544] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e8-QppsP1gRerkX.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e8-qppsp1grerkx.docx")) returned 1
	[0098.550] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaedb9960, ftCreationTime.dwHighDateTime=0x1d5dbd2, ftLastAccessTime.dwLowDateTime=0xe39cc9b0, ftLastAccessTime.dwHighDateTime=0x1d5df62, ftLastWriteTime.dwLowDateTime=0xe39cc9b0, ftLastWriteTime.dwHighDateTime=0x1d5df62, nFileSizeHigh=0x0, nFileSizeLow=0x10729, dwReserved0=0x0, dwReserved1=0x0, cFileName="EdSmxMO3CqQAXI.m4a", cAlternateFileName="EDSMXM~1.M4A")) returned 1
	[0098.551] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xacf5f430, ftCreationTime.dwHighDateTime=0x1d5e34b, ftLastAccessTime.dwLowDateTime=0x94805c40, ftLastAccessTime.dwHighDateTime=0x1d5d957, ftLastWriteTime.dwLowDateTime=0x94805c40, ftLastWriteTime.dwHighDateTime=0x1d5d957, nFileSizeHigh=0x0, nFileSizeLow=0x17896, dwReserved0=0x0, dwReserved1=0x0, cFileName="gFCGzFABqRtfbthg.jpg", cAlternateFileName="GFCGZF~1.JPG")) returned 1
	[0098.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gFCGzFABqRtfbthg.jpg", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gFCGzFABqRtfbthg.jpg", lpFilePart=0x0) returned 0x42
	[0098.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gFCGzFABqRtfbthg.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gfcgzfabqrtfbthg.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.552] GetFileType (hFile=0x208) returned 0x1
	[0098.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.552] GetFileType (hFile=0x208) returned 0x1
	[0098.553] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x17896
	[0098.553] ReadFile (in: hFile=0x208, lpBuffer=0x3830d80, nNumberOfBytesToRead=0x17896, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x3830d80*, lpNumberOfBytesRead=0x26ef24*=0x17896, lpOverlapped=0x0) returned 1
	[0098.561] CloseHandle (hObject=0x208) returned 1
	[0098.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gFCGzFABqRtfbthg.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gFCGzFABqRtfbthg.jpg.KEKW", lpFilePart=0x0) returned 0x47
	[0098.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.561] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gFCGzFABqRtfbthg.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gfcgzfabqrtfbthg.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.563] GetFileType (hFile=0x208) returned 0x1
	[0098.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.563] GetFileType (hFile=0x208) returned 0x1
	[0098.564] WriteFile (in: hFile=0x208, lpBuffer=0x2793cd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2793cd0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gFCGzFABqRtfbthg.jpg", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gFCGzFABqRtfbthg.jpg", lpFilePart=0x0) returned 0x42
	[0098.570] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gFCGzFABqRtfbthg.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gfcgzfabqrtfbthg.jpg")) returned 1
	[0098.578] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfde73610, ftCreationTime.dwHighDateTime=0x1d5d95a, ftLastAccessTime.dwLowDateTime=0xcc8b6ec0, ftLastAccessTime.dwHighDateTime=0x1d5e3ea, ftLastWriteTime.dwLowDateTime=0xcc8b6ec0, ftLastWriteTime.dwHighDateTime=0x1d5e3ea, nFileSizeHigh=0x0, nFileSizeLow=0x12af8, dwReserved0=0x0, dwReserved1=0x0, cFileName="heRZc55brEskdRX.flv", cAlternateFileName="HERZC5~1.FLV")) returned 1
	[0098.578] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc5835560, ftCreationTime.dwHighDateTime=0x1d5e274, ftLastAccessTime.dwLowDateTime=0xf3f29e70, ftLastAccessTime.dwHighDateTime=0x1d5e345, ftLastWriteTime.dwLowDateTime=0xf3f29e70, ftLastWriteTime.dwHighDateTime=0x1d5e345, nFileSizeHigh=0x0, nFileSizeLow=0x130df, dwReserved0=0x0, dwReserved1=0x0, cFileName="HPtpTBGwP6FaWD8QXb.m4a", cAlternateFileName="HPTPTB~1.M4A")) returned 1
	[0098.579] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9726c90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x9726c90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1
	[0098.580] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4a24d850, ftCreationTime.dwHighDateTime=0x1d5e0ec, ftLastAccessTime.dwLowDateTime=0x3c4c8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e74f, ftLastWriteTime.dwLowDateTime=0x3c4c8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e74f, nFileSizeHigh=0x0, nFileSizeLow=0x17146, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdNpk1x8AE0NOqJjSc5n.avi", cAlternateFileName="JDNPK1~1.AVI")) returned 1
	[0098.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jdNpk1x8AE0NOqJjSc5n.avi", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jdNpk1x8AE0NOqJjSc5n.avi", lpFilePart=0x0) returned 0x46
	[0098.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jdNpk1x8AE0NOqJjSc5n.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jdnpk1x8ae0noqjjsc5n.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.581] GetFileType (hFile=0x208) returned 0x1
	[0098.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.582] GetFileType (hFile=0x208) returned 0x1
	[0098.582] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x17146
	[0098.583] ReadFile (in: hFile=0x208, lpBuffer=0x3848638, nNumberOfBytesToRead=0x17146, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x3848638*, lpNumberOfBytesRead=0x26ef24*=0x17146, lpOverlapped=0x0) returned 1
	[0098.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jdNpk1x8AE0NOqJjSc5n.avi.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jdNpk1x8AE0NOqJjSc5n.avi.KEKW", lpFilePart=0x0) returned 0x4b
	[0098.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jdNpk1x8AE0NOqJjSc5n.avi.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jdnpk1x8ae0noqjjsc5n.avi.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.592] GetFileType (hFile=0x208) returned 0x1
	[0098.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.592] GetFileType (hFile=0x208) returned 0x1
	[0098.593] WriteFile (in: hFile=0x208, lpBuffer=0x2797294*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2797294*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jdNpk1x8AE0NOqJjSc5n.avi", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jdNpk1x8AE0NOqJjSc5n.avi", lpFilePart=0x0) returned 0x46
	[0098.597] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\jdNpk1x8AE0NOqJjSc5n.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\jdnpk1x8ae0noqjjsc5n.avi")) returned 1
	[0098.603] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfead4f20, ftCreationTime.dwHighDateTime=0x1d5de92, ftLastAccessTime.dwLowDateTime=0xf29b3630, ftLastAccessTime.dwHighDateTime=0x1d5dabd, ftLastWriteTime.dwLowDateTime=0xf29b3630, ftLastWriteTime.dwHighDateTime=0x1d5dabd, nFileSizeHigh=0x0, nFileSizeLow=0xa8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="KJoZDisMXpQ3iE.png", cAlternateFileName="KJOZDI~1.PNG")) returned 1
	[0098.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJoZDisMXpQ3iE.png", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJoZDisMXpQ3iE.png", lpFilePart=0x0) returned 0x40
	[0098.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJoZDisMXpQ3iE.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kjozdismxpq3ie.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.604] GetFileType (hFile=0x208) returned 0x1
	[0098.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.604] GetFileType (hFile=0x208) returned 0x1
	[0098.605] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa8fc
	[0098.605] ReadFile (in: hFile=0x208, lpBuffer=0x2798808, nNumberOfBytesToRead=0xa8fc, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2798808*, lpNumberOfBytesRead=0x26ef24*=0xa8fc, lpOverlapped=0x0) returned 1
	[0098.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJoZDisMXpQ3iE.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJoZDisMXpQ3iE.png.KEKW", lpFilePart=0x0) returned 0x45
	[0098.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJoZDisMXpQ3iE.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kjozdismxpq3ie.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.610] GetFileType (hFile=0x208) returned 0x1
	[0098.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.610] GetFileType (hFile=0x208) returned 0x1
	[0098.610] WriteFile (in: hFile=0x208, lpBuffer=0x27a4800*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27a4800*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJoZDisMXpQ3iE.png", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJoZDisMXpQ3iE.png", lpFilePart=0x0) returned 0x40
	[0098.615] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\KJoZDisMXpQ3iE.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kjozdismxpq3ie.png")) returned 1
	[0098.621] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x390d1330, ftCreationTime.dwHighDateTime=0x1d5dc45, ftLastAccessTime.dwLowDateTime=0x2eed16f0, ftLastAccessTime.dwHighDateTime=0x1d5db89, ftLastWriteTime.dwLowDateTime=0x2eed16f0, ftLastWriteTime.dwHighDateTime=0x1d5db89, nFileSizeHigh=0x0, nFileSizeLow=0xc1e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="knyNca0z5S0Hn-BxZd.mp4", cAlternateFileName="KNYNCA~1.MP4")) returned 1
	[0098.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\knyNca0z5S0Hn-BxZd.mp4", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\knyNca0z5S0Hn-BxZd.mp4", lpFilePart=0x0) returned 0x44
	[0098.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\knyNca0z5S0Hn-BxZd.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\knynca0z5s0hn-bxzd.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.622] GetFileType (hFile=0x208) returned 0x1
	[0098.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.622] GetFileType (hFile=0x208) returned 0x1
	[0098.622] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc1e2
	[0098.622] ReadFile (in: hFile=0x208, lpBuffer=0x27a5da8, nNumberOfBytesToRead=0xc1e2, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27a5da8*, lpNumberOfBytesRead=0x26ef24*=0xc1e2, lpOverlapped=0x0) returned 1
	[0098.626] CloseHandle (hObject=0x208) returned 1
	[0098.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\knyNca0z5S0Hn-BxZd.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\knyNca0z5S0Hn-BxZd.mp4.KEKW", lpFilePart=0x0) returned 0x49
	[0098.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\knyNca0z5S0Hn-BxZd.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\knynca0z5s0hn-bxzd.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.628] GetFileType (hFile=0x208) returned 0x1
	[0098.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.628] GetFileType (hFile=0x208) returned 0x1
	[0098.629] WriteFile (in: hFile=0x208, lpBuffer=0x27b36a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27b36a0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.632] CloseHandle (hObject=0x208) returned 1
	[0098.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\knyNca0z5S0Hn-BxZd.mp4", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\knyNca0z5S0Hn-BxZd.mp4", lpFilePart=0x0) returned 0x44
	[0098.632] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\knyNca0z5S0Hn-BxZd.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\knynca0z5s0hn-bxzd.mp4")) returned 1
	[0098.636] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee2d9f30, ftCreationTime.dwHighDateTime=0x1d5de68, ftLastAccessTime.dwLowDateTime=0xdc8a8860, ftLastAccessTime.dwHighDateTime=0x1d5dc92, ftLastWriteTime.dwLowDateTime=0xdc8a8860, ftLastWriteTime.dwHighDateTime=0x1d5dc92, nFileSizeHigh=0x0, nFileSizeLow=0x1fb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQ9twrZw46PHSgjvD.mkv", cAlternateFileName="KQ9TWR~1.MKV")) returned 1
	[0098.637] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83bc6110, ftCreationTime.dwHighDateTime=0x1d5ddf3, ftLastAccessTime.dwLowDateTime=0x3b2cd890, ftLastAccessTime.dwHighDateTime=0x1d5e16c, ftLastWriteTime.dwLowDateTime=0x3b2cd890, ftLastWriteTime.dwHighDateTime=0x1d5e16c, nFileSizeHigh=0x0, nFileSizeLow=0x2ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="lz2-7X1s4UwpH lnp.png", cAlternateFileName="LZ2-7X~1.PNG")) returned 1
	[0098.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lz2-7X1s4UwpH lnp.png", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lz2-7X1s4UwpH lnp.png", lpFilePart=0x0) returned 0x43
	[0098.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.638] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lz2-7X1s4UwpH lnp.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lz2-7x1s4uwph lnp.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.638] GetFileType (hFile=0x208) returned 0x1
	[0098.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.638] GetFileType (hFile=0x208) returned 0x1
	[0098.638] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x2ebc
	[0098.638] ReadFile (in: hFile=0x208, lpBuffer=0x27b4ffc, nNumberOfBytesToRead=0x2ebc, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27b4ffc*, lpNumberOfBytesRead=0x26ef24*=0x2ebc, lpOverlapped=0x0) returned 1
	[0098.642] CloseHandle (hObject=0x208) returned 1
	[0098.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lz2-7X1s4UwpH lnp.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lz2-7X1s4UwpH lnp.png.KEKW", lpFilePart=0x0) returned 0x48
	[0098.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lz2-7X1s4UwpH lnp.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lz2-7x1s4uwph lnp.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.643] GetFileType (hFile=0x208) returned 0x1
	[0098.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.644] GetFileType (hFile=0x208) returned 0x1
	[0098.644] WriteFile (in: hFile=0x208, lpBuffer=0x27b95cc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27b95cc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.647] CloseHandle (hObject=0x208) returned 1
	[0098.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lz2-7X1s4UwpH lnp.png", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lz2-7X1s4UwpH lnp.png", lpFilePart=0x0) returned 0x43
	[0098.648] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\lz2-7X1s4UwpH lnp.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lz2-7x1s4uwph lnp.png")) returned 1
	[0098.657] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x980b4d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x980b4d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1
	[0098.658] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb345070, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb345070, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0098.659] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb984a30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xb984a30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0098.659] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58ee33f0, ftCreationTime.dwHighDateTime=0x1d5e4bf, ftLastAccessTime.dwLowDateTime=0xf9cf1620, ftLastAccessTime.dwHighDateTime=0x1d5d9a4, ftLastWriteTime.dwLowDateTime=0xf9cf1620, ftLastWriteTime.dwHighDateTime=0x1d5d9a4, nFileSizeHigh=0x0, nFileSizeLow=0xf4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NX MfFno Qo.csv", cAlternateFileName="NXMFFN~1.CSV")) returned 1
	[0098.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NX MfFno Qo.csv", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NX MfFno Qo.csv", lpFilePart=0x0) returned 0x3d
	[0098.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NX MfFno Qo.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nx mffno qo.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.660] GetFileType (hFile=0x208) returned 0x1
	[0098.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.660] GetFileType (hFile=0x208) returned 0x1
	[0098.660] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xf4e6
	[0098.661] ReadFile (in: hFile=0x208, lpBuffer=0x27baec0, nNumberOfBytesToRead=0xf4e6, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27baec0*, lpNumberOfBytesRead=0x26ef24*=0xf4e6, lpOverlapped=0x0) returned 1
	[0098.664] CloseHandle (hObject=0x208) returned 1
	[0098.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NX MfFno Qo.csv.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NX MfFno Qo.csv.KEKW", lpFilePart=0x0) returned 0x42
	[0098.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NX MfFno Qo.csv.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nx mffno qo.csv.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.666] GetFileType (hFile=0x208) returned 0x1
	[0098.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.666] GetFileType (hFile=0x208) returned 0x1
	[0098.667] WriteFile (in: hFile=0x208, lpBuffer=0x27cba98*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27cba98*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.670] CloseHandle (hObject=0x208) returned 1
	[0098.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NX MfFno Qo.csv", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NX MfFno Qo.csv", lpFilePart=0x0) returned 0x3d
	[0098.670] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NX MfFno Qo.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nx mffno qo.csv")) returned 1
	[0098.676] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76403ac0, ftCreationTime.dwHighDateTime=0x1d5da74, ftLastAccessTime.dwLowDateTime=0xb6a49030, ftLastAccessTime.dwHighDateTime=0x1d5e1c6, ftLastWriteTime.dwLowDateTime=0xb6a49030, ftLastWriteTime.dwHighDateTime=0x1d5e1c6, nFileSizeHigh=0x0, nFileSizeLow=0xf63a, dwReserved0=0x0, dwReserved1=0x0, cFileName="nYIyxD_m.flv", cAlternateFileName="")) returned 1
	[0098.676] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc934d6d0, ftCreationTime.dwHighDateTime=0x1d5dcf1, ftLastAccessTime.dwLowDateTime=0x81298d00, ftLastAccessTime.dwHighDateTime=0x1d5e49d, ftLastWriteTime.dwLowDateTime=0x81298d00, ftLastWriteTime.dwHighDateTime=0x1d5e49d, nFileSizeHigh=0x0, nFileSizeLow=0x186a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="oaXCLvTR.png", cAlternateFileName="")) returned 1
	[0098.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oaXCLvTR.png", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oaXCLvTR.png", lpFilePart=0x0) returned 0x3a
	[0098.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oaXCLvTR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oaxclvtr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.677] GetFileType (hFile=0x208) returned 0x1
	[0098.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.678] GetFileType (hFile=0x208) returned 0x1
	[0098.678] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x186a4
	[0098.679] ReadFile (in: hFile=0x208, lpBuffer=0x385f7a0, nNumberOfBytesToRead=0x186a4, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x385f7a0*, lpNumberOfBytesRead=0x26ef24*=0x186a4, lpOverlapped=0x0) returned 1
	[0098.686] CloseHandle (hObject=0x208) returned 1
	[0098.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oaXCLvTR.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oaXCLvTR.png.KEKW", lpFilePart=0x0) returned 0x3f
	[0098.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oaXCLvTR.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oaxclvtr.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.688] GetFileType (hFile=0x208) returned 0x1
	[0098.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.688] GetFileType (hFile=0x208) returned 0x1
	[0098.691] WriteFile (in: hFile=0x208, lpBuffer=0x27ce978*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27ce978*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.694] CloseHandle (hObject=0x208) returned 1
	[0098.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oaXCLvTR.png", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oaXCLvTR.png", lpFilePart=0x0) returned 0x3a
	[0098.694] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oaXCLvTR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oaxclvtr.png")) returned 1
	[0098.701] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a5eeb50, ftCreationTime.dwHighDateTime=0x1d5dcb8, ftLastAccessTime.dwLowDateTime=0x507a98a0, ftLastAccessTime.dwHighDateTime=0x1d5dac2, ftLastWriteTime.dwLowDateTime=0x507a98a0, ftLastWriteTime.dwHighDateTime=0x1d5dac2, nFileSizeHigh=0x0, nFileSizeLow=0x59b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="odsU6e1_1_zLFVicos.mkv", cAlternateFileName="ODSU6E~1.MKV")) returned 1
	[0098.701] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd535b330, ftCreationTime.dwHighDateTime=0x1d5da9b, ftLastAccessTime.dwLowDateTime=0x55d1e8b0, ftLastAccessTime.dwHighDateTime=0x1d5e744, ftLastWriteTime.dwLowDateTime=0x55d1e8b0, ftLastWriteTime.dwHighDateTime=0x1d5e744, nFileSizeHigh=0x0, nFileSizeLow=0xc5dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pdl SJ2-ibz3Kq9zAy.avi", cAlternateFileName="PDLSJ2~1.AVI")) returned 1
	[0098.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Pdl SJ2-ibz3Kq9zAy.avi", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Pdl SJ2-ibz3Kq9zAy.avi", lpFilePart=0x0) returned 0x44
	[0098.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Pdl SJ2-ibz3Kq9zAy.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pdl sj2-ibz3kq9zay.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.702] GetFileType (hFile=0x208) returned 0x1
	[0098.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.703] GetFileType (hFile=0x208) returned 0x1
	[0098.703] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xc5dd
	[0098.703] ReadFile (in: hFile=0x208, lpBuffer=0x27d02f0, nNumberOfBytesToRead=0xc5dd, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27d02f0*, lpNumberOfBytesRead=0x26ef24*=0xc5dd, lpOverlapped=0x0) returned 1
	[0098.706] CloseHandle (hObject=0x208) returned 1
	[0098.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Pdl SJ2-ibz3Kq9zAy.avi.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Pdl SJ2-ibz3Kq9zAy.avi.KEKW", lpFilePart=0x0) returned 0x49
	[0098.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Pdl SJ2-ibz3Kq9zAy.avi.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pdl sj2-ibz3kq9zay.avi.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.708] GetFileType (hFile=0x208) returned 0x1
	[0098.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.708] GetFileType (hFile=0x208) returned 0x1
	[0098.709] WriteFile (in: hFile=0x208, lpBuffer=0x27ddfe4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27ddfe4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.712] CloseHandle (hObject=0x208) returned 1
	[0098.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Pdl SJ2-ibz3Kq9zAy.avi", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Pdl SJ2-ibz3Kq9zAy.avi", lpFilePart=0x0) returned 0x44
	[0098.712] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Pdl SJ2-ibz3Kq9zAy.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pdl sj2-ibz3kq9zay.avi")) returned 1
	[0098.717] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1aeb16c0, ftCreationTime.dwHighDateTime=0x1d5df80, ftLastAccessTime.dwLowDateTime=0xc9c1290, ftLastAccessTime.dwHighDateTime=0x1d5e471, ftLastWriteTime.dwLowDateTime=0xc9c1290, ftLastWriteTime.dwHighDateTime=0x1d5e471, nFileSizeHigh=0x0, nFileSizeLow=0x3821, dwReserved0=0x0, dwReserved1=0x0, cFileName="ph0y5eXuleMd2w.mp3", cAlternateFileName="PH0Y5E~1.MP3")) returned 1
	[0098.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ph0y5eXuleMd2w.mp3", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ph0y5eXuleMd2w.mp3", lpFilePart=0x0) returned 0x40
	[0098.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ph0y5eXuleMd2w.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ph0y5exulemd2w.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.718] GetFileType (hFile=0x208) returned 0x1
	[0098.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.718] GetFileType (hFile=0x208) returned 0x1
	[0098.718] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x3821
	[0098.718] ReadFile (in: hFile=0x208, lpBuffer=0x27df554, nNumberOfBytesToRead=0x3821, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27df554*, lpNumberOfBytesRead=0x26ef24*=0x3821, lpOverlapped=0x0) returned 1
	[0098.722] CloseHandle (hObject=0x208) returned 1
	[0098.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ph0y5eXuleMd2w.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ph0y5eXuleMd2w.mp3.KEKW", lpFilePart=0x0) returned 0x45
	[0098.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ph0y5eXuleMd2w.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ph0y5exulemd2w.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.723] GetFileType (hFile=0x208) returned 0x1
	[0098.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.724] GetFileType (hFile=0x208) returned 0x1
	[0098.724] WriteFile (in: hFile=0x208, lpBuffer=0x27e4474*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27e4474*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.727] CloseHandle (hObject=0x208) returned 1
	[0098.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ph0y5eXuleMd2w.mp3", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ph0y5eXuleMd2w.mp3", lpFilePart=0x0) returned 0x40
	[0098.728] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ph0y5eXuleMd2w.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ph0y5exulemd2w.mp3")) returned 1
	[0098.731] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9956ac0, ftCreationTime.dwHighDateTime=0x1d5e488, ftLastAccessTime.dwLowDateTime=0x9679ad40, ftLastAccessTime.dwHighDateTime=0x1d5e3b5, ftLastWriteTime.dwLowDateTime=0x9679ad40, ftLastWriteTime.dwHighDateTime=0x1d5e3b5, nFileSizeHigh=0x0, nFileSizeLow=0xf4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="rJMVpzJX7aYmRu3CC.csv", cAlternateFileName="RJMVPZ~1.CSV")) returned 1
	[0098.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJMVpzJX7aYmRu3CC.csv", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJMVpzJX7aYmRu3CC.csv", lpFilePart=0x0) returned 0x43
	[0098.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJMVpzJX7aYmRu3CC.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rjmvpzjx7aymru3cc.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.732] GetFileType (hFile=0x208) returned 0x1
	[0098.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.732] GetFileType (hFile=0x208) returned 0x1
	[0098.733] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xf4f4
	[0098.733] ReadFile (in: hFile=0x208, lpBuffer=0x27e5a00, nNumberOfBytesToRead=0xf4f4, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27e5a00*, lpNumberOfBytesRead=0x26ef24*=0xf4f4, lpOverlapped=0x0) returned 1
	[0098.739] CloseHandle (hObject=0x208) returned 1
	[0098.739] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJMVpzJX7aYmRu3CC.csv.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJMVpzJX7aYmRu3CC.csv.KEKW", lpFilePart=0x0) returned 0x48
	[0098.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJMVpzJX7aYmRu3CC.csv.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rjmvpzjx7aymru3cc.csv.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.741] GetFileType (hFile=0x208) returned 0x1
	[0098.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.741] GetFileType (hFile=0x208) returned 0x1
	[0098.746] WriteFile (in: hFile=0x208, lpBuffer=0x2607604*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2607604*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.751] CloseHandle (hObject=0x208) returned 1
	[0098.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJMVpzJX7aYmRu3CC.csv", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJMVpzJX7aYmRu3CC.csv", lpFilePart=0x0) returned 0x43
	[0098.751] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rJMVpzJX7aYmRu3CC.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rjmvpzjx7aymru3cc.csv")) returned 1
	[0098.758] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea29b230, ftCreationTime.dwHighDateTime=0x1d5da8e, ftLastAccessTime.dwLowDateTime=0x4ad66590, ftLastAccessTime.dwHighDateTime=0x1d5e7b1, ftLastWriteTime.dwLowDateTime=0x4ad66590, ftLastWriteTime.dwHighDateTime=0x1d5e7b1, nFileSizeHigh=0x0, nFileSizeLow=0x7ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S8hDa.wav", cAlternateFileName="")) returned 1
	[0098.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\S8hDa.wav", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\S8hDa.wav", lpFilePart=0x0) returned 0x37
	[0098.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\S8hDa.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\s8hda.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.759] GetFileType (hFile=0x208) returned 0x1
	[0098.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.759] GetFileType (hFile=0x208) returned 0x1
	[0098.759] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x7ad0
	[0098.760] ReadFile (in: hFile=0x208, lpBuffer=0x2608aac, nNumberOfBytesToRead=0x7ad0, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2608aac*, lpNumberOfBytesRead=0x26ef24*=0x7ad0, lpOverlapped=0x0) returned 1
	[0098.763] CloseHandle (hObject=0x208) returned 1
	[0098.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\S8hDa.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\S8hDa.wav.KEKW", lpFilePart=0x0) returned 0x3c
	[0098.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\S8hDa.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\s8hda.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.765] GetFileType (hFile=0x208) returned 0x1
	[0098.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.765] GetFileType (hFile=0x208) returned 0x1
	[0098.766] WriteFile (in: hFile=0x208, lpBuffer=0x2611cc4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2611cc4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.770] CloseHandle (hObject=0x208) returned 1
	[0098.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\S8hDa.wav", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\S8hDa.wav", lpFilePart=0x0) returned 0x37
	[0098.770] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\S8hDa.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\s8hda.wav")) returned 1
	[0098.774] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3fe3130, ftCreationTime.dwHighDateTime=0x1d5e0c8, ftLastAccessTime.dwLowDateTime=0x86a27e50, ftLastAccessTime.dwHighDateTime=0x1d5e7e9, ftLastWriteTime.dwLowDateTime=0x86a27e50, ftLastWriteTime.dwHighDateTime=0x1d5e7e9, nFileSizeHigh=0x0, nFileSizeLow=0x8483, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfAwhHD-lx.odp", cAlternateFileName="SFAWHH~1.ODP")) returned 1
	[0098.774] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28fd5db0, ftCreationTime.dwHighDateTime=0x1d5e690, ftLastAccessTime.dwLowDateTime=0x1379e9b0, ftLastAccessTime.dwHighDateTime=0x1d5e50d, ftLastWriteTime.dwLowDateTime=0x1379e9b0, ftLastWriteTime.dwHighDateTime=0x1d5e50d, nFileSizeHigh=0x0, nFileSizeLow=0x10408, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk0Kq.jpg", cAlternateFileName="")) returned 1
	[0098.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sk0Kq.jpg", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sk0Kq.jpg", lpFilePart=0x0) returned 0x37
	[0098.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sk0Kq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sk0kq.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.775] GetFileType (hFile=0x208) returned 0x1
	[0098.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.776] GetFileType (hFile=0x208) returned 0x1
	[0098.776] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x10408
	[0098.776] ReadFile (in: hFile=0x208, lpBuffer=0x26134d0, nNumberOfBytesToRead=0x10408, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26134d0*, lpNumberOfBytesRead=0x26ef24*=0x10408, lpOverlapped=0x0) returned 1
	[0098.780] CloseHandle (hObject=0x208) returned 1
	[0098.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sk0Kq.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sk0Kq.jpg.KEKW", lpFilePart=0x0) returned 0x3c
	[0098.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sk0Kq.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sk0kq.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.782] GetFileType (hFile=0x208) returned 0x1
	[0098.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.782] GetFileType (hFile=0x208) returned 0x1
	[0098.783] WriteFile (in: hFile=0x208, lpBuffer=0x2624fa4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2624fa4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.787] CloseHandle (hObject=0x208) returned 1
	[0098.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sk0Kq.jpg", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sk0Kq.jpg", lpFilePart=0x0) returned 0x37
	[0098.787] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sk0Kq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sk0kq.jpg")) returned 1
	[0098.793] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54142570, ftCreationTime.dwHighDateTime=0x1d5e67b, ftLastAccessTime.dwLowDateTime=0x261f8dc0, ftLastAccessTime.dwHighDateTime=0x1d5da3d, ftLastWriteTime.dwLowDateTime=0x261f8dc0, ftLastWriteTime.dwHighDateTime=0x1d5da3d, nFileSizeHigh=0x0, nFileSizeLow=0x21d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="tM0e4eTi2T7dYo-EKo.gif", cAlternateFileName="TM0E4E~1.GIF")) returned 1
	[0098.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tM0e4eTi2T7dYo-EKo.gif", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tM0e4eTi2T7dYo-EKo.gif", lpFilePart=0x0) returned 0x44
	[0098.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tM0e4eTi2T7dYo-EKo.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tm0e4eti2t7dyo-eko.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.794] GetFileType (hFile=0x208) returned 0x1
	[0098.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.794] GetFileType (hFile=0x208) returned 0x1
	[0098.794] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x21d1
	[0098.795] ReadFile (in: hFile=0x208, lpBuffer=0x2626538, nNumberOfBytesToRead=0x21d1, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2626538*, lpNumberOfBytesRead=0x26ef24*=0x21d1, lpOverlapped=0x0) returned 1
	[0098.798] CloseHandle (hObject=0x208) returned 1
	[0098.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tM0e4eTi2T7dYo-EKo.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tM0e4eTi2T7dYo-EKo.gif.KEKW", lpFilePart=0x0) returned 0x49
	[0098.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tM0e4eTi2T7dYo-EKo.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tm0e4eti2t7dyo-eko.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.800] GetFileType (hFile=0x208) returned 0x1
	[0098.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.800] GetFileType (hFile=0x208) returned 0x1
	[0098.800] WriteFile (in: hFile=0x208, lpBuffer=0x2629e20*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2629e20*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.803] CloseHandle (hObject=0x208) returned 1
	[0098.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tM0e4eTi2T7dYo-EKo.gif", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tM0e4eTi2T7dYo-EKo.gif", lpFilePart=0x0) returned 0x44
	[0098.804] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tM0e4eTi2T7dYo-EKo.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tm0e4eti2t7dyo-eko.gif")) returned 1
	[0098.809] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9809e80, ftCreationTime.dwHighDateTime=0x1d5df64, ftLastAccessTime.dwLowDateTime=0x2e6a2730, ftLastAccessTime.dwHighDateTime=0x1d5dacc, ftLastWriteTime.dwLowDateTime=0x2e6a2730, ftLastWriteTime.dwHighDateTime=0x1d5dacc, nFileSizeHigh=0x0, nFileSizeLow=0x89fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tn1bYj1wt.mkv", cAlternateFileName="TN1BYJ~1.MKV")) returned 1
	[0098.809] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4b145e60, ftCreationTime.dwHighDateTime=0x1d5dfad, ftLastAccessTime.dwLowDateTime=0xfd2c5a30, ftLastAccessTime.dwHighDateTime=0x1d5e642, ftLastWriteTime.dwLowDateTime=0xfd2c5a30, ftLastWriteTime.dwHighDateTime=0x1d5e642, nFileSizeHigh=0x0, nFileSizeLow=0x8d06, dwReserved0=0x0, dwReserved1=0x0, cFileName="tY-Hbt1Tur.bmp", cAlternateFileName="TY-HBT~1.BMP")) returned 1
	[0098.810] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tY-Hbt1Tur.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tY-Hbt1Tur.bmp", lpFilePart=0x0) returned 0x3c
	[0098.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tY-Hbt1Tur.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ty-hbt1tur.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.810] GetFileType (hFile=0x208) returned 0x1
	[0098.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.810] GetFileType (hFile=0x208) returned 0x1
	[0098.811] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x8d06
	[0098.811] ReadFile (in: hFile=0x208, lpBuffer=0x262b6b8, nNumberOfBytesToRead=0x8d06, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x262b6b8*, lpNumberOfBytesRead=0x26ef24*=0x8d06, lpOverlapped=0x0) returned 1
	[0098.814] CloseHandle (hObject=0x208) returned 1
	[0098.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tY-Hbt1Tur.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tY-Hbt1Tur.bmp.KEKW", lpFilePart=0x0) returned 0x41
	[0098.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tY-Hbt1Tur.bmp.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ty-hbt1tur.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.816] GetFileType (hFile=0x208) returned 0x1
	[0098.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.816] GetFileType (hFile=0x208) returned 0x1
	[0098.817] WriteFile (in: hFile=0x208, lpBuffer=0x2635aa4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2635aa4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.820] CloseHandle (hObject=0x208) returned 1
	[0098.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tY-Hbt1Tur.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tY-Hbt1Tur.bmp", lpFilePart=0x0) returned 0x3c
	[0098.820] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tY-Hbt1Tur.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ty-hbt1tur.bmp")) returned 1
	[0098.825] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93f575c0, ftCreationTime.dwHighDateTime=0x1d5d7b4, ftLastAccessTime.dwLowDateTime=0xfb965fe0, ftLastAccessTime.dwHighDateTime=0x1d5e59d, ftLastWriteTime.dwLowDateTime=0xfb965fe0, ftLastWriteTime.dwHighDateTime=0x1d5e59d, nFileSizeHigh=0x0, nFileSizeLow=0x16096, dwReserved0=0x0, dwReserved1=0x0, cFileName="uc3b5mzL6Hsz.gif", cAlternateFileName="UC3B5M~1.GIF")) returned 1
	[0098.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uc3b5mzL6Hsz.gif", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uc3b5mzL6Hsz.gif", lpFilePart=0x0) returned 0x3e
	[0098.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uc3b5mzL6Hsz.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uc3b5mzl6hsz.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.826] GetFileType (hFile=0x208) returned 0x1
	[0098.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.826] GetFileType (hFile=0x208) returned 0x1
	[0098.826] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x16096
	[0098.828] ReadFile (in: hFile=0x208, lpBuffer=0x3877e60, nNumberOfBytesToRead=0x16096, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x3877e60*, lpNumberOfBytesRead=0x26ef24*=0x16096, lpOverlapped=0x0) returned 1
	[0098.850] CloseHandle (hObject=0x208) returned 1
	[0098.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uc3b5mzL6Hsz.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uc3b5mzL6Hsz.gif.KEKW", lpFilePart=0x0) returned 0x43
	[0098.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uc3b5mzL6Hsz.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uc3b5mzl6hsz.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.851] GetFileType (hFile=0x208) returned 0x1
	[0098.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.852] GetFileType (hFile=0x208) returned 0x1
	[0098.852] WriteFile (in: hFile=0x208, lpBuffer=0x26386c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26386c8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.855] CloseHandle (hObject=0x208) returned 1
	[0098.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uc3b5mzL6Hsz.gif", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uc3b5mzL6Hsz.gif", lpFilePart=0x0) returned 0x3e
	[0098.856] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uc3b5mzL6Hsz.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uc3b5mzl6hsz.gif")) returned 1
	[0098.863] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b4027f0, ftCreationTime.dwHighDateTime=0x1d5db01, ftLastAccessTime.dwLowDateTime=0xdf8d25b0, ftLastAccessTime.dwHighDateTime=0x1d5dfe2, ftLastWriteTime.dwLowDateTime=0xdf8d25b0, ftLastWriteTime.dwHighDateTime=0x1d5dfe2, nFileSizeHigh=0x0, nFileSizeLow=0x189d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="W0hOuwKQL6 VMole2oOx.wav", cAlternateFileName="W0HOUW~1.WAV")) returned 1
	[0098.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W0hOuwKQL6 VMole2oOx.wav", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W0hOuwKQL6 VMole2oOx.wav", lpFilePart=0x0) returned 0x46
	[0098.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W0hOuwKQL6 VMole2oOx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w0houwkql6 vmole2oox.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.864] GetFileType (hFile=0x208) returned 0x1
	[0098.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.864] GetFileType (hFile=0x208) returned 0x1
	[0098.864] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x189d0
	[0098.865] ReadFile (in: hFile=0x208, lpBuffer=0x388df18, nNumberOfBytesToRead=0x189d0, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x388df18*, lpNumberOfBytesRead=0x26ef24*=0x189d0, lpOverlapped=0x0) returned 1
	[0098.873] CloseHandle (hObject=0x208) returned 1
	[0098.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W0hOuwKQL6 VMole2oOx.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W0hOuwKQL6 VMole2oOx.wav.KEKW", lpFilePart=0x0) returned 0x4b
	[0098.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W0hOuwKQL6 VMole2oOx.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w0houwkql6 vmole2oox.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.874] GetFileType (hFile=0x208) returned 0x1
	[0098.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.874] GetFileType (hFile=0x208) returned 0x1
	[0098.875] WriteFile (in: hFile=0x208, lpBuffer=0x263b3a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x263b3a0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.879] CloseHandle (hObject=0x208) returned 1
	[0098.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W0hOuwKQL6 VMole2oOx.wav", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W0hOuwKQL6 VMole2oOx.wav", lpFilePart=0x0) returned 0x46
	[0098.880] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\W0hOuwKQL6 VMole2oOx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\w0houwkql6 vmole2oox.wav")) returned 1
	[0098.885] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45de0340, ftCreationTime.dwHighDateTime=0x1d5e3d3, ftLastAccessTime.dwLowDateTime=0x46a0b3e0, ftLastAccessTime.dwHighDateTime=0x1d5e7ed, ftLastWriteTime.dwLowDateTime=0x46a0b3e0, ftLastWriteTime.dwHighDateTime=0x1d5e7ed, nFileSizeHigh=0x0, nFileSizeLow=0xbd49, dwReserved0=0x0, dwReserved1=0x0, cFileName="XJsm_wz.jpg", cAlternateFileName="")) returned 1
	[0098.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XJsm_wz.jpg", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XJsm_wz.jpg", lpFilePart=0x0) returned 0x39
	[0098.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XJsm_wz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xjsm_wz.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.886] GetFileType (hFile=0x208) returned 0x1
	[0098.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.886] GetFileType (hFile=0x208) returned 0x1
	[0098.886] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xbd49
	[0098.886] ReadFile (in: hFile=0x208, lpBuffer=0x263c870, nNumberOfBytesToRead=0xbd49, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x263c870*, lpNumberOfBytesRead=0x26ef24*=0xbd49, lpOverlapped=0x0) returned 1
	[0098.890] CloseHandle (hObject=0x208) returned 1
	[0098.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XJsm_wz.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XJsm_wz.jpg.KEKW", lpFilePart=0x0) returned 0x3e
	[0098.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XJsm_wz.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xjsm_wz.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.891] GetFileType (hFile=0x208) returned 0x1
	[0098.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.892] GetFileType (hFile=0x208) returned 0x1
	[0098.892] WriteFile (in: hFile=0x208, lpBuffer=0x2649c94*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2649c94*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.895] CloseHandle (hObject=0x208) returned 1
	[0098.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XJsm_wz.jpg", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XJsm_wz.jpg", lpFilePart=0x0) returned 0x39
	[0098.896] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XJsm_wz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xjsm_wz.jpg")) returned 1
	[0098.901] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x73a4d470, ftCreationTime.dwHighDateTime=0x1d5e0cc, ftLastAccessTime.dwLowDateTime=0xb025b850, ftLastAccessTime.dwHighDateTime=0x1d5de11, ftLastWriteTime.dwLowDateTime=0xb025b850, ftLastWriteTime.dwHighDateTime=0x1d5de11, nFileSizeHigh=0x0, nFileSizeLow=0xcef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZnJGTgjvmiO4bs5S1.csv", cAlternateFileName="ZNJGTG~1.CSV")) returned 1
	[0098.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZnJGTgjvmiO4bs5S1.csv", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZnJGTgjvmiO4bs5S1.csv", lpFilePart=0x0) returned 0x43
	[0098.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZnJGTgjvmiO4bs5S1.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\znjgtgjvmio4bs5s1.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.902] GetFileType (hFile=0x208) returned 0x1
	[0098.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.902] GetFileType (hFile=0x208) returned 0x1
	[0098.902] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xcef2
	[0098.903] ReadFile (in: hFile=0x208, lpBuffer=0x264b210, nNumberOfBytesToRead=0xcef2, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x264b210*, lpNumberOfBytesRead=0x26ef24*=0xcef2, lpOverlapped=0x0) returned 1
	[0098.906] CloseHandle (hObject=0x208) returned 1
	[0098.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZnJGTgjvmiO4bs5S1.csv.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZnJGTgjvmiO4bs5S1.csv.KEKW", lpFilePart=0x0) returned 0x48
	[0098.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZnJGTgjvmiO4bs5S1.csv.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\znjgtgjvmio4bs5s1.csv.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.918] GetFileType (hFile=0x208) returned 0x1
	[0098.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.919] GetFileType (hFile=0x208) returned 0x1
	[0098.919] WriteFile (in: hFile=0x208, lpBuffer=0x2659818*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2659818*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.922] CloseHandle (hObject=0x208) returned 1
	[0098.923] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZnJGTgjvmiO4bs5S1.csv", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZnJGTgjvmiO4bs5S1.csv", lpFilePart=0x0) returned 0x43
	[0098.923] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ZnJGTgjvmiO4bs5S1.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\znjgtgjvmio4bs5s1.csv")) returned 1
	[0098.928] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadd79a50, ftCreationTime.dwHighDateTime=0x1d5d8c6, ftLastAccessTime.dwLowDateTime=0xd6f41a90, ftLastAccessTime.dwHighDateTime=0x1d5dc94, ftLastWriteTime.dwLowDateTime=0xd6f41a90, ftLastWriteTime.dwHighDateTime=0x1d5dc94, nFileSizeHigh=0x0, nFileSizeLow=0xbb5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="_soZEeiKVmqW7eH4Z3.gif", cAlternateFileName="_SOZEE~1.GIF")) returned 1
	[0098.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_soZEeiKVmqW7eH4Z3.gif", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_soZEeiKVmqW7eH4Z3.gif", lpFilePart=0x0) returned 0x44
	[0098.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0098.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_soZEeiKVmqW7eH4Z3.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_sozeeikvmqw7eh4z3.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.929] GetFileType (hFile=0x208) returned 0x1
	[0098.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0098.930] GetFileType (hFile=0x208) returned 0x1
	[0098.930] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xbb5b
	[0098.930] ReadFile (in: hFile=0x208, lpBuffer=0x265adc4, nNumberOfBytesToRead=0xbb5b, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x265adc4*, lpNumberOfBytesRead=0x26ef24*=0xbb5b, lpOverlapped=0x0) returned 1
	[0098.933] CloseHandle (hObject=0x208) returned 1
	[0098.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_soZEeiKVmqW7eH4Z3.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_soZEeiKVmqW7eH4Z3.gif.KEKW", lpFilePart=0x0) returned 0x49
	[0098.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0098.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_soZEeiKVmqW7eH4Z3.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_sozeeikvmqw7eh4z3.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0098.935] GetFileType (hFile=0x208) returned 0x1
	[0098.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0098.935] GetFileType (hFile=0x208) returned 0x1
	[0098.936] WriteFile (in: hFile=0x208, lpBuffer=0x2668034*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2668034*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0098.940] CloseHandle (hObject=0x208) returned 1
	[0098.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_soZEeiKVmqW7eH4Z3.gif", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_soZEeiKVmqW7eH4Z3.gif", lpFilePart=0x0) returned 0x44
	[0098.941] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_soZEeiKVmqW7eH4Z3.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_sozeeikvmqw7eh4z3.gif")) returned 1
	[0098.947] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.947] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0098.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0098.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0098.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0098.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0098.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0098.949] GetFileType (hFile=0x204) returned 0x1
	[0098.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0098.949] GetFileType (hFile=0x204) returned 0x1
	[0098.950] WriteFile (in: hFile=0x204, lpBuffer=0x266a71c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x266a71c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0098.952] CloseHandle (hObject=0x204) returned 1
	[0098.953] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.953] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0098.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0098.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0098.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0098.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", lpFilePart=0x0) returned 0x25
	[0098.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpFilePart=0x0) returned 0x26
	[0098.954] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0098.954] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.955] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x88b8730, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x88b8730, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0098.955] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x93e0e50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x93e0e50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1
	[0098.956] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbf05d10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xbf05d10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1
	[0098.956] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbf05d10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xbf05d10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0
	[0098.957] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0098.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0098.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0098.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0098.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0098.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0098.958] GetFileType (hFile=0x200) returned 0x1
	[0098.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0098.959] GetFileType (hFile=0x200) returned 0x1
	[0098.959] WriteFile (in: hFile=0x200, lpBuffer=0x266d76c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x266d76c*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0098.962] CloseHandle (hObject=0x200) returned 1
	[0098.962] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0098.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0098.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data", lpFilePart=0x0) returned 0x2e
	[0098.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\", lpFilePart=0x0) returned 0x2f
	[0098.963] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0098.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0098.968] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1
	[0098.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0098.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", lpFilePart=0x0) returned 0x26
	[0098.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", lpFilePart=0x0) returned 0x27
	[0098.970] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0098.971] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.972] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1
	[0098.972] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1
	[0098.973] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1
	[0098.974] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1
	[0098.974] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0098.975] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x0, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1
	[0098.975] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1
	[0098.976] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0
	[0098.976] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0098.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0098.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0098.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0098.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", lpFilePart=0x0) returned 0x26
	[0098.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", lpFilePart=0x0) returned 0x27
	[0098.978] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0098.978] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.979] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1
	[0098.980] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1
	[0098.980] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1
	[0098.980] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1
	[0098.981] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0098.981] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x0, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1
	[0098.982] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1
	[0098.982] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0098.983] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0098.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0098.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0098.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Decrypt.txt", lpFilePart=0x0) returned 0x32
	[0098.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0098.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0098.984] GetFileType (hFile=0x200) returned 0x1
	[0098.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0098.984] GetFileType (hFile=0x200) returned 0x1
	[0098.985] WriteFile (in: hFile=0x200, lpBuffer=0x2673a20*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2673a20*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0098.988] CloseHandle (hObject=0x200) returned 1
	[0098.988] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0098.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0098.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies", lpFilePart=0x0) returned 0x25
	[0098.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\", lpFilePart=0x0) returned 0x26
	[0098.989] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0098.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0098.994] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe2743740, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xe2743740, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0098.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0098.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0098.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26
	[0098.995] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe2743740, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xe2743740, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0098.995] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe2743740, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xe2743740, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0098.996] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821e7460, ftCreationTime.dwHighDateTime=0x1d5e168, ftLastAccessTime.dwLowDateTime=0x909805d0, ftLastAccessTime.dwHighDateTime=0x1d5e16b, ftLastWriteTime.dwLowDateTime=0x909805d0, ftLastWriteTime.dwHighDateTime=0x1d5e16b, nFileSizeHigh=0x0, nFileSizeLow=0x846, dwReserved0=0x0, dwReserved1=0x0, cFileName="-8eG4Vj0uzt.swf", cAlternateFileName="-8EG4V~1.SWF")) returned 1
	[0098.996] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7cdf070, ftCreationTime.dwHighDateTime=0x1d5e6b3, ftLastAccessTime.dwLowDateTime=0x500ebbd0, ftLastAccessTime.dwHighDateTime=0x1d5dfc2, ftLastWriteTime.dwLowDateTime=0x500ebbd0, ftLastWriteTime.dwHighDateTime=0x1d5dfc2, nFileSizeHigh=0x0, nFileSizeLow=0x9f0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="1JHA5FWMFgn.mp3", cAlternateFileName="1JHA5F~1.MP3")) returned 1
	[0098.997] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b546230, ftCreationTime.dwHighDateTime=0x1d5e310, ftLastAccessTime.dwLowDateTime=0x9692d170, ftLastAccessTime.dwHighDateTime=0x1d5e811, ftLastWriteTime.dwLowDateTime=0x9692d170, ftLastWriteTime.dwHighDateTime=0x1d5e811, nFileSizeHigh=0x0, nFileSizeLow=0xf962, dwReserved0=0x0, dwReserved1=0x0, cFileName="2G0jYOLyFfWVl7zXML5.m4a", cAlternateFileName="2G0JYO~1.M4A")) returned 1
	[0098.998] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb4c30, ftCreationTime.dwHighDateTime=0x1d5e7d6, ftLastAccessTime.dwLowDateTime=0xc84efae0, ftLastAccessTime.dwHighDateTime=0x1d5e519, ftLastWriteTime.dwLowDateTime=0xc84efae0, ftLastWriteTime.dwHighDateTime=0x1d5e519, nFileSizeHigh=0x0, nFileSizeLow=0x14d6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="2IWp.gif", cAlternateFileName="")) returned 1
	[0098.998] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef325cb0, ftCreationTime.dwHighDateTime=0x1d5ddb2, ftLastAccessTime.dwLowDateTime=0xaccebe40, ftLastAccessTime.dwHighDateTime=0x1d5da65, ftLastWriteTime.dwLowDateTime=0xaccebe40, ftLastWriteTime.dwHighDateTime=0x1d5da65, nFileSizeHigh=0x0, nFileSizeLow=0xbab1, dwReserved0=0x0, dwReserved1=0x0, cFileName="5wJxRKjMWEP.odt", cAlternateFileName="5WJXRK~1.ODT")) returned 1
	[0098.999] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98042520, ftCreationTime.dwHighDateTime=0x1d5dab2, ftLastAccessTime.dwLowDateTime=0x1119d4c0, ftLastAccessTime.dwHighDateTime=0x1d5e3bc, ftLastWriteTime.dwLowDateTime=0x1119d4c0, ftLastWriteTime.dwHighDateTime=0x1d5e3bc, nFileSizeHigh=0x0, nFileSizeLow=0x113dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARmLj_June5TKj.swf", cAlternateFileName="ARMLJ_~1.SWF")) returned 1
	[0098.999] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6a9c7e0, ftCreationTime.dwHighDateTime=0x1d5e6ca, ftLastAccessTime.dwLowDateTime=0x9670b00, ftLastAccessTime.dwHighDateTime=0x1d5e48c, ftLastWriteTime.dwLowDateTime=0x9670b00, ftLastWriteTime.dwHighDateTime=0x1d5e48c, nFileSizeHigh=0x0, nFileSizeLow=0xafda, dwReserved0=0x0, dwReserved1=0x0, cFileName="bzV6a5Pfe.flv", cAlternateFileName="BZV6A5~1.FLV")) returned 1
	[0099.000] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f33750, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x92b42620, ftLastAccessTime.dwHighDateTime=0x1d5e37b, ftLastWriteTime.dwLowDateTime=0x92b42620, ftLastWriteTime.dwHighDateTime=0x1d5e37b, nFileSizeHigh=0x0, nFileSizeLow=0x14eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C-RcLTpgwLsTNOwu1.bmp", cAlternateFileName="C-RCLT~1.BMP")) returned 1
	[0099.001] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0099.001] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0d599c0, ftCreationTime.dwHighDateTime=0x1d5da88, ftLastAccessTime.dwLowDateTime=0x14a5b350, ftLastAccessTime.dwHighDateTime=0x1d5d937, ftLastWriteTime.dwLowDateTime=0x14a5b350, ftLastWriteTime.dwHighDateTime=0x1d5d937, nFileSizeHigh=0x0, nFileSizeLow=0xf802, dwReserved0=0x0, dwReserved1=0x0, cFileName="d_W6.swf", cAlternateFileName="")) returned 1
	[0099.002] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafa723c0, ftCreationTime.dwHighDateTime=0x1d5dbf3, ftLastAccessTime.dwLowDateTime=0x64dbf570, ftLastAccessTime.dwHighDateTime=0x1d5e385, ftLastWriteTime.dwLowDateTime=0x64dbf570, ftLastWriteTime.dwHighDateTime=0x1d5e385, nFileSizeHigh=0x0, nFileSizeLow=0x76c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="EaGMVKx99tO38Ada6zp.doc", cAlternateFileName="EAGMVK~1.DOC")) returned 1
	[0099.002] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ff1120, ftCreationTime.dwHighDateTime=0x1d5db4a, ftLastAccessTime.dwLowDateTime=0xd1ec7300, ftLastAccessTime.dwHighDateTime=0x1d5d8d7, ftLastWriteTime.dwLowDateTime=0xd1ec7300, ftLastWriteTime.dwHighDateTime=0x1d5d8d7, nFileSizeHigh=0x0, nFileSizeLow=0x1981, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eez-t7cYZD.jpg", cAlternateFileName="EEZ-T7~1.JPG")) returned 1
	[0099.003] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55bf750, ftCreationTime.dwHighDateTime=0x1d5e4be, ftLastAccessTime.dwLowDateTime=0x852664c0, ftLastAccessTime.dwHighDateTime=0x1d5e18a, ftLastWriteTime.dwLowDateTime=0x852664c0, ftLastWriteTime.dwHighDateTime=0x1d5e18a, nFileSizeHigh=0x0, nFileSizeLow=0x15055, dwReserved0=0x0, dwReserved1=0x0, cFileName="FNuzNIqniMp8p.bmp", cAlternateFileName="FNUZNI~1.BMP")) returned 1
	[0099.004] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fe6c2f0, ftCreationTime.dwHighDateTime=0x1d5e5cc, ftLastAccessTime.dwLowDateTime=0xeb938350, ftLastAccessTime.dwHighDateTime=0x1d5dfdc, ftLastWriteTime.dwLowDateTime=0xeb938350, ftLastWriteTime.dwHighDateTime=0x1d5dfdc, nFileSizeHigh=0x0, nFileSizeLow=0x125f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="gejNrNkaoA4QRCitb.mp4", cAlternateFileName="GEJNRN~1.MP4")) returned 1
	[0099.004] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e088400, ftCreationTime.dwHighDateTime=0x1d5ddcb, ftLastAccessTime.dwLowDateTime=0x13126080, ftLastAccessTime.dwHighDateTime=0x1d5dec6, ftLastWriteTime.dwLowDateTime=0x13126080, ftLastWriteTime.dwHighDateTime=0x1d5dec6, nFileSizeHigh=0x0, nFileSizeLow=0x9b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="H27SqMWfI.swf", cAlternateFileName="H27SQM~1.SWF")) returned 1
	[0099.005] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2be0c0, ftCreationTime.dwHighDateTime=0x1d5e146, ftLastAccessTime.dwLowDateTime=0xa07cdca0, ftLastAccessTime.dwHighDateTime=0x1d5db03, ftLastWriteTime.dwLowDateTime=0xa07cdca0, ftLastWriteTime.dwHighDateTime=0x1d5db03, nFileSizeHigh=0x0, nFileSizeLow=0x16446, dwReserved0=0x0, dwReserved1=0x0, cFileName="I2IqxxSN9.png", cAlternateFileName="I2IQXX~1.PNG")) returned 1
	[0099.005] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a3a2c40, ftCreationTime.dwHighDateTime=0x1d5d9fa, ftLastAccessTime.dwLowDateTime=0x378625f0, ftLastAccessTime.dwHighDateTime=0x1d5ddc2, ftLastWriteTime.dwLowDateTime=0x378625f0, ftLastWriteTime.dwHighDateTime=0x1d5ddc2, nFileSizeHigh=0x0, nFileSizeLow=0x7434, dwReserved0=0x0, dwReserved1=0x0, cFileName="J73JTPPJvRxwHLQ0XC3a.swf", cAlternateFileName="J73JTP~1.SWF")) returned 1
	[0099.006] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35bc2210, ftCreationTime.dwHighDateTime=0x1d5e2a9, ftLastAccessTime.dwLowDateTime=0x50059410, ftLastAccessTime.dwHighDateTime=0x1d5dd51, ftLastWriteTime.dwLowDateTime=0x50059410, ftLastWriteTime.dwHighDateTime=0x1d5dd51, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JVBNjkN-Qb39_TBQ4y", cAlternateFileName="JVBNJK~1")) returned 1
	[0099.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0099.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y", lpFilePart=0x0) returned 0x38
	[0099.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\", lpFilePart=0x0) returned 0x39
	[0099.007] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35bc2210, ftCreationTime.dwHighDateTime=0x1d5e2a9, ftLastAccessTime.dwLowDateTime=0x50059410, ftLastAccessTime.dwHighDateTime=0x1d5dd51, ftLastWriteTime.dwLowDateTime=0x50059410, ftLastWriteTime.dwHighDateTime=0x1d5dd51, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0099.008] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35bc2210, ftCreationTime.dwHighDateTime=0x1d5e2a9, ftLastAccessTime.dwLowDateTime=0x50059410, ftLastAccessTime.dwHighDateTime=0x1d5dd51, ftLastWriteTime.dwLowDateTime=0x50059410, ftLastWriteTime.dwHighDateTime=0x1d5dd51, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0099.008] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50612b60, ftCreationTime.dwHighDateTime=0x1d5e1a0, ftLastAccessTime.dwLowDateTime=0x13391560, ftLastAccessTime.dwHighDateTime=0x1d5df55, ftLastWriteTime.dwLowDateTime=0x13391560, ftLastWriteTime.dwHighDateTime=0x1d5df55, nFileSizeHigh=0x0, nFileSizeLow=0x115b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="0EbWXe73.rtf", cAlternateFileName="")) returned 1
	[0099.009] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5a28e0, ftCreationTime.dwHighDateTime=0x1d5dd65, ftLastAccessTime.dwLowDateTime=0x8db77880, ftLastAccessTime.dwHighDateTime=0x1d5e6b8, ftLastWriteTime.dwLowDateTime=0x8db77880, ftLastWriteTime.dwHighDateTime=0x1d5e6b8, nFileSizeHigh=0x0, nFileSizeLow=0xdd63, dwReserved0=0x0, dwReserved1=0x0, cFileName="5fCgIQ3Cmx0Z.wav", cAlternateFileName="5FCGIQ~1.WAV")) returned 1
	[0099.009] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x309fa410, ftCreationTime.dwHighDateTime=0x1d5e18b, ftLastAccessTime.dwLowDateTime=0xb40def80, ftLastAccessTime.dwHighDateTime=0x1d5e426, ftLastWriteTime.dwLowDateTime=0xb40def80, ftLastWriteTime.dwHighDateTime=0x1d5e426, nFileSizeHigh=0x0, nFileSizeLow=0x12180, dwReserved0=0x0, dwReserved1=0x0, cFileName="8wxu8xYGDCdlbG.pptx", cAlternateFileName="8WXU8X~1.PPT")) returned 1
	[0099.010] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97cfe1d0, ftCreationTime.dwHighDateTime=0x1d5e48e, ftLastAccessTime.dwLowDateTime=0x3b442910, ftLastAccessTime.dwHighDateTime=0x1d5d8c4, ftLastWriteTime.dwLowDateTime=0x3b442910, ftLastWriteTime.dwHighDateTime=0x1d5d8c4, nFileSizeHigh=0x0, nFileSizeLow=0xe214, dwReserved0=0x0, dwReserved1=0x0, cFileName="EdDq2m7lNBxZX.bmp", cAlternateFileName="EDDQ2M~1.BMP")) returned 1
	[0099.010] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3e3bc0, ftCreationTime.dwHighDateTime=0x1d5e643, ftLastAccessTime.dwLowDateTime=0xb90deaa0, ftLastAccessTime.dwHighDateTime=0x1d5e4dd, ftLastWriteTime.dwLowDateTime=0xb90deaa0, ftLastWriteTime.dwHighDateTime=0x1d5e4dd, nFileSizeHigh=0x0, nFileSizeLow=0x12801, dwReserved0=0x0, dwReserved1=0x0, cFileName="lr7rvr.avi", cAlternateFileName="")) returned 1
	[0099.011] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17abcf10, ftCreationTime.dwHighDateTime=0x1d5d7d1, ftLastAccessTime.dwLowDateTime=0xf4702160, ftLastAccessTime.dwHighDateTime=0x1d5e53e, ftLastWriteTime.dwLowDateTime=0xf4702160, ftLastWriteTime.dwHighDateTime=0x1d5e53e, nFileSizeHigh=0x0, nFileSizeLow=0x184d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="N9M5kz3lUb.mp3", cAlternateFileName="N9M5KZ~1.MP3")) returned 1
	[0099.011] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78e2f690, ftCreationTime.dwHighDateTime=0x1d5da1b, ftLastAccessTime.dwLowDateTime=0xb1624ed0, ftLastAccessTime.dwHighDateTime=0x1d5e0b5, ftLastWriteTime.dwLowDateTime=0xb1624ed0, ftLastWriteTime.dwHighDateTime=0x1d5e0b5, nFileSizeHigh=0x0, nFileSizeLow=0x14309, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScoPPq5fImFDiV86.mp3", cAlternateFileName="SCOPPQ~1.MP3")) returned 1
	[0099.012] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fadd40, ftCreationTime.dwHighDateTime=0x1d5d8da, ftLastAccessTime.dwLowDateTime=0xc672b4f0, ftLastAccessTime.dwHighDateTime=0x1d5df33, ftLastWriteTime.dwLowDateTime=0xc672b4f0, ftLastWriteTime.dwHighDateTime=0x1d5df33, nFileSizeHigh=0x0, nFileSizeLow=0xfb33, dwReserved0=0x0, dwReserved1=0x0, cFileName="tdyk843.png", cAlternateFileName="")) returned 1
	[0099.013] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853b2250, ftCreationTime.dwHighDateTime=0x1d5dc05, ftLastAccessTime.dwLowDateTime=0x750ea310, ftLastAccessTime.dwHighDateTime=0x1d5ddaa, ftLastWriteTime.dwLowDateTime=0x750ea310, ftLastWriteTime.dwHighDateTime=0x1d5ddaa, nFileSizeHigh=0x0, nFileSizeLow=0x16c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="YzdD53.m4a", cAlternateFileName="")) returned 1
	[0099.013] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853b2250, ftCreationTime.dwHighDateTime=0x1d5dc05, ftLastAccessTime.dwLowDateTime=0x750ea310, ftLastAccessTime.dwHighDateTime=0x1d5ddaa, ftLastWriteTime.dwLowDateTime=0x750ea310, ftLastWriteTime.dwHighDateTime=0x1d5ddaa, nFileSizeHigh=0x0, nFileSizeLow=0x16c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="YzdD53.m4a", cAlternateFileName="")) returned 0
	[0099.014] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0099.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0099.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0099.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0099.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y", lpFilePart=0x0) returned 0x38
	[0099.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\", lpFilePart=0x0) returned 0x39
	[0099.015] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35bc2210, ftCreationTime.dwHighDateTime=0x1d5e2a9, ftLastAccessTime.dwLowDateTime=0x50059410, ftLastAccessTime.dwHighDateTime=0x1d5dd51, ftLastWriteTime.dwLowDateTime=0x50059410, ftLastWriteTime.dwHighDateTime=0x1d5dd51, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0099.015] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35bc2210, ftCreationTime.dwHighDateTime=0x1d5e2a9, ftLastAccessTime.dwLowDateTime=0x50059410, ftLastAccessTime.dwHighDateTime=0x1d5dd51, ftLastWriteTime.dwLowDateTime=0x50059410, ftLastWriteTime.dwHighDateTime=0x1d5dd51, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0099.016] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50612b60, ftCreationTime.dwHighDateTime=0x1d5e1a0, ftLastAccessTime.dwLowDateTime=0x13391560, ftLastAccessTime.dwHighDateTime=0x1d5df55, ftLastWriteTime.dwLowDateTime=0x13391560, ftLastWriteTime.dwHighDateTime=0x1d5df55, nFileSizeHigh=0x0, nFileSizeLow=0x115b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="0EbWXe73.rtf", cAlternateFileName="")) returned 1
	[0099.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\0EbWXe73.rtf", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\0EbWXe73.rtf", lpFilePart=0x0) returned 0x45
	[0099.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0099.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\0EbWXe73.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\0ebwxe73.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.017] GetFileType (hFile=0x208) returned 0x1
	[0099.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0099.017] GetFileType (hFile=0x208) returned 0x1
	[0099.017] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x115b7
	[0099.018] ReadFile (in: hFile=0x208, lpBuffer=0x2679888, nNumberOfBytesToRead=0x115b7, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2679888*, lpNumberOfBytesRead=0x26ef24*=0x115b7, lpOverlapped=0x0) returned 1
	[0099.022] CloseHandle (hObject=0x208) returned 1
	[0099.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\0EbWXe73.rtf.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\0EbWXe73.rtf.KEKW", lpFilePart=0x0) returned 0x4a
	[0099.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0099.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\0EbWXe73.rtf.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\0ebwxe73.rtf.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.024] GetFileType (hFile=0x208) returned 0x1
	[0099.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0099.025] GetFileType (hFile=0x208) returned 0x1
	[0099.025] WriteFile (in: hFile=0x208, lpBuffer=0x268c548*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x268c548*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0099.028] CloseHandle (hObject=0x208) returned 1
	[0099.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\0EbWXe73.rtf", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\0EbWXe73.rtf", lpFilePart=0x0) returned 0x45
	[0099.028] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\0EbWXe73.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\0ebwxe73.rtf")) returned 1
	[0099.035] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5a28e0, ftCreationTime.dwHighDateTime=0x1d5dd65, ftLastAccessTime.dwLowDateTime=0x8db77880, ftLastAccessTime.dwHighDateTime=0x1d5e6b8, ftLastWriteTime.dwLowDateTime=0x8db77880, ftLastWriteTime.dwHighDateTime=0x1d5e6b8, nFileSizeHigh=0x0, nFileSizeLow=0xdd63, dwReserved0=0x0, dwReserved1=0x0, cFileName="5fCgIQ3Cmx0Z.wav", cAlternateFileName="5FCGIQ~1.WAV")) returned 1
	[0099.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\5fCgIQ3Cmx0Z.wav", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\5fCgIQ3Cmx0Z.wav", lpFilePart=0x0) returned 0x49
	[0099.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0099.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\5fCgIQ3Cmx0Z.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\5fcgiq3cmx0z.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.036] GetFileType (hFile=0x208) returned 0x1
	[0099.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0099.036] GetFileType (hFile=0x208) returned 0x1
	[0099.037] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xdd63
	[0099.037] ReadFile (in: hFile=0x208, lpBuffer=0x268db14, nNumberOfBytesToRead=0xdd63, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x268db14*, lpNumberOfBytesRead=0x26ef24*=0xdd63, lpOverlapped=0x0) returned 1
	[0099.041] CloseHandle (hObject=0x208) returned 1
	[0099.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\5fCgIQ3Cmx0Z.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\5fCgIQ3Cmx0Z.wav.KEKW", lpFilePart=0x0) returned 0x4e
	[0099.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0099.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\5fCgIQ3Cmx0Z.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\5fcgiq3cmx0z.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.043] GetFileType (hFile=0x208) returned 0x1
	[0099.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0099.043] GetFileType (hFile=0x208) returned 0x1
	[0099.044] WriteFile (in: hFile=0x208, lpBuffer=0x269cf98*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x269cf98*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0099.047] CloseHandle (hObject=0x208) returned 1
	[0099.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\5fCgIQ3Cmx0Z.wav", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\5fCgIQ3Cmx0Z.wav", lpFilePart=0x0) returned 0x49
	[0099.047] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\5fCgIQ3Cmx0Z.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\5fcgiq3cmx0z.wav")) returned 1
	[0099.051] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x309fa410, ftCreationTime.dwHighDateTime=0x1d5e18b, ftLastAccessTime.dwLowDateTime=0xb40def80, ftLastAccessTime.dwHighDateTime=0x1d5e426, ftLastWriteTime.dwLowDateTime=0xb40def80, ftLastWriteTime.dwHighDateTime=0x1d5e426, nFileSizeHigh=0x0, nFileSizeLow=0x12180, dwReserved0=0x0, dwReserved1=0x0, cFileName="8wxu8xYGDCdlbG.pptx", cAlternateFileName="8WXU8X~1.PPT")) returned 1
	[0099.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\8wxu8xYGDCdlbG.pptx", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\8wxu8xYGDCdlbG.pptx", lpFilePart=0x0) returned 0x4c
	[0099.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0099.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\8wxu8xYGDCdlbG.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\8wxu8xygdcdlbg.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.052] GetFileType (hFile=0x208) returned 0x1
	[0099.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0099.052] GetFileType (hFile=0x208) returned 0x1
	[0099.052] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x12180
	[0099.053] ReadFile (in: hFile=0x208, lpBuffer=0x269e5a4, nNumberOfBytesToRead=0x12180, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x269e5a4*, lpNumberOfBytesRead=0x26ef24*=0x12180, lpOverlapped=0x0) returned 1
	[0099.056] CloseHandle (hObject=0x208) returned 1
	[0099.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\8wxu8xYGDCdlbG.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\8wxu8xYGDCdlbG.pptx.KEKW", lpFilePart=0x0) returned 0x51
	[0099.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0099.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\8wxu8xYGDCdlbG.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\8wxu8xygdcdlbg.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.058] GetFileType (hFile=0x208) returned 0x1
	[0099.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0099.059] GetFileType (hFile=0x208) returned 0x1
	[0099.059] WriteFile (in: hFile=0x208, lpBuffer=0x26b1e54*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26b1e54*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0099.062] CloseHandle (hObject=0x208) returned 1
	[0099.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\8wxu8xYGDCdlbG.pptx", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\8wxu8xYGDCdlbG.pptx", lpFilePart=0x0) returned 0x4c
	[0099.062] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\8wxu8xYGDCdlbG.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\8wxu8xygdcdlbg.pptx")) returned 1
	[0099.068] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97cfe1d0, ftCreationTime.dwHighDateTime=0x1d5e48e, ftLastAccessTime.dwLowDateTime=0x3b442910, ftLastAccessTime.dwHighDateTime=0x1d5d8c4, ftLastWriteTime.dwLowDateTime=0x3b442910, ftLastWriteTime.dwHighDateTime=0x1d5d8c4, nFileSizeHigh=0x0, nFileSizeLow=0xe214, dwReserved0=0x0, dwReserved1=0x0, cFileName="EdDq2m7lNBxZX.bmp", cAlternateFileName="EDDQ2M~1.BMP")) returned 1
	[0099.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\EdDq2m7lNBxZX.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\EdDq2m7lNBxZX.bmp", lpFilePart=0x0) returned 0x4a
	[0099.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0099.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\EdDq2m7lNBxZX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\eddq2m7lnbxzx.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.069] GetFileType (hFile=0x208) returned 0x1
	[0099.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0099.070] GetFileType (hFile=0x208) returned 0x1
	[0099.070] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xe214
	[0099.070] ReadFile (in: hFile=0x208, lpBuffer=0x26b3444, nNumberOfBytesToRead=0xe214, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26b3444*, lpNumberOfBytesRead=0x26ef24*=0xe214, lpOverlapped=0x0) returned 1
	[0099.074] CloseHandle (hObject=0x208) returned 1
	[0099.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\EdDq2m7lNBxZX.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\EdDq2m7lNBxZX.bmp.KEKW", lpFilePart=0x0) returned 0x4f
	[0099.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0099.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\EdDq2m7lNBxZX.bmp.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\eddq2m7lnbxzx.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.076] GetFileType (hFile=0x208) returned 0x1
	[0099.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0099.076] GetFileType (hFile=0x208) returned 0x1
	[0099.077] WriteFile (in: hFile=0x208, lpBuffer=0x26c2d7c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26c2d7c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0099.080] CloseHandle (hObject=0x208) returned 1
	[0099.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\EdDq2m7lNBxZX.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\EdDq2m7lNBxZX.bmp", lpFilePart=0x0) returned 0x4a
	[0099.081] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\EdDq2m7lNBxZX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\eddq2m7lnbxzx.bmp")) returned 1
	[0099.086] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3e3bc0, ftCreationTime.dwHighDateTime=0x1d5e643, ftLastAccessTime.dwLowDateTime=0xb90deaa0, ftLastAccessTime.dwHighDateTime=0x1d5e4dd, ftLastWriteTime.dwLowDateTime=0xb90deaa0, ftLastWriteTime.dwHighDateTime=0x1d5e4dd, nFileSizeHigh=0x0, nFileSizeLow=0x12801, dwReserved0=0x0, dwReserved1=0x0, cFileName="lr7rvr.avi", cAlternateFileName="")) returned 1
	[0099.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\lr7rvr.avi", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\lr7rvr.avi", lpFilePart=0x0) returned 0x43
	[0099.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0099.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\lr7rvr.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\lr7rvr.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.087] GetFileType (hFile=0x208) returned 0x1
	[0099.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0099.087] GetFileType (hFile=0x208) returned 0x1
	[0099.087] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x12801
	[0099.087] ReadFile (in: hFile=0x208, lpBuffer=0x26c42cc, nNumberOfBytesToRead=0x12801, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26c42cc*, lpNumberOfBytesRead=0x26ef24*=0x12801, lpOverlapped=0x0) returned 1
	[0099.091] CloseHandle (hObject=0x208) returned 1
	[0099.091] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\lr7rvr.avi.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\lr7rvr.avi.KEKW", lpFilePart=0x0) returned 0x48
	[0099.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0099.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\lr7rvr.avi.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\lr7rvr.avi.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.093] GetFileType (hFile=0x208) returned 0x1
	[0099.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0099.093] GetFileType (hFile=0x208) returned 0x1
	[0099.094] WriteFile (in: hFile=0x208, lpBuffer=0x26d81cc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26d81cc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0099.097] CloseHandle (hObject=0x208) returned 1
	[0099.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\lr7rvr.avi", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\lr7rvr.avi", lpFilePart=0x0) returned 0x43
	[0099.098] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\lr7rvr.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\lr7rvr.avi")) returned 1
	[0099.102] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17abcf10, ftCreationTime.dwHighDateTime=0x1d5d7d1, ftLastAccessTime.dwLowDateTime=0xf4702160, ftLastAccessTime.dwHighDateTime=0x1d5e53e, ftLastWriteTime.dwLowDateTime=0xf4702160, ftLastWriteTime.dwHighDateTime=0x1d5e53e, nFileSizeHigh=0x0, nFileSizeLow=0x184d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="N9M5kz3lUb.mp3", cAlternateFileName="N9M5KZ~1.MP3")) returned 1
	[0099.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\N9M5kz3lUb.mp3", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\N9M5kz3lUb.mp3", lpFilePart=0x0) returned 0x47
	[0099.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0099.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\N9M5kz3lUb.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\n9m5kz3lub.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.103] GetFileType (hFile=0x208) returned 0x1
	[0099.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0099.103] GetFileType (hFile=0x208) returned 0x1
	[0099.103] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x184d8
	[0099.104] ReadFile (in: hFile=0x208, lpBuffer=0x38a6908, nNumberOfBytesToRead=0x184d8, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x38a6908*, lpNumberOfBytesRead=0x26ef24*=0x184d8, lpOverlapped=0x0) returned 1
	[0099.112] CloseHandle (hObject=0x208) returned 1
	[0099.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\N9M5kz3lUb.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\N9M5kz3lUb.mp3.KEKW", lpFilePart=0x0) returned 0x4c
	[0099.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0099.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\N9M5kz3lUb.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\n9m5kz3lub.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.114] GetFileType (hFile=0x208) returned 0x1
	[0099.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0099.114] GetFileType (hFile=0x208) returned 0x1
	[0099.115] WriteFile (in: hFile=0x208, lpBuffer=0x26dae7c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26dae7c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0099.118] CloseHandle (hObject=0x208) returned 1
	[0099.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\N9M5kz3lUb.mp3", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\N9M5kz3lUb.mp3", lpFilePart=0x0) returned 0x47
	[0099.118] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\N9M5kz3lUb.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\n9m5kz3lub.mp3")) returned 1
	[0099.123] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78e2f690, ftCreationTime.dwHighDateTime=0x1d5da1b, ftLastAccessTime.dwLowDateTime=0xb1624ed0, ftLastAccessTime.dwHighDateTime=0x1d5e0b5, ftLastWriteTime.dwLowDateTime=0xb1624ed0, ftLastWriteTime.dwHighDateTime=0x1d5e0b5, nFileSizeHigh=0x0, nFileSizeLow=0x14309, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScoPPq5fImFDiV86.mp3", cAlternateFileName="SCOPPQ~1.MP3")) returned 1
	[0099.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\ScoPPq5fImFDiV86.mp3", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\ScoPPq5fImFDiV86.mp3", lpFilePart=0x0) returned 0x4d
	[0099.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0099.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\ScoPPq5fImFDiV86.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\scoppq5fimfdiv86.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.124] GetFileType (hFile=0x208) returned 0x1
	[0099.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0099.124] GetFileType (hFile=0x208) returned 0x1
	[0099.124] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x14309
	[0099.125] ReadFile (in: hFile=0x208, lpBuffer=0x26dc48c, nNumberOfBytesToRead=0x14309, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26dc48c*, lpNumberOfBytesRead=0x26ef24*=0x14309, lpOverlapped=0x0) returned 1
	[0099.129] CloseHandle (hObject=0x208) returned 1
	[0099.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\ScoPPq5fImFDiV86.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\ScoPPq5fImFDiV86.mp3.KEKW", lpFilePart=0x0) returned 0x52
	[0099.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0099.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\ScoPPq5fImFDiV86.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\scoppq5fimfdiv86.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.131] GetFileType (hFile=0x208) returned 0x1
	[0099.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0099.132] GetFileType (hFile=0x208) returned 0x1
	[0099.132] WriteFile (in: hFile=0x208, lpBuffer=0x26f1ed0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26f1ed0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0099.135] CloseHandle (hObject=0x208) returned 1
	[0099.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\ScoPPq5fImFDiV86.mp3", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\ScoPPq5fImFDiV86.mp3", lpFilePart=0x0) returned 0x4d
	[0099.136] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\ScoPPq5fImFDiV86.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\scoppq5fimfdiv86.mp3")) returned 1
	[0099.140] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fadd40, ftCreationTime.dwHighDateTime=0x1d5d8da, ftLastAccessTime.dwLowDateTime=0xc672b4f0, ftLastAccessTime.dwHighDateTime=0x1d5df33, ftLastWriteTime.dwLowDateTime=0xc672b4f0, ftLastWriteTime.dwHighDateTime=0x1d5df33, nFileSizeHigh=0x0, nFileSizeLow=0xfb33, dwReserved0=0x0, dwReserved1=0x0, cFileName="tdyk843.png", cAlternateFileName="")) returned 1
	[0099.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\tdyk843.png", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\tdyk843.png", lpFilePart=0x0) returned 0x44
	[0099.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0099.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\tdyk843.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\tdyk843.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.142] GetFileType (hFile=0x208) returned 0x1
	[0099.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0099.142] GetFileType (hFile=0x208) returned 0x1
	[0099.142] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xfb33
	[0099.142] ReadFile (in: hFile=0x208, lpBuffer=0x26f3438, nNumberOfBytesToRead=0xfb33, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26f3438*, lpNumberOfBytesRead=0x26ef24*=0xfb33, lpOverlapped=0x0) returned 1
	[0099.146] CloseHandle (hObject=0x208) returned 1
	[0099.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\tdyk843.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\tdyk843.png.KEKW", lpFilePart=0x0) returned 0x49
	[0099.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0099.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\tdyk843.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\tdyk843.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0099.148] GetFileType (hFile=0x208) returned 0x1
	[0099.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0099.149] GetFileType (hFile=0x208) returned 0x1
	[0099.149] WriteFile (in: hFile=0x208, lpBuffer=0x270466c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x270466c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0099.152] CloseHandle (hObject=0x208) returned 1
	[0099.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\tdyk843.png", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\tdyk843.png", lpFilePart=0x0) returned 0x44
	[0099.153] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\tdyk843.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\tdyk843.png")) returned 1
	[0099.238] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x853b2250, ftCreationTime.dwHighDateTime=0x1d5dc05, ftLastAccessTime.dwLowDateTime=0x750ea310, ftLastAccessTime.dwHighDateTime=0x1d5ddaa, ftLastWriteTime.dwLowDateTime=0x750ea310, ftLastWriteTime.dwHighDateTime=0x1d5ddaa, nFileSizeHigh=0x0, nFileSizeLow=0x16c98, dwReserved0=0x0, dwReserved1=0x0, cFileName="YzdD53.m4a", cAlternateFileName="")) returned 1
	[0099.239] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0099.239] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0099.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0099.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0099.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0099.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0099.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JVBNjkN-Qb39_TBQ4y\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jvbnjkn-qb39_tbq4y\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0099.275] GetFileType (hFile=0x204) returned 0x1
	[0099.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0099.275] GetFileType (hFile=0x204) returned 0x1
	[0099.275] WriteFile (in: hFile=0x204, lpBuffer=0x2707110*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2707110*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0099.279] CloseHandle (hObject=0x204) returned 1
	[0099.279] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1135d00, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xd1abf380, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0x9a861400, ftLastWriteTime.dwHighDateTime=0x1d60291, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="KEKW.exe", cAlternateFileName="")) returned 1
	[0099.280] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62796c50, ftCreationTime.dwHighDateTime=0x1d5e712, ftLastAccessTime.dwLowDateTime=0xa3f24930, ftLastAccessTime.dwHighDateTime=0x1d5df75, ftLastWriteTime.dwLowDateTime=0xa3f24930, ftLastWriteTime.dwHighDateTime=0x1d5df75, nFileSizeHigh=0x0, nFileSizeLow=0x594d, dwReserved0=0x0, dwReserved1=0x0, cFileName="kU-XyHe85QS B6hnV.mp4", cAlternateFileName="KU-XYH~1.MP4")) returned 1
	[0099.280] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa870f680, ftCreationTime.dwHighDateTime=0x1d5e436, ftLastAccessTime.dwLowDateTime=0x2cfa5620, ftLastAccessTime.dwHighDateTime=0x1d5e104, ftLastWriteTime.dwLowDateTime=0x2cfa5620, ftLastWriteTime.dwHighDateTime=0x1d5e104, nFileSizeHigh=0x0, nFileSizeLow=0x3a70, dwReserved0=0x0, dwReserved1=0x0, cFileName="L QS.mp3", cAlternateFileName="LQS~1.MP3")) returned 1
	[0099.281] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37616eb0, ftCreationTime.dwHighDateTime=0x1d5e6bc, ftLastAccessTime.dwLowDateTime=0xee64bf80, ftLastAccessTime.dwHighDateTime=0x1d5dc1d, ftLastWriteTime.dwLowDateTime=0xee64bf80, ftLastWriteTime.dwHighDateTime=0x1d5dc1d, nFileSizeHigh=0x0, nFileSizeLow=0xef0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="M4Ls.mp4", cAlternateFileName="")) returned 1
	[0099.283] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66d5fc20, ftCreationTime.dwHighDateTime=0x1d5e021, ftLastAccessTime.dwLowDateTime=0x5a0e7db0, ftLastAccessTime.dwHighDateTime=0x1d5e593, ftLastWriteTime.dwLowDateTime=0x5a0e7db0, ftLastWriteTime.dwHighDateTime=0x1d5e593, nFileSizeHigh=0x0, nFileSizeLow=0xde6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="n5xbvFHN50k ei.flv", cAlternateFileName="N5XBVF~1.FLV")) returned 1
	[0099.284] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7ff7170, ftCreationTime.dwHighDateTime=0x1d5df92, ftLastAccessTime.dwLowDateTime=0x9467c120, ftLastAccessTime.dwHighDateTime=0x1d5da89, ftLastWriteTime.dwLowDateTime=0x9467c120, ftLastWriteTime.dwHighDateTime=0x1d5da89, nFileSizeHigh=0x0, nFileSizeLow=0x6d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAAh92c2O4I.mkv", cAlternateFileName="NAAH92~1.MKV")) returned 1
	[0099.284] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89cf760, ftCreationTime.dwHighDateTime=0x1d5e78a, ftLastAccessTime.dwLowDateTime=0xa32780a0, ftLastAccessTime.dwHighDateTime=0x1d5e57f, ftLastWriteTime.dwLowDateTime=0xa32780a0, ftLastWriteTime.dwHighDateTime=0x1d5e57f, nFileSizeHigh=0x0, nFileSizeLow=0x18c1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJkN.pptx", cAlternateFileName="PJKN~1.PPT")) returned 1
	[0099.285] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cd68ca0, ftCreationTime.dwHighDateTime=0x1d5df03, ftLastAccessTime.dwLowDateTime=0xfe3c3cd0, ftLastAccessTime.dwHighDateTime=0x1d5e5f0, ftLastWriteTime.dwLowDateTime=0xfe3c3cd0, ftLastWriteTime.dwHighDateTime=0x1d5e5f0, nFileSizeHigh=0x0, nFileSizeLow=0xd92b, dwReserved0=0x0, dwReserved1=0x0, cFileName="r2SZONAONwKHnnay.m4a", cAlternateFileName="R2SZON~1.M4A")) returned 1
	[0099.286] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x274fdb0, ftCreationTime.dwHighDateTime=0x1d5e181, ftLastAccessTime.dwLowDateTime=0x9bdf8d00, ftLastAccessTime.dwHighDateTime=0x1d5e3e6, ftLastWriteTime.dwLowDateTime=0x9bdf8d00, ftLastWriteTime.dwHighDateTime=0x1d5e3e6, nFileSizeHigh=0x0, nFileSizeLow=0x14bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAG_M6ElF.mkv", cAlternateFileName="SAG_M6~1.MKV")) returned 1
	[0099.286] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e6ca920, ftCreationTime.dwHighDateTime=0x1d5dd94, ftLastAccessTime.dwLowDateTime=0x20d88ab0, ftLastAccessTime.dwHighDateTime=0x1d5d8da, ftLastWriteTime.dwLowDateTime=0x20d88ab0, ftLastWriteTime.dwHighDateTime=0x1d5d8da, nFileSizeHigh=0x0, nFileSizeLow=0xa65a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sgch.m4a", cAlternateFileName="")) returned 1
	[0099.287] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2cf49b0, ftCreationTime.dwHighDateTime=0x1d5d7f8, ftLastAccessTime.dwLowDateTime=0x36121340, ftLastAccessTime.dwHighDateTime=0x1d5dfd5, ftLastWriteTime.dwLowDateTime=0x36121340, ftLastWriteTime.dwHighDateTime=0x1d5dfd5, nFileSizeHigh=0x0, nFileSizeLow=0x9a33, dwReserved0=0x0, dwReserved1=0x0, cFileName="tvLT_0yKTsc.mp3", cAlternateFileName="TVLT_0~1.MP3")) returned 1
	[0099.287] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef225fd0, ftCreationTime.dwHighDateTime=0x1d5e123, ftLastAccessTime.dwLowDateTime=0xc8bc1950, ftLastAccessTime.dwHighDateTime=0x1d5d94c, ftLastWriteTime.dwLowDateTime=0xc8bc1950, ftLastWriteTime.dwHighDateTime=0x1d5d94c, nFileSizeHigh=0x0, nFileSizeLow=0x134f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WNwFoyBHyvIiMSc.png", cAlternateFileName="WNWFOY~1.PNG")) returned 1
	[0099.288] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bbcfe0, ftCreationTime.dwHighDateTime=0x1d5e106, ftLastAccessTime.dwLowDateTime=0x19313c50, ftLastAccessTime.dwHighDateTime=0x1d5df81, ftLastWriteTime.dwLowDateTime=0x19313c50, ftLastWriteTime.dwHighDateTime=0x1d5df81, nFileSizeHigh=0x0, nFileSizeLow=0x17302, dwReserved0=0x0, dwReserved1=0x0, cFileName="z vMBS41 30Qj46r2tT.mp3", cAlternateFileName="ZVMBS4~1.MP3")) returned 1
	[0099.289] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c05dea0, ftCreationTime.dwHighDateTime=0x1d5dc5d, ftLastAccessTime.dwLowDateTime=0x32774b50, ftLastAccessTime.dwHighDateTime=0x1d5e32d, ftLastWriteTime.dwLowDateTime=0x32774b50, ftLastWriteTime.dwHighDateTime=0x1d5e32d, nFileSizeHigh=0x0, nFileSizeLow=0xd56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZRKQr vDI2XvOo.flv", cAlternateFileName="ZRKQRV~1.FLV")) returned 1
	[0099.289] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c05dea0, ftCreationTime.dwHighDateTime=0x1d5dc5d, ftLastAccessTime.dwLowDateTime=0x32774b50, ftLastAccessTime.dwHighDateTime=0x1d5e32d, ftLastWriteTime.dwLowDateTime=0x32774b50, ftLastWriteTime.dwHighDateTime=0x1d5e32d, nFileSizeHigh=0x0, nFileSizeLow=0xd56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZRKQr vDI2XvOo.flv", cAlternateFileName="ZRKQRV~1.FLV")) returned 0
	[0099.290] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0099.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0099.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0099.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0099.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
	[0099.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26
	[0099.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe2743740, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xe2743740, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0099.292] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe2743740, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xe2743740, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0099.292] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821e7460, ftCreationTime.dwHighDateTime=0x1d5e168, ftLastAccessTime.dwLowDateTime=0x909805d0, ftLastAccessTime.dwHighDateTime=0x1d5e16b, ftLastWriteTime.dwLowDateTime=0x909805d0, ftLastWriteTime.dwHighDateTime=0x1d5e16b, nFileSizeHigh=0x0, nFileSizeLow=0x846, dwReserved0=0x0, dwReserved1=0x0, cFileName="-8eG4Vj0uzt.swf", cAlternateFileName="-8EG4V~1.SWF")) returned 1
	[0099.293] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7cdf070, ftCreationTime.dwHighDateTime=0x1d5e6b3, ftLastAccessTime.dwLowDateTime=0x500ebbd0, ftLastAccessTime.dwHighDateTime=0x1d5dfc2, ftLastWriteTime.dwLowDateTime=0x500ebbd0, ftLastWriteTime.dwHighDateTime=0x1d5dfc2, nFileSizeHigh=0x0, nFileSizeLow=0x9f0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="1JHA5FWMFgn.mp3", cAlternateFileName="1JHA5F~1.MP3")) returned 1
	[0099.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1JHA5FWMFgn.mp3", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1JHA5FWMFgn.mp3", lpFilePart=0x0) returned 0x35
	[0099.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1JHA5FWMFgn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1jha5fwmfgn.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.294] GetFileType (hFile=0x204) returned 0x1
	[0099.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.294] GetFileType (hFile=0x204) returned 0x1
	[0099.294] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x9f0f
	[0099.294] ReadFile (in: hFile=0x204, lpBuffer=0x270a228, nNumberOfBytesToRead=0x9f0f, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x270a228*, lpNumberOfBytesRead=0x26efc4*=0x9f0f, lpOverlapped=0x0) returned 1
	[0099.298] CloseHandle (hObject=0x204) returned 1
	[0099.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1JHA5FWMFgn.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1JHA5FWMFgn.mp3.KEKW", lpFilePart=0x0) returned 0x3a
	[0099.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1JHA5FWMFgn.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1jha5fwmfgn.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.300] GetFileType (hFile=0x204) returned 0x1
	[0099.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.301] GetFileType (hFile=0x204) returned 0x1
	[0099.301] WriteFile (in: hFile=0x204, lpBuffer=0x2715808*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2715808*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.304] CloseHandle (hObject=0x204) returned 1
	[0099.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1JHA5FWMFgn.mp3", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1JHA5FWMFgn.mp3", lpFilePart=0x0) returned 0x35
	[0099.347] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1JHA5FWMFgn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1jha5fwmfgn.mp3")) returned 1
	[0099.352] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b546230, ftCreationTime.dwHighDateTime=0x1d5e310, ftLastAccessTime.dwLowDateTime=0x9692d170, ftLastAccessTime.dwHighDateTime=0x1d5e811, ftLastWriteTime.dwLowDateTime=0x9692d170, ftLastWriteTime.dwHighDateTime=0x1d5e811, nFileSizeHigh=0x0, nFileSizeLow=0xf962, dwReserved0=0x0, dwReserved1=0x0, cFileName="2G0jYOLyFfWVl7zXML5.m4a", cAlternateFileName="2G0JYO~1.M4A")) returned 1
	[0099.352] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb4c30, ftCreationTime.dwHighDateTime=0x1d5e7d6, ftLastAccessTime.dwLowDateTime=0xc84efae0, ftLastAccessTime.dwHighDateTime=0x1d5e519, ftLastWriteTime.dwLowDateTime=0xc84efae0, ftLastWriteTime.dwHighDateTime=0x1d5e519, nFileSizeHigh=0x0, nFileSizeLow=0x14d6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="2IWp.gif", cAlternateFileName="")) returned 1
	[0099.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2IWp.gif", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2IWp.gif", lpFilePart=0x0) returned 0x2e
	[0099.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2IWp.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2iwp.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.353] GetFileType (hFile=0x204) returned 0x1
	[0099.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.353] GetFileType (hFile=0x204) returned 0x1
	[0099.353] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x14d6a
	[0099.354] ReadFile (in: hFile=0x204, lpBuffer=0x38bee00, nNumberOfBytesToRead=0x14d6a, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x38bee00*, lpNumberOfBytesRead=0x26efc4*=0x14d6a, lpOverlapped=0x0) returned 1
	[0099.361] CloseHandle (hObject=0x204) returned 1
	[0099.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2IWp.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2IWp.gif.KEKW", lpFilePart=0x0) returned 0x33
	[0099.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2IWp.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2iwp.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.364] GetFileType (hFile=0x204) returned 0x1
	[0099.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.364] GetFileType (hFile=0x204) returned 0x1
	[0099.365] WriteFile (in: hFile=0x204, lpBuffer=0x2718654*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2718654*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.368] CloseHandle (hObject=0x204) returned 1
	[0099.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2IWp.gif", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2IWp.gif", lpFilePart=0x0) returned 0x2e
	[0099.369] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2IWp.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2iwp.gif")) returned 1
	[0099.378] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef325cb0, ftCreationTime.dwHighDateTime=0x1d5ddb2, ftLastAccessTime.dwLowDateTime=0xaccebe40, ftLastAccessTime.dwHighDateTime=0x1d5da65, ftLastWriteTime.dwLowDateTime=0xaccebe40, ftLastWriteTime.dwHighDateTime=0x1d5da65, nFileSizeHigh=0x0, nFileSizeLow=0xbab1, dwReserved0=0x0, dwReserved1=0x0, cFileName="5wJxRKjMWEP.odt", cAlternateFileName="5WJXRK~1.ODT")) returned 1
	[0099.378] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98042520, ftCreationTime.dwHighDateTime=0x1d5dab2, ftLastAccessTime.dwLowDateTime=0x1119d4c0, ftLastAccessTime.dwHighDateTime=0x1d5e3bc, ftLastWriteTime.dwLowDateTime=0x1119d4c0, ftLastWriteTime.dwHighDateTime=0x1d5e3bc, nFileSizeHigh=0x0, nFileSizeLow=0x113dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARmLj_June5TKj.swf", cAlternateFileName="ARMLJ_~1.SWF")) returned 1
	[0099.379] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6a9c7e0, ftCreationTime.dwHighDateTime=0x1d5e6ca, ftLastAccessTime.dwLowDateTime=0x9670b00, ftLastAccessTime.dwHighDateTime=0x1d5e48c, ftLastWriteTime.dwLowDateTime=0x9670b00, ftLastWriteTime.dwHighDateTime=0x1d5e48c, nFileSizeHigh=0x0, nFileSizeLow=0xafda, dwReserved0=0x0, dwReserved1=0x0, cFileName="bzV6a5Pfe.flv", cAlternateFileName="BZV6A5~1.FLV")) returned 1
	[0099.379] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1f33750, ftCreationTime.dwHighDateTime=0x1d5e206, ftLastAccessTime.dwLowDateTime=0x92b42620, ftLastAccessTime.dwHighDateTime=0x1d5e37b, ftLastWriteTime.dwLowDateTime=0x92b42620, ftLastWriteTime.dwHighDateTime=0x1d5e37b, nFileSizeHigh=0x0, nFileSizeLow=0x14eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C-RcLTpgwLsTNOwu1.bmp", cAlternateFileName="C-RCLT~1.BMP")) returned 1
	[0099.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C-RcLTpgwLsTNOwu1.bmp", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C-RcLTpgwLsTNOwu1.bmp", lpFilePart=0x0) returned 0x3b
	[0099.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C-RcLTpgwLsTNOwu1.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c-rcltpgwlstnowu1.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.380] GetFileType (hFile=0x204) returned 0x1
	[0099.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.380] GetFileType (hFile=0x204) returned 0x1
	[0099.381] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x14eaa
	[0099.382] ReadFile (in: hFile=0x204, lpBuffer=0x38d3b88, nNumberOfBytesToRead=0x14eaa, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x38d3b88*, lpNumberOfBytesRead=0x26efc4*=0x14eaa, lpOverlapped=0x0) returned 1
	[0099.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C-RcLTpgwLsTNOwu1.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C-RcLTpgwLsTNOwu1.bmp.KEKW", lpFilePart=0x0) returned 0x40
	[0099.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C-RcLTpgwLsTNOwu1.bmp.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c-rcltpgwlstnowu1.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.411] GetFileType (hFile=0x204) returned 0x1
	[0099.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.412] GetFileType (hFile=0x204) returned 0x1
	[0099.412] WriteFile (in: hFile=0x204, lpBuffer=0x271bbe8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x271bbe8*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C-RcLTpgwLsTNOwu1.bmp", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C-RcLTpgwLsTNOwu1.bmp", lpFilePart=0x0) returned 0x3b
	[0099.416] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\C-RcLTpgwLsTNOwu1.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c-rcltpgwlstnowu1.bmp")) returned 1
	[0099.423] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0099.423] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0d599c0, ftCreationTime.dwHighDateTime=0x1d5da88, ftLastAccessTime.dwLowDateTime=0x14a5b350, ftLastAccessTime.dwHighDateTime=0x1d5d937, ftLastWriteTime.dwLowDateTime=0x14a5b350, ftLastWriteTime.dwHighDateTime=0x1d5d937, nFileSizeHigh=0x0, nFileSizeLow=0xf802, dwReserved0=0x0, dwReserved1=0x0, cFileName="d_W6.swf", cAlternateFileName="")) returned 1
	[0099.423] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafa723c0, ftCreationTime.dwHighDateTime=0x1d5dbf3, ftLastAccessTime.dwLowDateTime=0x64dbf570, ftLastAccessTime.dwHighDateTime=0x1d5e385, ftLastWriteTime.dwLowDateTime=0x64dbf570, ftLastWriteTime.dwHighDateTime=0x1d5e385, nFileSizeHigh=0x0, nFileSizeLow=0x76c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="EaGMVKx99tO38Ada6zp.doc", cAlternateFileName="EAGMVK~1.DOC")) returned 1
	[0099.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EaGMVKx99tO38Ada6zp.doc", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EaGMVKx99tO38Ada6zp.doc", lpFilePart=0x0) returned 0x3d
	[0099.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EaGMVKx99tO38Ada6zp.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eagmvkx99to38ada6zp.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.424] GetFileType (hFile=0x204) returned 0x1
	[0099.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.424] GetFileType (hFile=0x204) returned 0x1
	[0099.425] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x76c5
	[0099.425] ReadFile (in: hFile=0x204, lpBuffer=0x271d6bc, nNumberOfBytesToRead=0x76c5, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x271d6bc*, lpNumberOfBytesRead=0x26efc4*=0x76c5, lpOverlapped=0x0) returned 1
	[0099.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EaGMVKx99tO38Ada6zp.doc.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EaGMVKx99tO38Ada6zp.doc.KEKW", lpFilePart=0x0) returned 0x42
	[0099.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.429] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EaGMVKx99tO38Ada6zp.doc.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eagmvkx99to38ada6zp.doc.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.429] GetFileType (hFile=0x204) returned 0x1
	[0099.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.430] GetFileType (hFile=0x204) returned 0x1
	[0099.430] WriteFile (in: hFile=0x204, lpBuffer=0x2726484*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2726484*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.433] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EaGMVKx99tO38Ada6zp.doc", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EaGMVKx99tO38Ada6zp.doc", lpFilePart=0x0) returned 0x3d
	[0099.434] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EaGMVKx99tO38Ada6zp.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eagmvkx99to38ada6zp.doc")) returned 1
	[0099.464] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ff1120, ftCreationTime.dwHighDateTime=0x1d5db4a, ftLastAccessTime.dwLowDateTime=0xd1ec7300, ftLastAccessTime.dwHighDateTime=0x1d5d8d7, ftLastWriteTime.dwLowDateTime=0xd1ec7300, ftLastWriteTime.dwHighDateTime=0x1d5d8d7, nFileSizeHigh=0x0, nFileSizeLow=0x1981, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eez-t7cYZD.jpg", cAlternateFileName="EEZ-T7~1.JPG")) returned 1
	[0099.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Eez-t7cYZD.jpg", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Eez-t7cYZD.jpg", lpFilePart=0x0) returned 0x34
	[0099.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.465] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Eez-t7cYZD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eez-t7cyzd.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.465] GetFileType (hFile=0x204) returned 0x1
	[0099.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.466] GetFileType (hFile=0x204) returned 0x1
	[0099.466] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x1981
	[0099.466] ReadFile (in: hFile=0x204, lpBuffer=0x2727944, nNumberOfBytesToRead=0x1981, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x2727944*, lpNumberOfBytesRead=0x26efc4*=0x1981, lpOverlapped=0x0) returned 1
	[0099.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Eez-t7cYZD.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Eez-t7cYZD.jpg.KEKW", lpFilePart=0x0) returned 0x39
	[0099.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Eez-t7cYZD.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eez-t7cyzd.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.471] GetFileType (hFile=0x204) returned 0x1
	[0099.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.471] GetFileType (hFile=0x204) returned 0x1
	[0099.472] WriteFile (in: hFile=0x204, lpBuffer=0x272a98c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x272a98c*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Eez-t7cYZD.jpg", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Eez-t7cYZD.jpg", lpFilePart=0x0) returned 0x34
	[0099.475] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Eez-t7cYZD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eez-t7cyzd.jpg")) returned 1
	[0099.480] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55bf750, ftCreationTime.dwHighDateTime=0x1d5e4be, ftLastAccessTime.dwLowDateTime=0x852664c0, ftLastAccessTime.dwHighDateTime=0x1d5e18a, ftLastWriteTime.dwLowDateTime=0x852664c0, ftLastWriteTime.dwHighDateTime=0x1d5e18a, nFileSizeHigh=0x0, nFileSizeLow=0x15055, dwReserved0=0x0, dwReserved1=0x0, cFileName="FNuzNIqniMp8p.bmp", cAlternateFileName="FNUZNI~1.BMP")) returned 1
	[0099.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FNuzNIqniMp8p.bmp", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FNuzNIqniMp8p.bmp", lpFilePart=0x0) returned 0x37
	[0099.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FNuzNIqniMp8p.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fnuzniqnimp8p.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.481] GetFileType (hFile=0x204) returned 0x1
	[0099.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.482] GetFileType (hFile=0x204) returned 0x1
	[0099.482] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x15055
	[0099.561] ReadFile (in: hFile=0x204, lpBuffer=0x35d54d0, nNumberOfBytesToRead=0x15055, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x35d54d0*, lpNumberOfBytesRead=0x26efc4*=0x15055, lpOverlapped=0x0) returned 1
	[0099.566] CloseHandle (hObject=0x204) returned 1
	[0099.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FNuzNIqniMp8p.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FNuzNIqniMp8p.bmp.KEKW", lpFilePart=0x0) returned 0x3c
	[0099.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FNuzNIqniMp8p.bmp.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fnuzniqnimp8p.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.568] GetFileType (hFile=0x204) returned 0x1
	[0099.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.569] GetFileType (hFile=0x204) returned 0x1
	[0099.570] WriteFile (in: hFile=0x204, lpBuffer=0x25de520*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x25de520*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.572] CloseHandle (hObject=0x204) returned 1
	[0099.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FNuzNIqniMp8p.bmp", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FNuzNIqniMp8p.bmp", lpFilePart=0x0) returned 0x37
	[0099.573] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FNuzNIqniMp8p.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fnuzniqnimp8p.bmp")) returned 1
	[0099.586] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fe6c2f0, ftCreationTime.dwHighDateTime=0x1d5e5cc, ftLastAccessTime.dwLowDateTime=0xeb938350, ftLastAccessTime.dwHighDateTime=0x1d5dfdc, ftLastWriteTime.dwLowDateTime=0xeb938350, ftLastWriteTime.dwHighDateTime=0x1d5dfdc, nFileSizeHigh=0x0, nFileSizeLow=0x125f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="gejNrNkaoA4QRCitb.mp4", cAlternateFileName="GEJNRN~1.MP4")) returned 1
	[0099.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gejNrNkaoA4QRCitb.mp4", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gejNrNkaoA4QRCitb.mp4", lpFilePart=0x0) returned 0x3b
	[0099.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gejNrNkaoA4QRCitb.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gejnrnkaoa4qrcitb.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.588] GetFileType (hFile=0x204) returned 0x1
	[0099.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.588] GetFileType (hFile=0x204) returned 0x1
	[0099.588] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x125f5
	[0099.588] ReadFile (in: hFile=0x204, lpBuffer=0x25dfa38, nNumberOfBytesToRead=0x125f5, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x25dfa38*, lpNumberOfBytesRead=0x26efc4*=0x125f5, lpOverlapped=0x0) returned 1
	[0099.593] CloseHandle (hObject=0x204) returned 1
	[0099.593] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gejNrNkaoA4QRCitb.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gejNrNkaoA4QRCitb.mp4.KEKW", lpFilePart=0x0) returned 0x40
	[0099.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gejNrNkaoA4QRCitb.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gejnrnkaoa4qrcitb.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.596] GetFileType (hFile=0x204) returned 0x1
	[0099.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.596] GetFileType (hFile=0x204) returned 0x1
	[0099.597] WriteFile (in: hFile=0x204, lpBuffer=0x25f3724*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x25f3724*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.599] CloseHandle (hObject=0x204) returned 1
	[0099.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gejNrNkaoA4QRCitb.mp4", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gejNrNkaoA4QRCitb.mp4", lpFilePart=0x0) returned 0x3b
	[0099.600] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gejNrNkaoA4QRCitb.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gejnrnkaoa4qrcitb.mp4")) returned 1
	[0099.606] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e088400, ftCreationTime.dwHighDateTime=0x1d5ddcb, ftLastAccessTime.dwLowDateTime=0x13126080, ftLastAccessTime.dwHighDateTime=0x1d5dec6, ftLastWriteTime.dwLowDateTime=0x13126080, ftLastWriteTime.dwHighDateTime=0x1d5dec6, nFileSizeHigh=0x0, nFileSizeLow=0x9b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="H27SqMWfI.swf", cAlternateFileName="H27SQM~1.SWF")) returned 1
	[0099.606] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2be0c0, ftCreationTime.dwHighDateTime=0x1d5e146, ftLastAccessTime.dwLowDateTime=0xa07cdca0, ftLastAccessTime.dwHighDateTime=0x1d5db03, ftLastWriteTime.dwLowDateTime=0xa07cdca0, ftLastWriteTime.dwHighDateTime=0x1d5db03, nFileSizeHigh=0x0, nFileSizeLow=0x16446, dwReserved0=0x0, dwReserved1=0x0, cFileName="I2IqxxSN9.png", cAlternateFileName="I2IQXX~1.PNG")) returned 1
	[0099.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I2IqxxSN9.png", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I2IqxxSN9.png", lpFilePart=0x0) returned 0x33
	[0099.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I2IqxxSN9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i2iqxxsn9.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.607] GetFileType (hFile=0x204) returned 0x1
	[0099.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.607] GetFileType (hFile=0x204) returned 0x1
	[0099.607] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x16446
	[0099.609] ReadFile (in: hFile=0x204, lpBuffer=0x35ea548, nNumberOfBytesToRead=0x16446, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x35ea548*, lpNumberOfBytesRead=0x26efc4*=0x16446, lpOverlapped=0x0) returned 1
	[0099.614] CloseHandle (hObject=0x204) returned 1
	[0099.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I2IqxxSN9.png.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I2IqxxSN9.png.KEKW", lpFilePart=0x0) returned 0x38
	[0099.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I2IqxxSN9.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i2iqxxsn9.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.624] GetFileType (hFile=0x204) returned 0x1
	[0099.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.624] GetFileType (hFile=0x204) returned 0x1
	[0099.624] WriteFile (in: hFile=0x204, lpBuffer=0x25f6594*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x25f6594*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.628] CloseHandle (hObject=0x204) returned 1
	[0099.629] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I2IqxxSN9.png", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I2IqxxSN9.png", lpFilePart=0x0) returned 0x33
	[0099.629] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I2IqxxSN9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i2iqxxsn9.png")) returned 1
	[0099.636] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a3a2c40, ftCreationTime.dwHighDateTime=0x1d5d9fa, ftLastAccessTime.dwLowDateTime=0x378625f0, ftLastAccessTime.dwHighDateTime=0x1d5ddc2, ftLastWriteTime.dwLowDateTime=0x378625f0, ftLastWriteTime.dwHighDateTime=0x1d5ddc2, nFileSizeHigh=0x0, nFileSizeLow=0x7434, dwReserved0=0x0, dwReserved1=0x0, cFileName="J73JTPPJvRxwHLQ0XC3a.swf", cAlternateFileName="J73JTP~1.SWF")) returned 1
	[0099.636] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35bc2210, ftCreationTime.dwHighDateTime=0x1d5e2a9, ftLastAccessTime.dwLowDateTime=0xc1d9730, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xc1d9730, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JVBNjkN-Qb39_TBQ4y", cAlternateFileName="JVBNJK~1")) returned 1
	[0099.637] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1135d00, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xd1abf380, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0x9a861400, ftLastWriteTime.dwHighDateTime=0x1d60291, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="KEKW.exe", cAlternateFileName="")) returned 1
	[0099.637] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62796c50, ftCreationTime.dwHighDateTime=0x1d5e712, ftLastAccessTime.dwLowDateTime=0xa3f24930, ftLastAccessTime.dwHighDateTime=0x1d5df75, ftLastWriteTime.dwLowDateTime=0xa3f24930, ftLastWriteTime.dwHighDateTime=0x1d5df75, nFileSizeHigh=0x0, nFileSizeLow=0x594d, dwReserved0=0x0, dwReserved1=0x0, cFileName="kU-XyHe85QS B6hnV.mp4", cAlternateFileName="KU-XYH~1.MP4")) returned 1
	[0099.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kU-XyHe85QS B6hnV.mp4", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kU-XyHe85QS B6hnV.mp4", lpFilePart=0x0) returned 0x3b
	[0099.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.638] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kU-XyHe85QS B6hnV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ku-xyhe85qs b6hnv.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.638] GetFileType (hFile=0x204) returned 0x1
	[0099.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.639] GetFileType (hFile=0x204) returned 0x1
	[0099.639] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x594d
	[0099.639] ReadFile (in: hFile=0x204, lpBuffer=0x25f826c, nNumberOfBytesToRead=0x594d, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x25f826c*, lpNumberOfBytesRead=0x26efc4*=0x594d, lpOverlapped=0x0) returned 1
	[0099.645] CloseHandle (hObject=0x204) returned 1
	[0099.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kU-XyHe85QS B6hnV.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kU-XyHe85QS B6hnV.mp4.KEKW", lpFilePart=0x0) returned 0x40
	[0099.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kU-XyHe85QS B6hnV.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ku-xyhe85qs b6hnv.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.648] GetFileType (hFile=0x204) returned 0x1
	[0099.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.648] GetFileType (hFile=0x204) returned 0x1
	[0099.648] WriteFile (in: hFile=0x204, lpBuffer=0x25ff2b0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x25ff2b0*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.651] CloseHandle (hObject=0x204) returned 1
	[0099.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kU-XyHe85QS B6hnV.mp4", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kU-XyHe85QS B6hnV.mp4", lpFilePart=0x0) returned 0x3b
	[0099.652] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kU-XyHe85QS B6hnV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ku-xyhe85qs b6hnv.mp4")) returned 1
	[0099.657] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa870f680, ftCreationTime.dwHighDateTime=0x1d5e436, ftLastAccessTime.dwLowDateTime=0x2cfa5620, ftLastAccessTime.dwHighDateTime=0x1d5e104, ftLastWriteTime.dwLowDateTime=0x2cfa5620, ftLastWriteTime.dwHighDateTime=0x1d5e104, nFileSizeHigh=0x0, nFileSizeLow=0x3a70, dwReserved0=0x0, dwReserved1=0x0, cFileName="L QS.mp3", cAlternateFileName="LQS~1.MP3")) returned 1
	[0099.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L QS.mp3", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L QS.mp3", lpFilePart=0x0) returned 0x2e
	[0099.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L QS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l qs.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.658] GetFileType (hFile=0x204) returned 0x1
	[0099.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.658] GetFileType (hFile=0x204) returned 0x1
	[0099.658] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x3a70
	[0099.658] ReadFile (in: hFile=0x204, lpBuffer=0x2600704, nNumberOfBytesToRead=0x3a70, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x2600704*, lpNumberOfBytesRead=0x26efc4*=0x3a70, lpOverlapped=0x0) returned 1
	[0099.662] CloseHandle (hObject=0x204) returned 1
	[0099.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L QS.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L QS.mp3.KEKW", lpFilePart=0x0) returned 0x33
	[0099.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L QS.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l qs.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.695] GetFileType (hFile=0x204) returned 0x1
	[0099.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.695] GetFileType (hFile=0x204) returned 0x1
	[0099.696] WriteFile (in: hFile=0x204, lpBuffer=0x2605814*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2605814*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.699] CloseHandle (hObject=0x204) returned 1
	[0099.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L QS.mp3", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L QS.mp3", lpFilePart=0x0) returned 0x2e
	[0099.700] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\L QS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\l qs.mp3")) returned 1
	[0099.704] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37616eb0, ftCreationTime.dwHighDateTime=0x1d5e6bc, ftLastAccessTime.dwLowDateTime=0xee64bf80, ftLastAccessTime.dwHighDateTime=0x1d5dc1d, ftLastWriteTime.dwLowDateTime=0xee64bf80, ftLastWriteTime.dwHighDateTime=0x1d5dc1d, nFileSizeHigh=0x0, nFileSizeLow=0xef0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="M4Ls.mp4", cAlternateFileName="")) returned 1
	[0099.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M4Ls.mp4", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M4Ls.mp4", lpFilePart=0x0) returned 0x2e
	[0099.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M4Ls.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m4ls.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.705] GetFileType (hFile=0x204) returned 0x1
	[0099.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.705] GetFileType (hFile=0x204) returned 0x1
	[0099.706] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xef0b
	[0099.706] ReadFile (in: hFile=0x204, lpBuffer=0x2606c30, nNumberOfBytesToRead=0xef0b, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x2606c30*, lpNumberOfBytesRead=0x26efc4*=0xef0b, lpOverlapped=0x0) returned 1
	[0099.709] CloseHandle (hObject=0x204) returned 1
	[0099.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M4Ls.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M4Ls.mp4.KEKW", lpFilePart=0x0) returned 0x33
	[0099.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M4Ls.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m4ls.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.711] GetFileType (hFile=0x204) returned 0x1
	[0099.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.711] GetFileType (hFile=0x204) returned 0x1
	[0099.712] WriteFile (in: hFile=0x204, lpBuffer=0x26171dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26171dc*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.715] CloseHandle (hObject=0x204) returned 1
	[0099.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M4Ls.mp4", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M4Ls.mp4", lpFilePart=0x0) returned 0x2e
	[0099.715] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\M4Ls.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\m4ls.mp4")) returned 1
	[0099.720] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66d5fc20, ftCreationTime.dwHighDateTime=0x1d5e021, ftLastAccessTime.dwLowDateTime=0x5a0e7db0, ftLastAccessTime.dwHighDateTime=0x1d5e593, ftLastWriteTime.dwLowDateTime=0x5a0e7db0, ftLastWriteTime.dwHighDateTime=0x1d5e593, nFileSizeHigh=0x0, nFileSizeLow=0xde6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="n5xbvFHN50k ei.flv", cAlternateFileName="N5XBVF~1.FLV")) returned 1
	[0099.720] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7ff7170, ftCreationTime.dwHighDateTime=0x1d5df92, ftLastAccessTime.dwLowDateTime=0x9467c120, ftLastAccessTime.dwHighDateTime=0x1d5da89, ftLastWriteTime.dwLowDateTime=0x9467c120, ftLastWriteTime.dwHighDateTime=0x1d5da89, nFileSizeHigh=0x0, nFileSizeLow=0x6d18, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAAh92c2O4I.mkv", cAlternateFileName="NAAH92~1.MKV")) returned 1
	[0099.721] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89cf760, ftCreationTime.dwHighDateTime=0x1d5e78a, ftLastAccessTime.dwLowDateTime=0xa32780a0, ftLastAccessTime.dwHighDateTime=0x1d5e57f, ftLastWriteTime.dwLowDateTime=0xa32780a0, ftLastWriteTime.dwHighDateTime=0x1d5e57f, nFileSizeHigh=0x0, nFileSizeLow=0x18c1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJkN.pptx", cAlternateFileName="PJKN~1.PPT")) returned 1
	[0099.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJkN.pptx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJkN.pptx", lpFilePart=0x0) returned 0x2f
	[0099.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJkN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pjkn.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.722] GetFileType (hFile=0x204) returned 0x1
	[0099.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.722] GetFileType (hFile=0x204) returned 0x1
	[0099.722] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x18c1a
	[0099.723] ReadFile (in: hFile=0x204, lpBuffer=0x36009b0, nNumberOfBytesToRead=0x18c1a, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x36009b0*, lpNumberOfBytesRead=0x26efc4*=0x18c1a, lpOverlapped=0x0) returned 1
	[0099.731] CloseHandle (hObject=0x204) returned 1
	[0099.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJkN.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJkN.pptx.KEKW", lpFilePart=0x0) returned 0x34
	[0099.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJkN.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pjkn.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.733] GetFileType (hFile=0x204) returned 0x1
	[0099.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.733] GetFileType (hFile=0x204) returned 0x1
	[0099.733] WriteFile (in: hFile=0x204, lpBuffer=0x261a354*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x261a354*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.736] CloseHandle (hObject=0x204) returned 1
	[0099.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJkN.pptx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJkN.pptx", lpFilePart=0x0) returned 0x2f
	[0099.737] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJkN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pjkn.pptx")) returned 1
	[0099.752] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cd68ca0, ftCreationTime.dwHighDateTime=0x1d5df03, ftLastAccessTime.dwLowDateTime=0xfe3c3cd0, ftLastAccessTime.dwHighDateTime=0x1d5e5f0, ftLastWriteTime.dwLowDateTime=0xfe3c3cd0, ftLastWriteTime.dwHighDateTime=0x1d5e5f0, nFileSizeHigh=0x0, nFileSizeLow=0xd92b, dwReserved0=0x0, dwReserved1=0x0, cFileName="r2SZONAONwKHnnay.m4a", cAlternateFileName="R2SZON~1.M4A")) returned 1
	[0099.753] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x274fdb0, ftCreationTime.dwHighDateTime=0x1d5e181, ftLastAccessTime.dwLowDateTime=0x9bdf8d00, ftLastAccessTime.dwHighDateTime=0x1d5e3e6, ftLastWriteTime.dwLowDateTime=0x9bdf8d00, ftLastWriteTime.dwHighDateTime=0x1d5e3e6, nFileSizeHigh=0x0, nFileSizeLow=0x14bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAG_M6ElF.mkv", cAlternateFileName="SAG_M6~1.MKV")) returned 1
	[0099.753] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e6ca920, ftCreationTime.dwHighDateTime=0x1d5dd94, ftLastAccessTime.dwLowDateTime=0x20d88ab0, ftLastAccessTime.dwHighDateTime=0x1d5d8da, ftLastWriteTime.dwLowDateTime=0x20d88ab0, ftLastWriteTime.dwHighDateTime=0x1d5d8da, nFileSizeHigh=0x0, nFileSizeLow=0xa65a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sgch.m4a", cAlternateFileName="")) returned 1
	[0099.754] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2cf49b0, ftCreationTime.dwHighDateTime=0x1d5d7f8, ftLastAccessTime.dwLowDateTime=0x36121340, ftLastAccessTime.dwHighDateTime=0x1d5dfd5, ftLastWriteTime.dwLowDateTime=0x36121340, ftLastWriteTime.dwHighDateTime=0x1d5dfd5, nFileSizeHigh=0x0, nFileSizeLow=0x9a33, dwReserved0=0x0, dwReserved1=0x0, cFileName="tvLT_0yKTsc.mp3", cAlternateFileName="TVLT_0~1.MP3")) returned 1
	[0099.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tvLT_0yKTsc.mp3", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tvLT_0yKTsc.mp3", lpFilePart=0x0) returned 0x35
	[0099.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tvLT_0yKTsc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tvlt_0yktsc.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.755] GetFileType (hFile=0x204) returned 0x1
	[0099.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.755] GetFileType (hFile=0x204) returned 0x1
	[0099.755] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x9a33
	[0099.756] ReadFile (in: hFile=0x204, lpBuffer=0x261c144, nNumberOfBytesToRead=0x9a33, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x261c144*, lpNumberOfBytesRead=0x26efc4*=0x9a33, lpOverlapped=0x0) returned 1
	[0099.759] CloseHandle (hObject=0x204) returned 1
	[0099.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tvLT_0yKTsc.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tvLT_0yKTsc.mp3.KEKW", lpFilePart=0x0) returned 0x3a
	[0099.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tvLT_0yKTsc.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tvlt_0yktsc.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.761] GetFileType (hFile=0x204) returned 0x1
	[0099.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.761] GetFileType (hFile=0x204) returned 0x1
	[0099.761] WriteFile (in: hFile=0x204, lpBuffer=0x2627248*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2627248*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.764] CloseHandle (hObject=0x204) returned 1
	[0099.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tvLT_0yKTsc.mp3", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tvLT_0yKTsc.mp3", lpFilePart=0x0) returned 0x35
	[0099.764] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tvLT_0yKTsc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tvlt_0yktsc.mp3")) returned 1
	[0099.769] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef225fd0, ftCreationTime.dwHighDateTime=0x1d5e123, ftLastAccessTime.dwLowDateTime=0xc8bc1950, ftLastAccessTime.dwHighDateTime=0x1d5d94c, ftLastWriteTime.dwLowDateTime=0xc8bc1950, ftLastWriteTime.dwHighDateTime=0x1d5d94c, nFileSizeHigh=0x0, nFileSizeLow=0x134f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WNwFoyBHyvIiMSc.png", cAlternateFileName="WNWFOY~1.PNG")) returned 1
	[0099.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WNwFoyBHyvIiMSc.png", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WNwFoyBHyvIiMSc.png", lpFilePart=0x0) returned 0x39
	[0099.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WNwFoyBHyvIiMSc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wnwfoybhyviimsc.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.770] GetFileType (hFile=0x204) returned 0x1
	[0099.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.770] GetFileType (hFile=0x204) returned 0x1
	[0099.771] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x134f9
	[0099.771] ReadFile (in: hFile=0x204, lpBuffer=0x262873c, nNumberOfBytesToRead=0x134f9, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x262873c*, lpNumberOfBytesRead=0x26efc4*=0x134f9, lpOverlapped=0x0) returned 1
	[0099.775] CloseHandle (hObject=0x204) returned 1
	[0099.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WNwFoyBHyvIiMSc.png.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WNwFoyBHyvIiMSc.png.KEKW", lpFilePart=0x0) returned 0x3e
	[0099.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WNwFoyBHyvIiMSc.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wnwfoybhyviimsc.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.777] GetFileType (hFile=0x204) returned 0x1
	[0099.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.777] GetFileType (hFile=0x204) returned 0x1
	[0099.777] WriteFile (in: hFile=0x204, lpBuffer=0x263d320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x263d320*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.781] CloseHandle (hObject=0x204) returned 1
	[0099.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WNwFoyBHyvIiMSc.png", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WNwFoyBHyvIiMSc.png", lpFilePart=0x0) returned 0x39
	[0099.781] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WNwFoyBHyvIiMSc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wnwfoybhyviimsc.png")) returned 1
	[0099.794] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bbcfe0, ftCreationTime.dwHighDateTime=0x1d5e106, ftLastAccessTime.dwLowDateTime=0x19313c50, ftLastAccessTime.dwHighDateTime=0x1d5df81, ftLastWriteTime.dwLowDateTime=0x19313c50, ftLastWriteTime.dwHighDateTime=0x1d5df81, nFileSizeHigh=0x0, nFileSizeLow=0x17302, dwReserved0=0x0, dwReserved1=0x0, cFileName="z vMBS41 30Qj46r2tT.mp3", cAlternateFileName="ZVMBS4~1.MP3")) returned 1
	[0099.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z vMBS41 30Qj46r2tT.mp3", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z vMBS41 30Qj46r2tT.mp3", lpFilePart=0x0) returned 0x3d
	[0099.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0099.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z vMBS41 30Qj46r2tT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z vmbs41 30qj46r2tt.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.796] GetFileType (hFile=0x204) returned 0x1
	[0099.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0099.796] GetFileType (hFile=0x204) returned 0x1
	[0099.797] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x17302
	[0099.798] ReadFile (in: hFile=0x204, lpBuffer=0x36195e8, nNumberOfBytesToRead=0x17302, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x36195e8*, lpNumberOfBytesRead=0x26efc4*=0x17302, lpOverlapped=0x0) returned 1
	[0099.806] CloseHandle (hObject=0x204) returned 1
	[0099.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z vMBS41 30Qj46r2tT.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z vMBS41 30Qj46r2tT.mp3.KEKW", lpFilePart=0x0) returned 0x42
	[0099.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0099.807] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z vMBS41 30Qj46r2tT.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z vmbs41 30qj46r2tt.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0099.808] GetFileType (hFile=0x204) returned 0x1
	[0099.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0099.808] GetFileType (hFile=0x204) returned 0x1
	[0099.809] WriteFile (in: hFile=0x204, lpBuffer=0x263ff50*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x263ff50*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0099.812] CloseHandle (hObject=0x204) returned 1
	[0099.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z vMBS41 30Qj46r2tT.mp3", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z vMBS41 30Qj46r2tT.mp3", lpFilePart=0x0) returned 0x3d
	[0099.812] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\z vMBS41 30Qj46r2tT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\z vmbs41 30qj46r2tt.mp3")) returned 1
	[0099.818] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c05dea0, ftCreationTime.dwHighDateTime=0x1d5dc5d, ftLastAccessTime.dwLowDateTime=0x32774b50, ftLastAccessTime.dwHighDateTime=0x1d5e32d, ftLastWriteTime.dwLowDateTime=0x32774b50, ftLastWriteTime.dwHighDateTime=0x1d5e32d, nFileSizeHigh=0x0, nFileSizeLow=0xd56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZRKQr vDI2XvOo.flv", cAlternateFileName="ZRKQRV~1.FLV")) returned 1
	[0099.819] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0099.819] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0099.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0099.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0099.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0099.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0099.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0099.821] GetFileType (hFile=0x200) returned 0x1
	[0099.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0099.821] GetFileType (hFile=0x200) returned 0x1
	[0099.822] WriteFile (in: hFile=0x200, lpBuffer=0x2642964*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2642964*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0099.824] CloseHandle (hObject=0x200) returned 1
	[0099.825] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda7dc660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda7dc660, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0099.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0099.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27
	[0099.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28
	[0099.826] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda7dc660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda7dc660, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0099.827] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda7dc660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda7dc660, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0099.836] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6070f00, ftCreationTime.dwHighDateTime=0x1d5e114, ftLastAccessTime.dwLowDateTime=0xbe9cf110, ftLastAccessTime.dwHighDateTime=0x1d5dba9, ftLastWriteTime.dwLowDateTime=0xbe9cf110, ftLastWriteTime.dwHighDateTime=0x1d5dba9, nFileSizeHigh=0x0, nFileSizeLow=0x9ab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="0kI16qGYKIWr.pdf", cAlternateFileName="0KI16Q~1.PDF")) returned 1
	[0099.836] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5655d110, ftCreationTime.dwHighDateTime=0x1d5e6c8, ftLastAccessTime.dwLowDateTime=0xd63c6c80, ftLastAccessTime.dwHighDateTime=0x1d55fd3, ftLastWriteTime.dwLowDateTime=0xd63c6c80, ftLastWriteTime.dwHighDateTime=0x1d55fd3, nFileSizeHigh=0x0, nFileSizeLow=0x76a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="288dXqBRqJ dmG.xlsx", cAlternateFileName="288DXQ~1.XLS")) returned 1
	[0099.837] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614d3380, ftCreationTime.dwHighDateTime=0x1d5b32c, ftLastAccessTime.dwLowDateTime=0xa1b56ad0, ftLastAccessTime.dwHighDateTime=0x1d58c6e, ftLastWriteTime.dwLowDateTime=0xa1b56ad0, ftLastWriteTime.dwHighDateTime=0x1d58c6e, nFileSizeHigh=0x0, nFileSizeLow=0x18d55, dwReserved0=0x0, dwReserved1=0x0, cFileName="2wb0k9funFxm5A6aGy.pptx", cAlternateFileName="2WB0K9~1.PPT")) returned 1
	[0099.838] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x942b1850, ftCreationTime.dwHighDateTime=0x1d59232, ftLastAccessTime.dwLowDateTime=0xb71d6a30, ftLastAccessTime.dwHighDateTime=0x1d5bbe9, ftLastWriteTime.dwLowDateTime=0xb71d6a30, ftLastWriteTime.dwHighDateTime=0x1d5bbe9, nFileSizeHigh=0x0, nFileSizeLow=0x5262, dwReserved0=0x0, dwReserved1=0x0, cFileName="5pyJ_ 12qn1vPLhsv.docx", cAlternateFileName="5PYJ_1~1.DOC")) returned 1
	[0099.838] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc8ccb0, ftCreationTime.dwHighDateTime=0x1d5e107, ftLastAccessTime.dwLowDateTime=0x5e80eb10, ftLastAccessTime.dwHighDateTime=0x1d5e798, ftLastWriteTime.dwLowDateTime=0x5e80eb10, ftLastWriteTime.dwHighDateTime=0x1d5e798, nFileSizeHigh=0x0, nFileSizeLow=0x22ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="6wbzV22J.pptx", cAlternateFileName="6WBZV2~1.PPT")) returned 1
	[0099.839] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bebdc0, ftCreationTime.dwHighDateTime=0x1d5e484, ftLastAccessTime.dwLowDateTime=0x294e2300, ftLastAccessTime.dwHighDateTime=0x1d5e562, ftLastWriteTime.dwLowDateTime=0x294e2300, ftLastWriteTime.dwHighDateTime=0x1d5e562, nFileSizeHigh=0x0, nFileSizeLow=0x4182, dwReserved0=0x0, dwReserved1=0x0, cFileName="CKvdvKV-oh.pptx", cAlternateFileName="CKVDVK~1.PPT")) returned 1
	[0099.840] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0099.840] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdab8c150, ftCreationTime.dwHighDateTime=0x1d5b06e, ftLastAccessTime.dwLowDateTime=0xc5efb3f0, ftLastAccessTime.dwHighDateTime=0x1d5aa1a, ftLastWriteTime.dwLowDateTime=0xc5efb3f0, ftLastWriteTime.dwHighDateTime=0x1d5aa1a, nFileSizeHigh=0x0, nFileSizeLow=0x159eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="dUMj7GuNWeG1d50zvU-W.xlsx", cAlternateFileName="DUMJ7G~1.XLS")) returned 1
	[0099.841] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76969890, ftCreationTime.dwHighDateTime=0x1d5d2a7, ftLastAccessTime.dwLowDateTime=0x1d028a00, ftLastAccessTime.dwHighDateTime=0x1d5e4ef, ftLastWriteTime.dwLowDateTime=0x1d028a00, ftLastWriteTime.dwHighDateTime=0x1d5e4ef, nFileSizeHigh=0x0, nFileSizeLow=0x13a8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERZf4Y5RBkSUzVt.xlsx", cAlternateFileName="ERZF4Y~1.XLS")) returned 1
	[0099.842] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x603c000, ftCreationTime.dwHighDateTime=0x1d57d37, ftLastAccessTime.dwLowDateTime=0xc654d720, ftLastAccessTime.dwHighDateTime=0x1d5d969, ftLastWriteTime.dwLowDateTime=0xc654d720, ftLastWriteTime.dwHighDateTime=0x1d5d969, nFileSizeHigh=0x0, nFileSizeLow=0x1868f, dwReserved0=0x0, dwReserved1=0x0, cFileName="f46Ms.docx", cAlternateFileName="F46MS~1.DOC")) returned 1
	[0099.842] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3520290, ftCreationTime.dwHighDateTime=0x1d5817f, ftLastAccessTime.dwLowDateTime=0xd1c983b0, ftLastAccessTime.dwHighDateTime=0x1d574a8, ftLastWriteTime.dwLowDateTime=0xd1c983b0, ftLastWriteTime.dwHighDateTime=0x1d574a8, nFileSizeHigh=0x0, nFileSizeLow=0x56d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FIgAgA4hj5B3F2rQ-ow.pptx", cAlternateFileName="FIGAGA~1.PPT")) returned 1
	[0099.843] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbca1d500, ftCreationTime.dwHighDateTime=0x1d5e5c8, ftLastAccessTime.dwLowDateTime=0xa96e6300, ftLastAccessTime.dwHighDateTime=0x1d5d9a6, ftLastWriteTime.dwLowDateTime=0xa96e6300, ftLastWriteTime.dwHighDateTime=0x1d5d9a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="f__WJP1S", cAlternateFileName="")) returned 1
	[0099.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0099.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S", lpFilePart=0x0) returned 0x30
	[0099.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\", lpFilePart=0x0) returned 0x31
	[0099.844] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbca1d500, ftCreationTime.dwHighDateTime=0x1d5e5c8, ftLastAccessTime.dwLowDateTime=0xa96e6300, ftLastAccessTime.dwHighDateTime=0x1d5d9a6, ftLastWriteTime.dwLowDateTime=0xa96e6300, ftLastWriteTime.dwHighDateTime=0x1d5d9a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0099.845] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbca1d500, ftCreationTime.dwHighDateTime=0x1d5e5c8, ftLastAccessTime.dwLowDateTime=0xa96e6300, ftLastAccessTime.dwHighDateTime=0x1d5d9a6, ftLastWriteTime.dwLowDateTime=0xa96e6300, ftLastWriteTime.dwHighDateTime=0x1d5d9a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0099.845] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeca1310, ftCreationTime.dwHighDateTime=0x1d5e507, ftLastAccessTime.dwLowDateTime=0x4d6f9a30, ftLastAccessTime.dwHighDateTime=0x1d5dd41, ftLastWriteTime.dwLowDateTime=0x4d6f9a30, ftLastWriteTime.dwHighDateTime=0x1d5dd41, nFileSizeHigh=0x0, nFileSizeLow=0xeac1, dwReserved0=0x0, dwReserved1=0x0, cFileName="8y2wDARL3.ppt", cAlternateFileName="8Y2WDA~1.PPT")) returned 1
	[0099.846] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b8cad0, ftCreationTime.dwHighDateTime=0x1d5dc63, ftLastAccessTime.dwLowDateTime=0x13b89820, ftLastAccessTime.dwHighDateTime=0x1d5d9cf, ftLastWriteTime.dwLowDateTime=0x13b89820, ftLastWriteTime.dwHighDateTime=0x1d5d9cf, nFileSizeHigh=0x0, nFileSizeLow=0x16cc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="9x49PM1E8xONjF84kJ.xlsx", cAlternateFileName="9X49PM~1.XLS")) returned 1
	[0099.847] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37295f0, ftCreationTime.dwHighDateTime=0x1d5e367, ftLastAccessTime.dwLowDateTime=0x3874ac50, ftLastAccessTime.dwHighDateTime=0x1d5e620, ftLastWriteTime.dwLowDateTime=0x3874ac50, ftLastWriteTime.dwHighDateTime=0x1d5e620, nFileSizeHigh=0x0, nFileSizeLow=0xeca1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oKaEbwcOgsPSBH.pptx", cAlternateFileName="OKAEBW~1.PPT")) returned 1
	[0099.847] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35ea60b0, ftCreationTime.dwHighDateTime=0x1d5e3eb, ftLastAccessTime.dwLowDateTime=0x7413f930, ftLastAccessTime.dwHighDateTime=0x1d5d835, ftLastWriteTime.dwLowDateTime=0x7413f930, ftLastWriteTime.dwHighDateTime=0x1d5d835, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QphIe7J3JTVAb6lMkmEX", cAlternateFileName="QPHIE7~1")) returned 1
	[0099.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0099.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX", lpFilePart=0x0) returned 0x45
	[0099.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\", lpFilePart=0x0) returned 0x46
	[0099.848] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35ea60b0, ftCreationTime.dwHighDateTime=0x1d5e3eb, ftLastAccessTime.dwLowDateTime=0x7413f930, ftLastAccessTime.dwHighDateTime=0x1d5d835, ftLastWriteTime.dwLowDateTime=0x7413f930, ftLastWriteTime.dwHighDateTime=0x1d5d835, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0099.849] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35ea60b0, ftCreationTime.dwHighDateTime=0x1d5e3eb, ftLastAccessTime.dwLowDateTime=0x7413f930, ftLastAccessTime.dwHighDateTime=0x1d5d835, ftLastWriteTime.dwLowDateTime=0x7413f930, ftLastWriteTime.dwHighDateTime=0x1d5d835, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0099.850] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7452cd0, ftCreationTime.dwHighDateTime=0x1d5e4c2, ftLastAccessTime.dwLowDateTime=0x9cbc50, ftLastAccessTime.dwHighDateTime=0x1d5d95f, ftLastWriteTime.dwLowDateTime=0x9cbc50, ftLastWriteTime.dwHighDateTime=0x1d5d95f, nFileSizeHigh=0x0, nFileSizeLow=0xd335, dwReserved0=0x0, dwReserved1=0x0, cFileName="4s41QTR7ma-8YN84zJ3G.pptx", cAlternateFileName="4S41QT~1.PPT")) returned 1
	[0099.850] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7448580, ftCreationTime.dwHighDateTime=0x1d5dcb0, ftLastAccessTime.dwLowDateTime=0x27f2af20, ftLastAccessTime.dwHighDateTime=0x1d5e027, ftLastWriteTime.dwLowDateTime=0x27f2af20, ftLastWriteTime.dwHighDateTime=0x1d5e027, nFileSizeHigh=0x0, nFileSizeLow=0x53d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fu4R7AoTqa3eV1.pptx", cAlternateFileName="FU4R7A~1.PPT")) returned 1
	[0099.851] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60b94b90, ftCreationTime.dwHighDateTime=0x1d5e43a, ftLastAccessTime.dwLowDateTime=0x5071fe40, ftLastAccessTime.dwHighDateTime=0x1d5dec1, ftLastWriteTime.dwLowDateTime=0x5071fe40, ftLastWriteTime.dwHighDateTime=0x1d5dec1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDmALjK8", cAlternateFileName="")) returned 1
	[0099.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0099.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8", lpFilePart=0x0) returned 0x4e
	[0099.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\", lpFilePart=0x0) returned 0x4f
	[0099.852] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60b94b90, ftCreationTime.dwHighDateTime=0x1d5e43a, ftLastAccessTime.dwLowDateTime=0x5071fe40, ftLastAccessTime.dwHighDateTime=0x1d5dec1, ftLastWriteTime.dwLowDateTime=0x5071fe40, ftLastWriteTime.dwHighDateTime=0x1d5dec1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0099.853] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60b94b90, ftCreationTime.dwHighDateTime=0x1d5e43a, ftLastAccessTime.dwLowDateTime=0x5071fe40, ftLastAccessTime.dwHighDateTime=0x1d5dec1, ftLastWriteTime.dwLowDateTime=0x5071fe40, ftLastWriteTime.dwHighDateTime=0x1d5dec1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0099.853] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879f4d80, ftCreationTime.dwHighDateTime=0x1d5e30a, ftLastAccessTime.dwLowDateTime=0xdf8b1f30, ftLastAccessTime.dwHighDateTime=0x1d5da16, ftLastWriteTime.dwLowDateTime=0xdf8b1f30, ftLastWriteTime.dwHighDateTime=0x1d5da16, nFileSizeHigh=0x0, nFileSizeLow=0x89f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="b-sZVFKr0qE.pdf", cAlternateFileName="B-SZVF~1.PDF")) returned 1
	[0099.854] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54254d20, ftCreationTime.dwHighDateTime=0x1d5daee, ftLastAccessTime.dwLowDateTime=0x45efa60, ftLastAccessTime.dwHighDateTime=0x1d5d9e1, ftLastWriteTime.dwLowDateTime=0x45efa60, ftLastWriteTime.dwHighDateTime=0x1d5d9e1, nFileSizeHigh=0x0, nFileSizeLow=0x6730, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDSaBnCNcG.ppt", cAlternateFileName="BDSABN~1.PPT")) returned 1
	[0099.855] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb95c0490, ftCreationTime.dwHighDateTime=0x1d5e5e3, ftLastAccessTime.dwLowDateTime=0x81ced690, ftLastAccessTime.dwHighDateTime=0x1d5dbfe, ftLastWriteTime.dwLowDateTime=0x81ced690, ftLastWriteTime.dwHighDateTime=0x1d5dbfe, nFileSizeHigh=0x0, nFileSizeLow=0x1192e, dwReserved0=0x0, dwReserved1=0x0, cFileName="E 2VGlPB8jFk5rmdHt.ppt", cAlternateFileName="E2VGLP~1.PPT")) returned 1
	[0099.855] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44bc0, ftCreationTime.dwHighDateTime=0x1d5dfa5, ftLastAccessTime.dwLowDateTime=0x3610ba10, ftLastAccessTime.dwHighDateTime=0x1d5e4bf, ftLastWriteTime.dwLowDateTime=0x3610ba10, ftLastWriteTime.dwHighDateTime=0x1d5e4bf, nFileSizeHigh=0x0, nFileSizeLow=0x3deb, dwReserved0=0x0, dwReserved1=0x0, cFileName="maCM.ods", cAlternateFileName="")) returned 1
	[0099.856] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb104a50, ftCreationTime.dwHighDateTime=0x1d5d944, ftLastAccessTime.dwLowDateTime=0xf5411650, ftLastAccessTime.dwHighDateTime=0x1d5db14, ftLastWriteTime.dwLowDateTime=0xf5411650, ftLastWriteTime.dwHighDateTime=0x1d5db14, nFileSizeHigh=0x0, nFileSizeLow=0x1214e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MWK5d1zBuYM.doc", cAlternateFileName="MWK5D1~1.DOC")) returned 1
	[0099.857] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310a9b0, ftCreationTime.dwHighDateTime=0x1d5e7dd, ftLastAccessTime.dwLowDateTime=0x6b7c3ca0, ftLastAccessTime.dwHighDateTime=0x1d5d813, ftLastWriteTime.dwLowDateTime=0x6b7c3ca0, ftLastWriteTime.dwHighDateTime=0x1d5d813, nFileSizeHigh=0x0, nFileSizeLow=0x32a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="q2 l_fsC5nR1.rtf", cAlternateFileName="Q2L_FS~1.RTF")) returned 1
	[0099.857] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5b8aaa0, ftCreationTime.dwHighDateTime=0x1d5e627, ftLastAccessTime.dwLowDateTime=0x26c9f590, ftLastAccessTime.dwHighDateTime=0x1d5dd11, ftLastWriteTime.dwLowDateTime=0x26c9f590, ftLastWriteTime.dwHighDateTime=0x1d5dd11, nFileSizeHigh=0x0, nFileSizeLow=0x17b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="s91SwGFHR.doc", cAlternateFileName="S91SWG~1.DOC")) returned 1
	[0099.858] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd70a5ca0, ftCreationTime.dwHighDateTime=0x1d5e4e2, ftLastAccessTime.dwLowDateTime=0x79d862d0, ftLastAccessTime.dwHighDateTime=0x1d5e15d, ftLastWriteTime.dwLowDateTime=0x79d862d0, ftLastWriteTime.dwHighDateTime=0x1d5e15d, nFileSizeHigh=0x0, nFileSizeLow=0x128c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VJXpF4pwBzNNdc85.csv", cAlternateFileName="VJXPF4~1.CSV")) returned 1
	[0099.861] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd70a5ca0, ftCreationTime.dwHighDateTime=0x1d5e4e2, ftLastAccessTime.dwLowDateTime=0x79d862d0, ftLastAccessTime.dwHighDateTime=0x1d5e15d, ftLastWriteTime.dwLowDateTime=0x79d862d0, ftLastWriteTime.dwHighDateTime=0x1d5e15d, nFileSizeHigh=0x0, nFileSizeLow=0x128c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VJXpF4pwBzNNdc85.csv", cAlternateFileName="VJXPF4~1.CSV")) returned 0
	[0099.862] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0099.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0099.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0099.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0099.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8", lpFilePart=0x0) returned 0x4e
	[0099.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\", lpFilePart=0x0) returned 0x4f
	[0099.862] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60b94b90, ftCreationTime.dwHighDateTime=0x1d5e43a, ftLastAccessTime.dwLowDateTime=0x5071fe40, ftLastAccessTime.dwHighDateTime=0x1d5dec1, ftLastWriteTime.dwLowDateTime=0x5071fe40, ftLastWriteTime.dwHighDateTime=0x1d5dec1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0099.863] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60b94b90, ftCreationTime.dwHighDateTime=0x1d5e43a, ftLastAccessTime.dwLowDateTime=0x5071fe40, ftLastAccessTime.dwHighDateTime=0x1d5dec1, ftLastWriteTime.dwLowDateTime=0x5071fe40, ftLastWriteTime.dwHighDateTime=0x1d5dec1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0099.863] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879f4d80, ftCreationTime.dwHighDateTime=0x1d5e30a, ftLastAccessTime.dwLowDateTime=0xdf8b1f30, ftLastAccessTime.dwHighDateTime=0x1d5da16, ftLastWriteTime.dwLowDateTime=0xdf8b1f30, ftLastWriteTime.dwHighDateTime=0x1d5da16, nFileSizeHigh=0x0, nFileSizeLow=0x89f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="b-sZVFKr0qE.pdf", cAlternateFileName="B-SZVF~1.PDF")) returned 1
	[0099.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\b-sZVFKr0qE.pdf", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\b-sZVFKr0qE.pdf", lpFilePart=0x0) returned 0x5e
	[0099.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0099.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\b-sZVFKr0qE.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\b-szvfkr0qe.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0099.865] GetFileType (hFile=0x224) returned 0x1
	[0099.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0099.865] GetFileType (hFile=0x224) returned 0x1
	[0099.865] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x89f4
	[0099.865] ReadFile (in: hFile=0x224, lpBuffer=0x2649de4, nNumberOfBytesToRead=0x89f4, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2649de4*, lpNumberOfBytesRead=0x26ede4*=0x89f4, lpOverlapped=0x0) returned 1
	[0099.869] CloseHandle (hObject=0x224) returned 1
	[0099.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\b-sZVFKr0qE.pdf.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\b-sZVFKr0qE.pdf.KEKW", lpFilePart=0x0) returned 0x63
	[0099.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0099.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\b-sZVFKr0qE.pdf.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\b-szvfkr0qe.pdf.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0099.870] GetFileType (hFile=0x224) returned 0x1
	[0099.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0099.871] GetFileType (hFile=0x224) returned 0x1
	[0099.871] WriteFile (in: hFile=0x224, lpBuffer=0x2653f48*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2653f48*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0100.117] CloseHandle (hObject=0x224) returned 1
	[0100.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\b-sZVFKr0qE.pdf", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\b-sZVFKr0qE.pdf", lpFilePart=0x0) returned 0x5e
	[0100.118] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\b-sZVFKr0qE.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\b-szvfkr0qe.pdf")) returned 1
	[0100.121] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54254d20, ftCreationTime.dwHighDateTime=0x1d5daee, ftLastAccessTime.dwLowDateTime=0x45efa60, ftLastAccessTime.dwHighDateTime=0x1d5d9e1, ftLastWriteTime.dwLowDateTime=0x45efa60, ftLastWriteTime.dwHighDateTime=0x1d5d9e1, nFileSizeHigh=0x0, nFileSizeLow=0x6730, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDSaBnCNcG.ppt", cAlternateFileName="BDSABN~1.PPT")) returned 1
	[0100.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\BDSaBnCNcG.ppt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\BDSaBnCNcG.ppt", lpFilePart=0x0) returned 0x5d
	[0100.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0100.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\BDSaBnCNcG.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\bdsabncncg.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0100.122] GetFileType (hFile=0x224) returned 0x1
	[0100.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0100.122] GetFileType (hFile=0x224) returned 0x1
	[0100.123] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x6730
	[0100.123] ReadFile (in: hFile=0x224, lpBuffer=0x2655630, nNumberOfBytesToRead=0x6730, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2655630*, lpNumberOfBytesRead=0x26ede4*=0x6730, lpOverlapped=0x0) returned 1
	[0100.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\BDSaBnCNcG.ppt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\BDSaBnCNcG.ppt.KEKW", lpFilePart=0x0) returned 0x62
	[0100.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0100.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\BDSaBnCNcG.ppt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\bdsabncncg.ppt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0100.129] GetFileType (hFile=0x224) returned 0x1
	[0100.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0100.130] GetFileType (hFile=0x224) returned 0x1
	[0100.130] WriteFile (in: hFile=0x224, lpBuffer=0x265d4cc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x265d4cc*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0100.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\BDSaBnCNcG.ppt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\BDSaBnCNcG.ppt", lpFilePart=0x0) returned 0x5d
	[0100.134] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\BDSaBnCNcG.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\bdsabncncg.ppt")) returned 1
	[0100.140] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb95c0490, ftCreationTime.dwHighDateTime=0x1d5e5e3, ftLastAccessTime.dwLowDateTime=0x81ced690, ftLastAccessTime.dwHighDateTime=0x1d5dbfe, ftLastWriteTime.dwLowDateTime=0x81ced690, ftLastWriteTime.dwHighDateTime=0x1d5dbfe, nFileSizeHigh=0x0, nFileSizeLow=0x1192e, dwReserved0=0x0, dwReserved1=0x0, cFileName="E 2VGlPB8jFk5rmdHt.ppt", cAlternateFileName="E2VGLP~1.PPT")) returned 1
	[0100.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\E 2VGlPB8jFk5rmdHt.ppt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\E 2VGlPB8jFk5rmdHt.ppt", lpFilePart=0x0) returned 0x65
	[0100.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0100.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\E 2VGlPB8jFk5rmdHt.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\e 2vglpb8jfk5rmdht.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0100.141] GetFileType (hFile=0x224) returned 0x1
	[0100.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0100.141] GetFileType (hFile=0x224) returned 0x1
	[0100.141] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x1192e
	[0100.142] ReadFile (in: hFile=0x224, lpBuffer=0x265ec30, nNumberOfBytesToRead=0x1192e, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x265ec30*, lpNumberOfBytesRead=0x26ede4*=0x1192e, lpOverlapped=0x0) returned 1
	[0100.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\E 2VGlPB8jFk5rmdHt.ppt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\E 2VGlPB8jFk5rmdHt.ppt.KEKW", lpFilePart=0x0) returned 0x6a
	[0100.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0100.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\E 2VGlPB8jFk5rmdHt.ppt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\e 2vglpb8jfk5rmdht.ppt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0100.146] GetFileType (hFile=0x224) returned 0x1
	[0100.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0100.147] GetFileType (hFile=0x224) returned 0x1
	[0100.147] WriteFile (in: hFile=0x224, lpBuffer=0x2671cfc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2671cfc*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0100.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\E 2VGlPB8jFk5rmdHt.ppt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\E 2VGlPB8jFk5rmdHt.ppt", lpFilePart=0x0) returned 0x65
	[0100.150] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\E 2VGlPB8jFk5rmdHt.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\e 2vglpb8jfk5rmdht.ppt")) returned 1
	[0100.169] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44bc0, ftCreationTime.dwHighDateTime=0x1d5dfa5, ftLastAccessTime.dwLowDateTime=0x3610ba10, ftLastAccessTime.dwHighDateTime=0x1d5e4bf, ftLastWriteTime.dwLowDateTime=0x3610ba10, ftLastWriteTime.dwHighDateTime=0x1d5e4bf, nFileSizeHigh=0x0, nFileSizeLow=0x3deb, dwReserved0=0x0, dwReserved1=0x0, cFileName="maCM.ods", cAlternateFileName="")) returned 1
	[0100.169] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb104a50, ftCreationTime.dwHighDateTime=0x1d5d944, ftLastAccessTime.dwLowDateTime=0xf5411650, ftLastAccessTime.dwHighDateTime=0x1d5db14, ftLastWriteTime.dwLowDateTime=0xf5411650, ftLastWriteTime.dwHighDateTime=0x1d5db14, nFileSizeHigh=0x0, nFileSizeLow=0x1214e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MWK5d1zBuYM.doc", cAlternateFileName="MWK5D1~1.DOC")) returned 1
	[0100.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\MWK5d1zBuYM.doc", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\MWK5d1zBuYM.doc", lpFilePart=0x0) returned 0x5e
	[0100.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0100.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\MWK5d1zBuYM.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\mwk5d1zbuym.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0100.170] GetFileType (hFile=0x224) returned 0x1
	[0100.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0100.171] GetFileType (hFile=0x224) returned 0x1
	[0100.171] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x1214e
	[0100.171] ReadFile (in: hFile=0x224, lpBuffer=0x2673854, nNumberOfBytesToRead=0x1214e, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2673854*, lpNumberOfBytesRead=0x26ede4*=0x1214e, lpOverlapped=0x0) returned 1
	[0100.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\MWK5d1zBuYM.doc.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\MWK5d1zBuYM.doc.KEKW", lpFilePart=0x0) returned 0x63
	[0100.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0100.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\MWK5d1zBuYM.doc.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\mwk5d1zbuym.doc.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0100.177] GetFileType (hFile=0x224) returned 0x1
	[0100.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0100.177] GetFileType (hFile=0x224) returned 0x1
	[0100.178] WriteFile (in: hFile=0x224, lpBuffer=0x2687114*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2687114*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0100.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\MWK5d1zBuYM.doc", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\MWK5d1zBuYM.doc", lpFilePart=0x0) returned 0x5e
	[0100.183] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\MWK5d1zBuYM.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\mwk5d1zbuym.doc")) returned 1
	[0100.189] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310a9b0, ftCreationTime.dwHighDateTime=0x1d5e7dd, ftLastAccessTime.dwLowDateTime=0x6b7c3ca0, ftLastAccessTime.dwHighDateTime=0x1d5d813, ftLastWriteTime.dwLowDateTime=0x6b7c3ca0, ftLastWriteTime.dwHighDateTime=0x1d5d813, nFileSizeHigh=0x0, nFileSizeLow=0x32a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="q2 l_fsC5nR1.rtf", cAlternateFileName="Q2L_FS~1.RTF")) returned 1
	[0100.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\q2 l_fsC5nR1.rtf", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\q2 l_fsC5nR1.rtf", lpFilePart=0x0) returned 0x5f
	[0100.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0100.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\q2 l_fsC5nR1.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\q2 l_fsc5nr1.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0100.190] GetFileType (hFile=0x224) returned 0x1
	[0100.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0100.190] GetFileType (hFile=0x224) returned 0x1
	[0100.190] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x32a7
	[0100.191] ReadFile (in: hFile=0x224, lpBuffer=0x268881c, nNumberOfBytesToRead=0x32a7, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x268881c*, lpNumberOfBytesRead=0x26ede4*=0x32a7, lpOverlapped=0x0) returned 1
	[0100.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\q2 l_fsC5nR1.rtf.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\q2 l_fsC5nR1.rtf.KEKW", lpFilePart=0x0) returned 0x64
	[0100.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0100.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\q2 l_fsC5nR1.rtf.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\q2 l_fsc5nr1.rtf.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0100.195] GetFileType (hFile=0x224) returned 0x1
	[0100.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0100.195] GetFileType (hFile=0x224) returned 0x1
	[0100.195] WriteFile (in: hFile=0x224, lpBuffer=0x268d23c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x268d23c*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0100.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\q2 l_fsC5nR1.rtf", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\q2 l_fsC5nR1.rtf", lpFilePart=0x0) returned 0x5f
	[0100.198] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\q2 l_fsC5nR1.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\q2 l_fsc5nr1.rtf")) returned 1
	[0100.214] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5b8aaa0, ftCreationTime.dwHighDateTime=0x1d5e627, ftLastAccessTime.dwLowDateTime=0x26c9f590, ftLastAccessTime.dwHighDateTime=0x1d5dd11, ftLastWriteTime.dwLowDateTime=0x26c9f590, ftLastWriteTime.dwHighDateTime=0x1d5dd11, nFileSizeHigh=0x0, nFileSizeLow=0x17b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="s91SwGFHR.doc", cAlternateFileName="S91SWG~1.DOC")) returned 1
	[0100.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\s91SwGFHR.doc", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\s91SwGFHR.doc", lpFilePart=0x0) returned 0x5c
	[0100.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0100.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\s91SwGFHR.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\s91swgfhr.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0100.215] GetFileType (hFile=0x224) returned 0x1
	[0100.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0100.215] GetFileType (hFile=0x224) returned 0x1
	[0100.215] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x17b04
	[0100.216] ReadFile (in: hFile=0x224, lpBuffer=0x3630908, nNumberOfBytesToRead=0x17b04, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x3630908*, lpNumberOfBytesRead=0x26ede4*=0x17b04, lpOverlapped=0x0) returned 1
	[0100.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\s91SwGFHR.doc.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\s91SwGFHR.doc.KEKW", lpFilePart=0x0) returned 0x61
	[0100.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0100.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\s91SwGFHR.doc.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\s91swgfhr.doc.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0100.225] GetFileType (hFile=0x224) returned 0x1
	[0100.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0100.226] GetFileType (hFile=0x224) returned 0x1
	[0100.226] WriteFile (in: hFile=0x224, lpBuffer=0x2690070*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2690070*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0100.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\s91SwGFHR.doc", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\s91SwGFHR.doc", lpFilePart=0x0) returned 0x5c
	[0100.229] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\s91SwGFHR.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\s91swgfhr.doc")) returned 1
	[0100.363] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd70a5ca0, ftCreationTime.dwHighDateTime=0x1d5e4e2, ftLastAccessTime.dwLowDateTime=0x79d862d0, ftLastAccessTime.dwHighDateTime=0x1d5e15d, ftLastWriteTime.dwLowDateTime=0x79d862d0, ftLastWriteTime.dwHighDateTime=0x1d5e15d, nFileSizeHigh=0x0, nFileSizeLow=0x128c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VJXpF4pwBzNNdc85.csv", cAlternateFileName="VJXPF4~1.CSV")) returned 1
	[0100.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\VJXpF4pwBzNNdc85.csv", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\VJXpF4pwBzNNdc85.csv", lpFilePart=0x0) returned 0x63
	[0100.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0100.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\VJXpF4pwBzNNdc85.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\vjxpf4pwbznndc85.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0100.364] GetFileType (hFile=0x224) returned 0x1
	[0100.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0100.364] GetFileType (hFile=0x224) returned 0x1
	[0100.364] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x128c
	[0100.365] ReadFile (in: hFile=0x224, lpBuffer=0x26917b4, nNumberOfBytesToRead=0x128c, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26917b4*, lpNumberOfBytesRead=0x26ede4*=0x128c, lpOverlapped=0x0) returned 1
	[0100.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\VJXpF4pwBzNNdc85.csv.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\VJXpF4pwBzNNdc85.csv.KEKW", lpFilePart=0x0) returned 0x68
	[0100.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0100.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\VJXpF4pwBzNNdc85.csv.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\vjxpf4pwbznndc85.csv.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0100.369] GetFileType (hFile=0x224) returned 0x1
	[0100.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0100.369] GetFileType (hFile=0x224) returned 0x1
	[0100.369] WriteFile (in: hFile=0x224, lpBuffer=0x26941d0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26941d0*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0100.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\VJXpF4pwBzNNdc85.csv", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\VJXpF4pwBzNNdc85.csv", lpFilePart=0x0) returned 0x63
	[0100.373] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\VJXpF4pwBzNNdc85.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\vjxpf4pwbznndc85.csv")) returned 1
	[0100.428] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0100.428] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0100.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0100.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0100.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0100.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0100.429] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\WDmALjK8\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\wdmaljk8\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0100.430] GetFileType (hFile=0x220) returned 0x1
	[0100.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0100.430] GetFileType (hFile=0x220) returned 0x1
	[0100.430] WriteFile (in: hFile=0x220, lpBuffer=0x269697c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x269697c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0100.433] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa846610, ftCreationTime.dwHighDateTime=0x1d5e6f6, ftLastAccessTime.dwLowDateTime=0x266d0f40, ftLastAccessTime.dwHighDateTime=0x1d5e4b6, ftLastWriteTime.dwLowDateTime=0x266d0f40, ftLastWriteTime.dwHighDateTime=0x1d5e4b6, nFileSizeHigh=0x0, nFileSizeLow=0xbaf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="xcfcY-q63z.odt", cAlternateFileName="XCFCY-~1.ODT")) returned 1
	[0100.434] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa846610, ftCreationTime.dwHighDateTime=0x1d5e6f6, ftLastAccessTime.dwLowDateTime=0x266d0f40, ftLastAccessTime.dwHighDateTime=0x1d5e4b6, ftLastWriteTime.dwLowDateTime=0x266d0f40, ftLastWriteTime.dwHighDateTime=0x1d5e4b6, nFileSizeHigh=0x0, nFileSizeLow=0xbaf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="xcfcY-q63z.odt", cAlternateFileName="XCFCY-~1.ODT")) returned 0
	[0100.435] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0100.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0100.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0100.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0100.435] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX", lpFilePart=0x0) returned 0x45
	[0100.435] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\", lpFilePart=0x0) returned 0x46
	[0100.437] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35ea60b0, ftCreationTime.dwHighDateTime=0x1d5e3eb, ftLastAccessTime.dwLowDateTime=0x7413f930, ftLastAccessTime.dwHighDateTime=0x1d5d835, ftLastWriteTime.dwLowDateTime=0x7413f930, ftLastWriteTime.dwHighDateTime=0x1d5d835, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0100.437] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35ea60b0, ftCreationTime.dwHighDateTime=0x1d5e3eb, ftLastAccessTime.dwLowDateTime=0x7413f930, ftLastAccessTime.dwHighDateTime=0x1d5d835, ftLastWriteTime.dwLowDateTime=0x7413f930, ftLastWriteTime.dwHighDateTime=0x1d5d835, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0100.438] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7452cd0, ftCreationTime.dwHighDateTime=0x1d5e4c2, ftLastAccessTime.dwLowDateTime=0x9cbc50, ftLastAccessTime.dwHighDateTime=0x1d5d95f, ftLastWriteTime.dwLowDateTime=0x9cbc50, ftLastWriteTime.dwHighDateTime=0x1d5d95f, nFileSizeHigh=0x0, nFileSizeLow=0xd335, dwReserved0=0x0, dwReserved1=0x0, cFileName="4s41QTR7ma-8YN84zJ3G.pptx", cAlternateFileName="4S41QT~1.PPT")) returned 1
	[0100.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\4s41QTR7ma-8YN84zJ3G.pptx", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\4s41QTR7ma-8YN84zJ3G.pptx", lpFilePart=0x0) returned 0x5f
	[0100.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0100.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\4s41QTR7ma-8YN84zJ3G.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\4s41qtr7ma-8yn84zj3g.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0100.438] GetFileType (hFile=0x220) returned 0x1
	[0100.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0100.439] GetFileType (hFile=0x220) returned 0x1
	[0100.439] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xd335
	[0100.439] ReadFile (in: hFile=0x220, lpBuffer=0x2698c50, nNumberOfBytesToRead=0xd335, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2698c50*, lpNumberOfBytesRead=0x26ee84*=0xd335, lpOverlapped=0x0) returned 1
	[0100.443] CloseHandle (hObject=0x220) returned 1
	[0100.443] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\4s41QTR7ma-8YN84zJ3G.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\4s41QTR7ma-8YN84zJ3G.pptx.KEKW", lpFilePart=0x0) returned 0x64
	[0100.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0100.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\4s41QTR7ma-8YN84zJ3G.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\4s41qtr7ma-8yn84zj3g.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0100.444] GetFileType (hFile=0x220) returned 0x1
	[0100.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0100.445] GetFileType (hFile=0x220) returned 0x1
	[0100.445] WriteFile (in: hFile=0x220, lpBuffer=0x26a7714*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26a7714*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0100.448] CloseHandle (hObject=0x220) returned 1
	[0100.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\4s41QTR7ma-8YN84zJ3G.pptx", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\4s41QTR7ma-8YN84zJ3G.pptx", lpFilePart=0x0) returned 0x5f
	[0100.449] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\4s41QTR7ma-8YN84zJ3G.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\4s41qtr7ma-8yn84zj3g.pptx")) returned 1
	[0100.455] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7448580, ftCreationTime.dwHighDateTime=0x1d5dcb0, ftLastAccessTime.dwLowDateTime=0x27f2af20, ftLastAccessTime.dwHighDateTime=0x1d5e027, ftLastWriteTime.dwLowDateTime=0x27f2af20, ftLastWriteTime.dwHighDateTime=0x1d5e027, nFileSizeHigh=0x0, nFileSizeLow=0x53d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fu4R7AoTqa3eV1.pptx", cAlternateFileName="FU4R7A~1.PPT")) returned 1
	[0100.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\Fu4R7AoTqa3eV1.pptx", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\Fu4R7AoTqa3eV1.pptx", lpFilePart=0x0) returned 0x59
	[0100.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0100.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\Fu4R7AoTqa3eV1.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\fu4r7aotqa3ev1.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0100.457] GetFileType (hFile=0x220) returned 0x1
	[0100.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0100.457] GetFileType (hFile=0x220) returned 0x1
	[0100.457] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x53d0
	[0100.457] ReadFile (in: hFile=0x220, lpBuffer=0x26a8de4, nNumberOfBytesToRead=0x53d0, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26a8de4*, lpNumberOfBytesRead=0x26ee84*=0x53d0, lpOverlapped=0x0) returned 1
	[0100.460] CloseHandle (hObject=0x220) returned 1
	[0100.460] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\Fu4R7AoTqa3eV1.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\Fu4R7AoTqa3eV1.pptx.KEKW", lpFilePart=0x0) returned 0x5e
	[0100.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0100.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\Fu4R7AoTqa3eV1.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\fu4r7aotqa3ev1.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0100.462] GetFileType (hFile=0x220) returned 0x1
	[0100.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0100.462] GetFileType (hFile=0x220) returned 0x1
	[0100.462] WriteFile (in: hFile=0x220, lpBuffer=0x26af91c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26af91c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0100.465] CloseHandle (hObject=0x220) returned 1
	[0100.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\Fu4R7AoTqa3eV1.pptx", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\Fu4R7AoTqa3eV1.pptx", lpFilePart=0x0) returned 0x59
	[0100.465] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\Fu4R7AoTqa3eV1.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\fu4r7aotqa3ev1.pptx")) returned 1
	[0100.924] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60b94b90, ftCreationTime.dwHighDateTime=0x1d5e43a, ftLastAccessTime.dwLowDateTime=0xccdbcf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xccdbcf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDmALjK8", cAlternateFileName="")) returned 1
	[0100.925] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa846610, ftCreationTime.dwHighDateTime=0x1d5e6f6, ftLastAccessTime.dwLowDateTime=0x266d0f40, ftLastAccessTime.dwHighDateTime=0x1d5e4b6, ftLastWriteTime.dwLowDateTime=0x266d0f40, ftLastWriteTime.dwHighDateTime=0x1d5e4b6, nFileSizeHigh=0x0, nFileSizeLow=0xbaf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="xcfcY-q63z.odt", cAlternateFileName="XCFCY-~1.ODT")) returned 1
	[0100.925] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0100.926] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0100.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0100.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0100.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0100.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0100.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\QphIe7J3JTVAb6lMkmEX\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\qphie7j3jtvab6lmkmex\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0100.928] GetFileType (hFile=0x208) returned 0x1
	[0100.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0100.928] GetFileType (hFile=0x208) returned 0x1
	[0100.928] WriteFile (in: hFile=0x208, lpBuffer=0x26b2684*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26b2684*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0100.934] CloseHandle (hObject=0x208) returned 1
	[0100.934] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4545f1d0, ftCreationTime.dwHighDateTime=0x1d5dfc9, ftLastAccessTime.dwLowDateTime=0x99533f80, ftLastAccessTime.dwHighDateTime=0x1d5ddd5, ftLastWriteTime.dwLowDateTime=0x99533f80, ftLastWriteTime.dwHighDateTime=0x1d5ddd5, nFileSizeHigh=0x0, nFileSizeLow=0xa991, dwReserved0=0x0, dwReserved1=0x0, cFileName="RgkXT7U3sMAKrn4DC1R3.docx", cAlternateFileName="RGKXT7~1.DOC")) returned 1
	[0100.934] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaa77740, ftCreationTime.dwHighDateTime=0x1d5e1ed, ftLastAccessTime.dwLowDateTime=0xb63fa320, ftLastAccessTime.dwHighDateTime=0x1d5da8f, ftLastWriteTime.dwLowDateTime=0xb63fa320, ftLastWriteTime.dwHighDateTime=0x1d5da8f, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="wWd4kF1RArO.ots", cAlternateFileName="WWD4KF~1.OTS")) returned 1
	[0100.935] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddc44900, ftCreationTime.dwHighDateTime=0x1d5dab2, ftLastAccessTime.dwLowDateTime=0xefa93bd0, ftLastAccessTime.dwHighDateTime=0x1d5e20f, ftLastWriteTime.dwLowDateTime=0xefa93bd0, ftLastWriteTime.dwHighDateTime=0x1d5e20f, nFileSizeHigh=0x0, nFileSizeLow=0x10430, dwReserved0=0x0, dwReserved1=0x0, cFileName="xy2kYiRdnAtf-Vy3k.docx", cAlternateFileName="XY2KYI~1.DOC")) returned 1
	[0100.936] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddc44900, ftCreationTime.dwHighDateTime=0x1d5dab2, ftLastAccessTime.dwLowDateTime=0xefa93bd0, ftLastAccessTime.dwHighDateTime=0x1d5e20f, ftLastWriteTime.dwLowDateTime=0xefa93bd0, ftLastWriteTime.dwHighDateTime=0x1d5e20f, nFileSizeHigh=0x0, nFileSizeLow=0x10430, dwReserved0=0x0, dwReserved1=0x0, cFileName="xy2kYiRdnAtf-Vy3k.docx", cAlternateFileName="XY2KYI~1.DOC")) returned 0
	[0100.936] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0100.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0100.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0100.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0100.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S", lpFilePart=0x0) returned 0x30
	[0100.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\", lpFilePart=0x0) returned 0x31
	[0100.937] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbca1d500, ftCreationTime.dwHighDateTime=0x1d5e5c8, ftLastAccessTime.dwLowDateTime=0xa96e6300, ftLastAccessTime.dwHighDateTime=0x1d5d9a6, ftLastWriteTime.dwLowDateTime=0xa96e6300, ftLastWriteTime.dwHighDateTime=0x1d5d9a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0100.938] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbca1d500, ftCreationTime.dwHighDateTime=0x1d5e5c8, ftLastAccessTime.dwLowDateTime=0xa96e6300, ftLastAccessTime.dwHighDateTime=0x1d5d9a6, ftLastWriteTime.dwLowDateTime=0xa96e6300, ftLastWriteTime.dwHighDateTime=0x1d5d9a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0100.939] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeca1310, ftCreationTime.dwHighDateTime=0x1d5e507, ftLastAccessTime.dwLowDateTime=0x4d6f9a30, ftLastAccessTime.dwHighDateTime=0x1d5dd41, ftLastWriteTime.dwLowDateTime=0x4d6f9a30, ftLastWriteTime.dwHighDateTime=0x1d5dd41, nFileSizeHigh=0x0, nFileSizeLow=0xeac1, dwReserved0=0x0, dwReserved1=0x0, cFileName="8y2wDARL3.ppt", cAlternateFileName="8Y2WDA~1.PPT")) returned 1
	[0100.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\8y2wDARL3.ppt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\8y2wDARL3.ppt", lpFilePart=0x0) returned 0x3e
	[0100.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0100.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\8y2wDARL3.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\8y2wdarl3.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0100.940] GetFileType (hFile=0x208) returned 0x1
	[0100.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0100.940] GetFileType (hFile=0x208) returned 0x1
	[0100.940] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xeac1
	[0100.940] ReadFile (in: hFile=0x208, lpBuffer=0x26b48b8, nNumberOfBytesToRead=0xeac1, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26b48b8*, lpNumberOfBytesRead=0x26ef24*=0xeac1, lpOverlapped=0x0) returned 1
	[0100.944] CloseHandle (hObject=0x208) returned 1
	[0100.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\8y2wDARL3.ppt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\8y2wDARL3.ppt.KEKW", lpFilePart=0x0) returned 0x43
	[0100.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0100.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\8y2wDARL3.ppt.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\8y2wdarl3.ppt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0100.946] GetFileType (hFile=0x208) returned 0x1
	[0100.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0100.946] GetFileType (hFile=0x208) returned 0x1
	[0100.947] WriteFile (in: hFile=0x208, lpBuffer=0x26c4a68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26c4a68*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0100.950] CloseHandle (hObject=0x208) returned 1
	[0100.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\8y2wDARL3.ppt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\8y2wDARL3.ppt", lpFilePart=0x0) returned 0x3e
	[0100.950] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\8y2wDARL3.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\8y2wdarl3.ppt")) returned 1
	[0100.957] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b8cad0, ftCreationTime.dwHighDateTime=0x1d5dc63, ftLastAccessTime.dwLowDateTime=0x13b89820, ftLastAccessTime.dwHighDateTime=0x1d5d9cf, ftLastWriteTime.dwLowDateTime=0x13b89820, ftLastWriteTime.dwHighDateTime=0x1d5d9cf, nFileSizeHigh=0x0, nFileSizeLow=0x16cc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="9x49PM1E8xONjF84kJ.xlsx", cAlternateFileName="9X49PM~1.XLS")) returned 1
	[0100.957] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37295f0, ftCreationTime.dwHighDateTime=0x1d5e367, ftLastAccessTime.dwLowDateTime=0x3874ac50, ftLastAccessTime.dwHighDateTime=0x1d5e620, ftLastWriteTime.dwLowDateTime=0x3874ac50, ftLastWriteTime.dwHighDateTime=0x1d5e620, nFileSizeHigh=0x0, nFileSizeLow=0xeca1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oKaEbwcOgsPSBH.pptx", cAlternateFileName="OKAEBW~1.PPT")) returned 1
	[0100.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\oKaEbwcOgsPSBH.pptx", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\oKaEbwcOgsPSBH.pptx", lpFilePart=0x0) returned 0x44
	[0100.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0100.958] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\oKaEbwcOgsPSBH.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\okaebwcogspsbh.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0100.958] GetFileType (hFile=0x208) returned 0x1
	[0100.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0100.958] GetFileType (hFile=0x208) returned 0x1
	[0100.958] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xeca1
	[0100.959] ReadFile (in: hFile=0x208, lpBuffer=0x26c6408, nNumberOfBytesToRead=0xeca1, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26c6408*, lpNumberOfBytesRead=0x26ef24*=0xeca1, lpOverlapped=0x0) returned 1
	[0100.962] CloseHandle (hObject=0x208) returned 1
	[0100.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\oKaEbwcOgsPSBH.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\oKaEbwcOgsPSBH.pptx.KEKW", lpFilePart=0x0) returned 0x49
	[0100.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0100.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\oKaEbwcOgsPSBH.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\okaebwcogspsbh.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0100.963] GetFileType (hFile=0x208) returned 0x1
	[0100.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0100.964] GetFileType (hFile=0x208) returned 0x1
	[0100.964] WriteFile (in: hFile=0x208, lpBuffer=0x26d67bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26d67bc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0101.123] CloseHandle (hObject=0x208) returned 1
	[0101.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\oKaEbwcOgsPSBH.pptx", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\oKaEbwcOgsPSBH.pptx", lpFilePart=0x0) returned 0x44
	[0101.124] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\oKaEbwcOgsPSBH.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\okaebwcogspsbh.pptx")) returned 1
	[0101.130] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35ea60b0, ftCreationTime.dwHighDateTime=0x1d5e3eb, ftLastAccessTime.dwLowDateTime=0xd19e8f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xd19e8f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QphIe7J3JTVAb6lMkmEX", cAlternateFileName="QPHIE7~1")) returned 1
	[0101.131] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4545f1d0, ftCreationTime.dwHighDateTime=0x1d5dfc9, ftLastAccessTime.dwLowDateTime=0x99533f80, ftLastAccessTime.dwHighDateTime=0x1d5ddd5, ftLastWriteTime.dwLowDateTime=0x99533f80, ftLastWriteTime.dwHighDateTime=0x1d5ddd5, nFileSizeHigh=0x0, nFileSizeLow=0xa991, dwReserved0=0x0, dwReserved1=0x0, cFileName="RgkXT7U3sMAKrn4DC1R3.docx", cAlternateFileName="RGKXT7~1.DOC")) returned 1
	[0101.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\RgkXT7U3sMAKrn4DC1R3.docx", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\RgkXT7U3sMAKrn4DC1R3.docx", lpFilePart=0x0) returned 0x4a
	[0101.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0101.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\RgkXT7U3sMAKrn4DC1R3.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\rgkxt7u3smakrn4dc1r3.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0101.132] GetFileType (hFile=0x208) returned 0x1
	[0101.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0101.132] GetFileType (hFile=0x208) returned 0x1
	[0101.132] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa991
	[0101.132] ReadFile (in: hFile=0x208, lpBuffer=0x26d7f5c, nNumberOfBytesToRead=0xa991, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26d7f5c*, lpNumberOfBytesRead=0x26ef24*=0xa991, lpOverlapped=0x0) returned 1
	[0101.136] CloseHandle (hObject=0x208) returned 1
	[0101.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\RgkXT7U3sMAKrn4DC1R3.docx.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\RgkXT7U3sMAKrn4DC1R3.docx.KEKW", lpFilePart=0x0) returned 0x4f
	[0101.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0101.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\RgkXT7U3sMAKrn4DC1R3.docx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\rgkxt7u3smakrn4dc1r3.docx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0101.137] GetFileType (hFile=0x208) returned 0x1
	[0101.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0101.138] GetFileType (hFile=0x208) returned 0x1
	[0101.138] WriteFile (in: hFile=0x208, lpBuffer=0x26e4024*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26e4024*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0101.141] CloseHandle (hObject=0x208) returned 1
	[0101.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\RgkXT7U3sMAKrn4DC1R3.docx", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\RgkXT7U3sMAKrn4DC1R3.docx", lpFilePart=0x0) returned 0x4a
	[0101.142] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\RgkXT7U3sMAKrn4DC1R3.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\rgkxt7u3smakrn4dc1r3.docx")) returned 1
	[0101.151] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaa77740, ftCreationTime.dwHighDateTime=0x1d5e1ed, ftLastAccessTime.dwLowDateTime=0xb63fa320, ftLastAccessTime.dwHighDateTime=0x1d5da8f, ftLastWriteTime.dwLowDateTime=0xb63fa320, ftLastWriteTime.dwHighDateTime=0x1d5da8f, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="wWd4kF1RArO.ots", cAlternateFileName="WWD4KF~1.OTS")) returned 1
	[0101.151] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddc44900, ftCreationTime.dwHighDateTime=0x1d5dab2, ftLastAccessTime.dwLowDateTime=0xefa93bd0, ftLastAccessTime.dwHighDateTime=0x1d5e20f, ftLastWriteTime.dwLowDateTime=0xefa93bd0, ftLastWriteTime.dwHighDateTime=0x1d5e20f, nFileSizeHigh=0x0, nFileSizeLow=0x10430, dwReserved0=0x0, dwReserved1=0x0, cFileName="xy2kYiRdnAtf-Vy3k.docx", cAlternateFileName="XY2KYI~1.DOC")) returned 1
	[0101.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\xy2kYiRdnAtf-Vy3k.docx", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\xy2kYiRdnAtf-Vy3k.docx", lpFilePart=0x0) returned 0x47
	[0101.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0101.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\xy2kYiRdnAtf-Vy3k.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\xy2kyirdnatf-vy3k.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0101.152] GetFileType (hFile=0x208) returned 0x1
	[0101.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0101.152] GetFileType (hFile=0x208) returned 0x1
	[0101.152] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x10430
	[0101.153] ReadFile (in: hFile=0x208, lpBuffer=0x26e59a8, nNumberOfBytesToRead=0x10430, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26e59a8*, lpNumberOfBytesRead=0x26ef24*=0x10430, lpOverlapped=0x0) returned 1
	[0101.157] CloseHandle (hObject=0x208) returned 1
	[0101.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\xy2kYiRdnAtf-Vy3k.docx.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\xy2kYiRdnAtf-Vy3k.docx.KEKW", lpFilePart=0x0) returned 0x4c
	[0101.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0101.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\xy2kYiRdnAtf-Vy3k.docx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\xy2kyirdnatf-vy3k.docx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0101.159] GetFileType (hFile=0x208) returned 0x1
	[0101.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0101.159] GetFileType (hFile=0x208) returned 0x1
	[0101.159] WriteFile (in: hFile=0x208, lpBuffer=0x26f74fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26f74fc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0101.162] CloseHandle (hObject=0x208) returned 1
	[0101.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\xy2kYiRdnAtf-Vy3k.docx", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\xy2kYiRdnAtf-Vy3k.docx", lpFilePart=0x0) returned 0x47
	[0101.163] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\xy2kYiRdnAtf-Vy3k.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\xy2kyirdnatf-vy3k.docx")) returned 1
	[0101.261] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0101.261] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0101.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0101.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0101.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0101.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0101.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f__WJP1S\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f__wjp1s\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0101.283] GetFileType (hFile=0x204) returned 0x1
	[0101.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0101.283] GetFileType (hFile=0x204) returned 0x1
	[0101.284] WriteFile (in: hFile=0x204, lpBuffer=0x26f9bf8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26f9bf8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0101.287] CloseHandle (hObject=0x204) returned 1
	[0101.287] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44334a0, ftCreationTime.dwHighDateTime=0x1d5e026, ftLastAccessTime.dwLowDateTime=0x705449e0, ftLastAccessTime.dwHighDateTime=0x1d5e0cc, ftLastWriteTime.dwLowDateTime=0x705449e0, ftLastWriteTime.dwHighDateTime=0x1d5e0cc, nFileSizeHigh=0x0, nFileSizeLow=0x1132d, dwReserved0=0x0, dwReserved1=0x0, cFileName="g3IGI_8_b20Ns0MOJ9.odt", cAlternateFileName="G3IGI_~1.ODT")) returned 1
	[0101.288] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc1f7c0, ftCreationTime.dwHighDateTime=0x1d5ad15, ftLastAccessTime.dwLowDateTime=0xbdfc7460, ftLastAccessTime.dwHighDateTime=0x1d55b8e, ftLastWriteTime.dwLowDateTime=0xbdfc7460, ftLastWriteTime.dwHighDateTime=0x1d55b8e, nFileSizeHigh=0x0, nFileSizeLow=0x7375, dwReserved0=0x0, dwReserved1=0x0, cFileName="k9pFxS6ebZN.xlsx", cAlternateFileName="K9PFXS~1.XLS")) returned 1
	[0101.288] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6d27f0, ftCreationTime.dwHighDateTime=0x1d5a9bb, ftLastAccessTime.dwLowDateTime=0x96296330, ftLastAccessTime.dwHighDateTime=0x1d5bf3e, ftLastWriteTime.dwLowDateTime=0x96296330, ftLastWriteTime.dwHighDateTime=0x1d5bf3e, nFileSizeHigh=0x0, nFileSizeLow=0xec96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LejfGFmzj3PSoclK1Dyf.xlsx", cAlternateFileName="LEJFGF~1.XLS")) returned 1
	[0101.289] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x818e7900, ftCreationTime.dwHighDateTime=0x1d5ddfd, ftLastAccessTime.dwLowDateTime=0x575558d0, ftLastAccessTime.dwHighDateTime=0x1d5e69e, ftLastWriteTime.dwLowDateTime=0x575558d0, ftLastWriteTime.dwHighDateTime=0x1d5e69e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lssfz5", cAlternateFileName="")) returned 1
	[0101.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0101.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5", lpFilePart=0x0) returned 0x2e
	[0101.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\", lpFilePart=0x0) returned 0x2f
	[0101.290] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x818e7900, ftCreationTime.dwHighDateTime=0x1d5ddfd, ftLastAccessTime.dwLowDateTime=0x575558d0, ftLastAccessTime.dwHighDateTime=0x1d5e69e, ftLastWriteTime.dwLowDateTime=0x575558d0, ftLastWriteTime.dwHighDateTime=0x1d5e69e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0101.291] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x818e7900, ftCreationTime.dwHighDateTime=0x1d5ddfd, ftLastAccessTime.dwLowDateTime=0x575558d0, ftLastAccessTime.dwHighDateTime=0x1d5e69e, ftLastWriteTime.dwLowDateTime=0x575558d0, ftLastWriteTime.dwHighDateTime=0x1d5e69e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.291] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e525c0, ftCreationTime.dwHighDateTime=0x1d5dffa, ftLastAccessTime.dwLowDateTime=0x2967ce20, ftLastAccessTime.dwHighDateTime=0x1d5e726, ftLastWriteTime.dwLowDateTime=0x2967ce20, ftLastWriteTime.dwHighDateTime=0x1d5e726, nFileSizeHigh=0x0, nFileSizeLow=0xfc17, dwReserved0=0x0, dwReserved1=0x0, cFileName="5QlA2SuSZH92 L9.pps", cAlternateFileName="5QLA2S~1.PPS")) returned 1
	[0101.292] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d1c3410, ftCreationTime.dwHighDateTime=0x1d5e0a4, ftLastAccessTime.dwLowDateTime=0x4d0e2340, ftLastAccessTime.dwHighDateTime=0x1d5dcd3, ftLastWriteTime.dwLowDateTime=0x4d0e2340, ftLastWriteTime.dwHighDateTime=0x1d5dcd3, nFileSizeHigh=0x0, nFileSizeLow=0xcf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ngUDipaXNO.pptx", cAlternateFileName="NGUDIP~1.PPT")) returned 1
	[0101.293] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e14bf0, ftCreationTime.dwHighDateTime=0x1d5e25b, ftLastAccessTime.dwLowDateTime=0xbd2095e0, ftLastAccessTime.dwHighDateTime=0x1d5e49f, ftLastWriteTime.dwLowDateTime=0xbd2095e0, ftLastWriteTime.dwHighDateTime=0x1d5e49f, nFileSizeHigh=0x0, nFileSizeLow=0xb33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ot2dToqM.pps", cAlternateFileName="")) returned 1
	[0101.293] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x559573b0, ftCreationTime.dwHighDateTime=0x1d5d995, ftLastAccessTime.dwLowDateTime=0x470e43a0, ftLastAccessTime.dwHighDateTime=0x1d5d853, ftLastWriteTime.dwLowDateTime=0x470e43a0, ftLastWriteTime.dwHighDateTime=0x1d5d853, nFileSizeHigh=0x0, nFileSizeLow=0x1789d, dwReserved0=0x0, dwReserved1=0x0, cFileName="QoTMlAH_YZPnU_nsY49.ods", cAlternateFileName="QOTMLA~1.ODS")) returned 1
	[0101.294] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e045230, ftCreationTime.dwHighDateTime=0x1d5e777, ftLastAccessTime.dwLowDateTime=0x389b1a50, ftLastAccessTime.dwHighDateTime=0x1d5de70, ftLastWriteTime.dwLowDateTime=0x389b1a50, ftLastWriteTime.dwHighDateTime=0x1d5de70, nFileSizeHigh=0x0, nFileSizeLow=0x18804, dwReserved0=0x0, dwReserved1=0x0, cFileName="rRGx3-ADGD Q7osenff.ods", cAlternateFileName="RRGX3-~1.ODS")) returned 1
	[0101.295] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd117a6c0, ftCreationTime.dwHighDateTime=0x1d5ddcd, ftLastAccessTime.dwLowDateTime=0xb28247d0, ftLastAccessTime.dwHighDateTime=0x1d5e1f4, ftLastWriteTime.dwLowDateTime=0xb28247d0, ftLastWriteTime.dwHighDateTime=0x1d5e1f4, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVgPOkZod7XGGc.xls", cAlternateFileName="SVGPOK~1.XLS")) returned 1
	[0101.295] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf80e9b20, ftCreationTime.dwHighDateTime=0x1d5e29c, ftLastAccessTime.dwLowDateTime=0x5a1e8c40, ftLastAccessTime.dwHighDateTime=0x1d5d8fb, ftLastWriteTime.dwLowDateTime=0x5a1e8c40, ftLastWriteTime.dwHighDateTime=0x1d5d8fb, nFileSizeHigh=0x0, nFileSizeLow=0x3db4, dwReserved0=0x0, dwReserved1=0x0, cFileName="X508s_NGV.odp", cAlternateFileName="X508S_~1.ODP")) returned 1
	[0101.296] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf80e9b20, ftCreationTime.dwHighDateTime=0x1d5e29c, ftLastAccessTime.dwLowDateTime=0x5a1e8c40, ftLastAccessTime.dwHighDateTime=0x1d5d8fb, ftLastWriteTime.dwLowDateTime=0x5a1e8c40, ftLastWriteTime.dwHighDateTime=0x1d5d8fb, nFileSizeHigh=0x0, nFileSizeLow=0x3db4, dwReserved0=0x0, dwReserved1=0x0, cFileName="X508s_NGV.odp", cAlternateFileName="X508S_~1.ODP")) returned 0
	[0101.296] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0101.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0101.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0101.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0101.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5", lpFilePart=0x0) returned 0x2e
	[0101.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\", lpFilePart=0x0) returned 0x2f
	[0101.297] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x818e7900, ftCreationTime.dwHighDateTime=0x1d5ddfd, ftLastAccessTime.dwLowDateTime=0x575558d0, ftLastAccessTime.dwHighDateTime=0x1d5e69e, ftLastWriteTime.dwLowDateTime=0x575558d0, ftLastWriteTime.dwHighDateTime=0x1d5e69e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0101.298] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x818e7900, ftCreationTime.dwHighDateTime=0x1d5ddfd, ftLastAccessTime.dwLowDateTime=0x575558d0, ftLastAccessTime.dwHighDateTime=0x1d5e69e, ftLastWriteTime.dwLowDateTime=0x575558d0, ftLastWriteTime.dwHighDateTime=0x1d5e69e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.298] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e525c0, ftCreationTime.dwHighDateTime=0x1d5dffa, ftLastAccessTime.dwLowDateTime=0x2967ce20, ftLastAccessTime.dwHighDateTime=0x1d5e726, ftLastWriteTime.dwLowDateTime=0x2967ce20, ftLastWriteTime.dwHighDateTime=0x1d5e726, nFileSizeHigh=0x0, nFileSizeLow=0xfc17, dwReserved0=0x0, dwReserved1=0x0, cFileName="5QlA2SuSZH92 L9.pps", cAlternateFileName="5QLA2S~1.PPS")) returned 1
	[0101.299] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d1c3410, ftCreationTime.dwHighDateTime=0x1d5e0a4, ftLastAccessTime.dwLowDateTime=0x4d0e2340, ftLastAccessTime.dwHighDateTime=0x1d5dcd3, ftLastWriteTime.dwLowDateTime=0x4d0e2340, ftLastWriteTime.dwHighDateTime=0x1d5dcd3, nFileSizeHigh=0x0, nFileSizeLow=0xcf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ngUDipaXNO.pptx", cAlternateFileName="NGUDIP~1.PPT")) returned 1
	[0101.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\ngUDipaXNO.pptx", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\ngUDipaXNO.pptx", lpFilePart=0x0) returned 0x3e
	[0101.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0101.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\ngUDipaXNO.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lssfz5\\ngudipaxno.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0101.300] GetFileType (hFile=0x208) returned 0x1
	[0101.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0101.300] GetFileType (hFile=0x208) returned 0x1
	[0101.300] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xcf3b
	[0101.301] ReadFile (in: hFile=0x208, lpBuffer=0x26fd50c, nNumberOfBytesToRead=0xcf3b, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26fd50c*, lpNumberOfBytesRead=0x26ef24*=0xcf3b, lpOverlapped=0x0) returned 1
	[0101.305] CloseHandle (hObject=0x208) returned 1
	[0101.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\ngUDipaXNO.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\ngUDipaXNO.pptx.KEKW", lpFilePart=0x0) returned 0x43
	[0101.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0101.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\ngUDipaXNO.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lssfz5\\ngudipaxno.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0101.307] GetFileType (hFile=0x208) returned 0x1
	[0101.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0101.307] GetFileType (hFile=0x208) returned 0x1
	[0101.307] WriteFile (in: hFile=0x208, lpBuffer=0x270bb38*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x270bb38*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0101.354] CloseHandle (hObject=0x208) returned 1
	[0101.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\ngUDipaXNO.pptx", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\ngUDipaXNO.pptx", lpFilePart=0x0) returned 0x3e
	[0101.354] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\ngUDipaXNO.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lssfz5\\ngudipaxno.pptx")) returned 1
	[0101.364] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e14bf0, ftCreationTime.dwHighDateTime=0x1d5e25b, ftLastAccessTime.dwLowDateTime=0xbd2095e0, ftLastAccessTime.dwHighDateTime=0x1d5e49f, ftLastWriteTime.dwLowDateTime=0xbd2095e0, ftLastWriteTime.dwHighDateTime=0x1d5e49f, nFileSizeHigh=0x0, nFileSizeLow=0xb33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ot2dToqM.pps", cAlternateFileName="")) returned 1
	[0101.364] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x559573b0, ftCreationTime.dwHighDateTime=0x1d5d995, ftLastAccessTime.dwLowDateTime=0x470e43a0, ftLastAccessTime.dwHighDateTime=0x1d5d853, ftLastWriteTime.dwLowDateTime=0x470e43a0, ftLastWriteTime.dwHighDateTime=0x1d5d853, nFileSizeHigh=0x0, nFileSizeLow=0x1789d, dwReserved0=0x0, dwReserved1=0x0, cFileName="QoTMlAH_YZPnU_nsY49.ods", cAlternateFileName="QOTMLA~1.ODS")) returned 1
	[0101.365] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e045230, ftCreationTime.dwHighDateTime=0x1d5e777, ftLastAccessTime.dwLowDateTime=0x389b1a50, ftLastAccessTime.dwHighDateTime=0x1d5de70, ftLastWriteTime.dwLowDateTime=0x389b1a50, ftLastWriteTime.dwHighDateTime=0x1d5de70, nFileSizeHigh=0x0, nFileSizeLow=0x18804, dwReserved0=0x0, dwReserved1=0x0, cFileName="rRGx3-ADGD Q7osenff.ods", cAlternateFileName="RRGX3-~1.ODS")) returned 1
	[0101.365] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd117a6c0, ftCreationTime.dwHighDateTime=0x1d5ddcd, ftLastAccessTime.dwLowDateTime=0xb28247d0, ftLastAccessTime.dwHighDateTime=0x1d5e1f4, ftLastWriteTime.dwLowDateTime=0xb28247d0, ftLastWriteTime.dwHighDateTime=0x1d5e1f4, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVgPOkZod7XGGc.xls", cAlternateFileName="SVGPOK~1.XLS")) returned 1
	[0101.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\SVgPOkZod7XGGc.xls", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\SVgPOkZod7XGGc.xls", lpFilePart=0x0) returned 0x41
	[0101.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0101.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\SVgPOkZod7XGGc.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lssfz5\\svgpokzod7xggc.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0101.366] GetFileType (hFile=0x208) returned 0x1
	[0101.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0101.366] GetFileType (hFile=0x208) returned 0x1
	[0101.366] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x3c58
	[0101.367] ReadFile (in: hFile=0x208, lpBuffer=0x270dbc0, nNumberOfBytesToRead=0x3c58, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x270dbc0*, lpNumberOfBytesRead=0x26ef24*=0x3c58, lpOverlapped=0x0) returned 1
	[0101.370] CloseHandle (hObject=0x208) returned 1
	[0101.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\SVgPOkZod7XGGc.xls.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\SVgPOkZod7XGGc.xls.KEKW", lpFilePart=0x0) returned 0x46
	[0101.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0101.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\SVgPOkZod7XGGc.xls.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lssfz5\\svgpokzod7xggc.xls.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0101.372] GetFileType (hFile=0x208) returned 0x1
	[0101.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0101.372] GetFileType (hFile=0x208) returned 0x1
	[0101.373] WriteFile (in: hFile=0x208, lpBuffer=0x2712f1c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2712f1c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0101.375] CloseHandle (hObject=0x208) returned 1
	[0101.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\SVgPOkZod7XGGc.xls", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\SVgPOkZod7XGGc.xls", lpFilePart=0x0) returned 0x41
	[0101.376] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\SVgPOkZod7XGGc.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lssfz5\\svgpokzod7xggc.xls")) returned 1
	[0101.384] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf80e9b20, ftCreationTime.dwHighDateTime=0x1d5e29c, ftLastAccessTime.dwLowDateTime=0x5a1e8c40, ftLastAccessTime.dwHighDateTime=0x1d5d8fb, ftLastWriteTime.dwLowDateTime=0x5a1e8c40, ftLastWriteTime.dwHighDateTime=0x1d5d8fb, nFileSizeHigh=0x0, nFileSizeLow=0x3db4, dwReserved0=0x0, dwReserved1=0x0, cFileName="X508s_NGV.odp", cAlternateFileName="X508S_~1.ODP")) returned 1
	[0101.384] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0101.384] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0101.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0101.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0101.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0101.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0101.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Lssfz5\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lssfz5\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0101.386] GetFileType (hFile=0x204) returned 0x1
	[0101.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0101.386] GetFileType (hFile=0x204) returned 0x1
	[0101.386] WriteFile (in: hFile=0x204, lpBuffer=0x271597c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x271597c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0101.390] CloseHandle (hObject=0x204) returned 1
	[0101.390] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9be61a0, ftCreationTime.dwHighDateTime=0x1d5dfc9, ftLastAccessTime.dwLowDateTime=0x8af59240, ftLastAccessTime.dwHighDateTime=0x1d5e61c, ftLastWriteTime.dwLowDateTime=0x8af59240, ftLastWriteTime.dwHighDateTime=0x1d5e61c, nFileSizeHigh=0x0, nFileSizeLow=0xfa83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mc9jttJNds c6wX8O-L.rtf", cAlternateFileName="MC9JTT~1.RTF")) returned 1
	[0101.391] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0101.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0101.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30
	[0101.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", lpFilePart=0x0) returned 0x31
	[0101.392] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0101.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef80) returned 1
	[0101.395] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0101.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0101.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33
	[0101.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x34
	[0101.396] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0101.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef80) returned 1
	[0101.400] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1
	[0101.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0101.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31
	[0101.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32
	[0101.401] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0101.411] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.411] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0101.412] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1
	[0101.413] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1
	[0101.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0101.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a
	[0101.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b
	[0101.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0101.418] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.419] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0101.419] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0
	[0101.420] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0101.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0101.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0101.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0101.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a
	[0101.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b
	[0101.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0101.421] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.422] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0101.422] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0101.422] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0101.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0101.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0101.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0101.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0101.423] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0101.424] GetFileType (hFile=0x208) returned 0x1
	[0101.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0101.424] GetFileType (hFile=0x208) returned 0x1
	[0101.425] WriteFile (in: hFile=0x208, lpBuffer=0x271bbb4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x271bbb4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0101.428] CloseHandle (hObject=0x208) returned 1
	[0101.428] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0101.428] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0101.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0101.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0101.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0101.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31
	[0101.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32
	[0101.429] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0101.430] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.430] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0101.431] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1
	[0101.431] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xd6614f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xd6614f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1
	[0101.432] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xd6614f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xd6614f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0
	[0101.432] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0101.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0101.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0101.433] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0101.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0101.433] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0101.435] GetFileType (hFile=0x204) returned 0x1
	[0101.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0101.435] GetFileType (hFile=0x204) returned 0x1
	[0101.435] WriteFile (in: hFile=0x204, lpBuffer=0x271f28c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x271f28c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0101.438] CloseHandle (hObject=0x204) returned 1
	[0101.439] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0101.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0101.439] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31
	[0101.439] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x32
	[0101.439] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0101.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef80) returned 1
	[0101.443] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bede530, ftCreationTime.dwHighDateTime=0x1d5df9d, ftLastAccessTime.dwLowDateTime=0x19edb100, ftLastAccessTime.dwHighDateTime=0x1d5d94b, ftLastWriteTime.dwLowDateTime=0x19edb100, ftLastWriteTime.dwHighDateTime=0x1d5d94b, nFileSizeHigh=0x0, nFileSizeLow=0x759c, dwReserved0=0x0, dwReserved1=0x0, cFileName="N28MvGiCVwSz7l-D2f.xlsx", cAlternateFileName="N28MVG~1.XLS")) returned 1
	[0101.444] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1
	[0101.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0101.445] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35
	[0101.445] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36
	[0101.445] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0101.446] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.446] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1
	[0101.447] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0
	[0101.447] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0101.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0101.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0101.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0101.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35
	[0101.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36
	[0101.448] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0101.449] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.450] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1
	[0101.450] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0101.451] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0101.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0101.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0101.451] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0101.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0101.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0101.452] GetFileType (hFile=0x204) returned 0x1
	[0101.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0101.453] GetFileType (hFile=0x204) returned 0x1
	[0101.453] WriteFile (in: hFile=0x204, lpBuffer=0x2723e04*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2723e04*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0101.456] CloseHandle (hObject=0x204) returned 1
	[0101.456] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc381e3f0, ftCreationTime.dwHighDateTime=0x1d5da0c, ftLastAccessTime.dwLowDateTime=0xb5b499d0, ftLastAccessTime.dwHighDateTime=0x1d5dd03, ftLastWriteTime.dwLowDateTime=0xb5b499d0, ftLastWriteTime.dwHighDateTime=0x1d5dd03, nFileSizeHigh=0x0, nFileSizeLow=0x126ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="rHnnn.pps", cAlternateFileName="")) returned 1
	[0101.457] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x266cbf60, ftCreationTime.dwHighDateTime=0x1d573df, ftLastAccessTime.dwLowDateTime=0xab28cc70, ftLastAccessTime.dwHighDateTime=0x1d56f67, ftLastWriteTime.dwLowDateTime=0xab28cc70, ftLastWriteTime.dwHighDateTime=0x1d56f67, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x0, dwReserved1=0x0, cFileName="sgyB7GXPtsnhQSYJ0.pptx", cAlternateFileName="SGYB7G~1.PPT")) returned 1
	[0101.457] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93a1f00, ftCreationTime.dwHighDateTime=0x1d5e4e9, ftLastAccessTime.dwLowDateTime=0x2d8b3a70, ftLastAccessTime.dwHighDateTime=0x1d5e283, ftLastWriteTime.dwLowDateTime=0x2d8b3a70, ftLastWriteTime.dwHighDateTime=0x1d5e283, nFileSizeHigh=0x0, nFileSizeLow=0x12c17, dwReserved0=0x0, dwReserved1=0x0, cFileName="TJowR7p3onxdwUlc.ots", cAlternateFileName="TJOWR7~1.OTS")) returned 1
	[0101.458] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488ba1f0, ftCreationTime.dwHighDateTime=0x1d5acbb, ftLastAccessTime.dwLowDateTime=0x2830ff30, ftLastAccessTime.dwHighDateTime=0x1d5d8a9, ftLastWriteTime.dwLowDateTime=0x2830ff30, ftLastWriteTime.dwHighDateTime=0x1d5d8a9, nFileSizeHigh=0x0, nFileSizeLow=0x5e34, dwReserved0=0x0, dwReserved1=0x0, cFileName="VlDWNqZ9Oy-yQqpS.pptx", cAlternateFileName="VLDWNQ~1.PPT")) returned 1
	[0101.458] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5754fb0, ftCreationTime.dwHighDateTime=0x1d5dcc9, ftLastAccessTime.dwLowDateTime=0xfbcc1f70, ftLastAccessTime.dwHighDateTime=0x1d5cfb0, ftLastWriteTime.dwLowDateTime=0xfbcc1f70, ftLastWriteTime.dwHighDateTime=0x1d5cfb0, nFileSizeHigh=0x0, nFileSizeLow=0x15983, dwReserved0=0x0, dwReserved1=0x0, cFileName="VsMue.docx", cAlternateFileName="VSMUE~1.DOC")) returned 1
	[0101.459] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f3887d0, ftCreationTime.dwHighDateTime=0x1d5c751, ftLastAccessTime.dwLowDateTime=0xc6519710, ftLastAccessTime.dwHighDateTime=0x1d572c4, ftLastWriteTime.dwLowDateTime=0xc6519710, ftLastWriteTime.dwHighDateTime=0x1d572c4, nFileSizeHigh=0x0, nFileSizeLow=0x181de, dwReserved0=0x0, dwReserved1=0x0, cFileName="wUXc6EhnWHZbuYOaWjpH.docx", cAlternateFileName="WUXC6E~1.DOC")) returned 1
	[0101.460] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb334ed0, ftCreationTime.dwHighDateTime=0x1d598f7, ftLastAccessTime.dwLowDateTime=0xe7ed5b90, ftLastAccessTime.dwHighDateTime=0x1d57619, ftLastWriteTime.dwLowDateTime=0xe7ed5b90, ftLastWriteTime.dwHighDateTime=0x1d57619, nFileSizeHigh=0x0, nFileSizeLow=0xc2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="XE0 jUKMfFjCtfmBzTF.docx", cAlternateFileName="XE0JUK~1.DOC")) returned 1
	[0101.460] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f009690, ftCreationTime.dwHighDateTime=0x1d5d99b, ftLastAccessTime.dwLowDateTime=0x131ede50, ftLastAccessTime.dwHighDateTime=0x1d5e7b3, ftLastWriteTime.dwLowDateTime=0x131ede50, ftLastWriteTime.dwHighDateTime=0x1d5e7b3, nFileSizeHigh=0x0, nFileSizeLow=0x17334, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZhvS4lX.xls", cAlternateFileName="")) returned 1
	[0101.461] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e11d30, ftCreationTime.dwHighDateTime=0x1d59fb1, ftLastAccessTime.dwLowDateTime=0x1e837210, ftLastAccessTime.dwHighDateTime=0x1d59308, ftLastWriteTime.dwLowDateTime=0x1e837210, ftLastWriteTime.dwHighDateTime=0x1d59308, nFileSizeHigh=0x0, nFileSizeLow=0x15c2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZjW5mk1OGDP3a2UPxB.pptx", cAlternateFileName="ZJW5MK~1.PPT")) returned 1
	[0101.461] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e11d30, ftCreationTime.dwHighDateTime=0x1d59fb1, ftLastAccessTime.dwLowDateTime=0x1e837210, ftLastAccessTime.dwHighDateTime=0x1d59308, ftLastWriteTime.dwLowDateTime=0x1e837210, ftLastWriteTime.dwHighDateTime=0x1d59308, nFileSizeHigh=0x0, nFileSizeLow=0x15c2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZjW5mk1OGDP3a2UPxB.pptx", cAlternateFileName="ZJW5MK~1.PPT")) returned 0
	[0101.462] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0101.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0101.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0101.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0101.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27
	[0101.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28
	[0101.463] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda7dc660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda7dc660, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0101.463] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda7dc660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda7dc660, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.464] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6070f00, ftCreationTime.dwHighDateTime=0x1d5e114, ftLastAccessTime.dwLowDateTime=0xbe9cf110, ftLastAccessTime.dwHighDateTime=0x1d5dba9, ftLastWriteTime.dwLowDateTime=0xbe9cf110, ftLastWriteTime.dwHighDateTime=0x1d5dba9, nFileSizeHigh=0x0, nFileSizeLow=0x9ab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="0kI16qGYKIWr.pdf", cAlternateFileName="0KI16Q~1.PDF")) returned 1
	[0101.464] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0kI16qGYKIWr.pdf", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0kI16qGYKIWr.pdf", lpFilePart=0x0) returned 0x38
	[0101.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.465] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0kI16qGYKIWr.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0ki16qgykiwr.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.506] GetFileType (hFile=0x204) returned 0x1
	[0101.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.506] GetFileType (hFile=0x204) returned 0x1
	[0101.506] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x9ab5
	[0101.506] ReadFile (in: hFile=0x204, lpBuffer=0x27266e8, nNumberOfBytesToRead=0x9ab5, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x27266e8*, lpNumberOfBytesRead=0x26efc4*=0x9ab5, lpOverlapped=0x0) returned 1
	[0101.510] CloseHandle (hObject=0x204) returned 1
	[0101.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0kI16qGYKIWr.pdf.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0kI16qGYKIWr.pdf.KEKW", lpFilePart=0x0) returned 0x3d
	[0101.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0kI16qGYKIWr.pdf.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0ki16qgykiwr.pdf.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.514] GetFileType (hFile=0x204) returned 0x1
	[0101.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.514] GetFileType (hFile=0x204) returned 0x1
	[0101.515] WriteFile (in: hFile=0x204, lpBuffer=0x2731878*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2731878*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.518] CloseHandle (hObject=0x204) returned 1
	[0101.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0kI16qGYKIWr.pdf", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0kI16qGYKIWr.pdf", lpFilePart=0x0) returned 0x38
	[0101.518] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0kI16qGYKIWr.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0ki16qgykiwr.pdf")) returned 1
	[0101.526] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5655d110, ftCreationTime.dwHighDateTime=0x1d5e6c8, ftLastAccessTime.dwLowDateTime=0xd63c6c80, ftLastAccessTime.dwHighDateTime=0x1d55fd3, ftLastWriteTime.dwLowDateTime=0xd63c6c80, ftLastWriteTime.dwHighDateTime=0x1d55fd3, nFileSizeHigh=0x0, nFileSizeLow=0x76a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="288dXqBRqJ dmG.xlsx", cAlternateFileName="288DXQ~1.XLS")) returned 1
	[0101.527] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614d3380, ftCreationTime.dwHighDateTime=0x1d5b32c, ftLastAccessTime.dwLowDateTime=0xa1b56ad0, ftLastAccessTime.dwHighDateTime=0x1d58c6e, ftLastWriteTime.dwLowDateTime=0xa1b56ad0, ftLastWriteTime.dwHighDateTime=0x1d58c6e, nFileSizeHigh=0x0, nFileSizeLow=0x18d55, dwReserved0=0x0, dwReserved1=0x0, cFileName="2wb0k9funFxm5A6aGy.pptx", cAlternateFileName="2WB0K9~1.PPT")) returned 1
	[0101.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wb0k9funFxm5A6aGy.pptx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wb0k9funFxm5A6aGy.pptx", lpFilePart=0x0) returned 0x3f
	[0101.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wb0k9funFxm5A6aGy.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2wb0k9funfxm5a6agy.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.528] GetFileType (hFile=0x204) returned 0x1
	[0101.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.528] GetFileType (hFile=0x204) returned 0x1
	[0101.529] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x18d55
	[0101.530] ReadFile (in: hFile=0x204, lpBuffer=0x3648428, nNumberOfBytesToRead=0x18d55, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x3648428*, lpNumberOfBytesRead=0x26efc4*=0x18d55, lpOverlapped=0x0) returned 1
	[0101.537] CloseHandle (hObject=0x204) returned 1
	[0101.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wb0k9funFxm5A6aGy.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wb0k9funFxm5A6aGy.pptx.KEKW", lpFilePart=0x0) returned 0x44
	[0101.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wb0k9funFxm5A6aGy.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2wb0k9funfxm5a6agy.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.539] GetFileType (hFile=0x204) returned 0x1
	[0101.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.539] GetFileType (hFile=0x204) returned 0x1
	[0101.539] WriteFile (in: hFile=0x204, lpBuffer=0x273484c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x273484c*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.542] CloseHandle (hObject=0x204) returned 1
	[0101.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wb0k9funFxm5A6aGy.pptx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wb0k9funFxm5A6aGy.pptx", lpFilePart=0x0) returned 0x3f
	[0101.543] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wb0k9funFxm5A6aGy.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2wb0k9funfxm5a6agy.pptx")) returned 1
	[0101.550] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x942b1850, ftCreationTime.dwHighDateTime=0x1d59232, ftLastAccessTime.dwLowDateTime=0xb71d6a30, ftLastAccessTime.dwHighDateTime=0x1d5bbe9, ftLastWriteTime.dwLowDateTime=0xb71d6a30, ftLastWriteTime.dwHighDateTime=0x1d5bbe9, nFileSizeHigh=0x0, nFileSizeLow=0x5262, dwReserved0=0x0, dwReserved1=0x0, cFileName="5pyJ_ 12qn1vPLhsv.docx", cAlternateFileName="5PYJ_1~1.DOC")) returned 1
	[0101.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5pyJ_ 12qn1vPLhsv.docx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5pyJ_ 12qn1vPLhsv.docx", lpFilePart=0x0) returned 0x3e
	[0101.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5pyJ_ 12qn1vPLhsv.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5pyj_ 12qn1vplhsv.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.551] GetFileType (hFile=0x204) returned 0x1
	[0101.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.551] GetFileType (hFile=0x204) returned 0x1
	[0101.551] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x5262
	[0101.551] ReadFile (in: hFile=0x204, lpBuffer=0x2735dac, nNumberOfBytesToRead=0x5262, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x2735dac*, lpNumberOfBytesRead=0x26efc4*=0x5262, lpOverlapped=0x0) returned 1
	[0101.555] CloseHandle (hObject=0x204) returned 1
	[0101.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5pyJ_ 12qn1vPLhsv.docx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5pyJ_ 12qn1vPLhsv.docx.KEKW", lpFilePart=0x0) returned 0x43
	[0101.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5pyJ_ 12qn1vPLhsv.docx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5pyj_ 12qn1vplhsv.docx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.556] GetFileType (hFile=0x204) returned 0x1
	[0101.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.556] GetFileType (hFile=0x204) returned 0x1
	[0101.557] WriteFile (in: hFile=0x204, lpBuffer=0x273c70c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x273c70c*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.561] CloseHandle (hObject=0x204) returned 1
	[0101.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5pyJ_ 12qn1vPLhsv.docx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5pyJ_ 12qn1vPLhsv.docx", lpFilePart=0x0) returned 0x3e
	[0101.562] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5pyJ_ 12qn1vPLhsv.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5pyj_ 12qn1vplhsv.docx")) returned 1
	[0101.567] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc8ccb0, ftCreationTime.dwHighDateTime=0x1d5e107, ftLastAccessTime.dwLowDateTime=0x5e80eb10, ftLastAccessTime.dwHighDateTime=0x1d5e798, ftLastWriteTime.dwLowDateTime=0x5e80eb10, ftLastWriteTime.dwHighDateTime=0x1d5e798, nFileSizeHigh=0x0, nFileSizeLow=0x22ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="6wbzV22J.pptx", cAlternateFileName="6WBZV2~1.PPT")) returned 1
	[0101.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6wbzV22J.pptx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6wbzV22J.pptx", lpFilePart=0x0) returned 0x35
	[0101.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6wbzV22J.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6wbzv22j.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.568] GetFileType (hFile=0x204) returned 0x1
	[0101.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.568] GetFileType (hFile=0x204) returned 0x1
	[0101.568] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x22ae
	[0101.568] ReadFile (in: hFile=0x204, lpBuffer=0x273dbd4, nNumberOfBytesToRead=0x22ae, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x273dbd4*, lpNumberOfBytesRead=0x26efc4*=0x22ae, lpOverlapped=0x0) returned 1
	[0101.571] CloseHandle (hObject=0x204) returned 1
	[0101.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6wbzV22J.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6wbzV22J.pptx.KEKW", lpFilePart=0x0) returned 0x3a
	[0101.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6wbzV22J.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6wbzv22j.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.573] GetFileType (hFile=0x204) returned 0x1
	[0101.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.573] GetFileType (hFile=0x204) returned 0x1
	[0101.574] WriteFile (in: hFile=0x204, lpBuffer=0x2741550*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2741550*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.576] CloseHandle (hObject=0x204) returned 1
	[0101.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6wbzV22J.pptx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6wbzV22J.pptx", lpFilePart=0x0) returned 0x35
	[0101.577] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6wbzV22J.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6wbzv22j.pptx")) returned 1
	[0101.582] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78bebdc0, ftCreationTime.dwHighDateTime=0x1d5e484, ftLastAccessTime.dwLowDateTime=0x294e2300, ftLastAccessTime.dwHighDateTime=0x1d5e562, ftLastWriteTime.dwLowDateTime=0x294e2300, ftLastWriteTime.dwHighDateTime=0x1d5e562, nFileSizeHigh=0x0, nFileSizeLow=0x4182, dwReserved0=0x0, dwReserved1=0x0, cFileName="CKvdvKV-oh.pptx", cAlternateFileName="CKVDVK~1.PPT")) returned 1
	[0101.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CKvdvKV-oh.pptx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CKvdvKV-oh.pptx", lpFilePart=0x0) returned 0x37
	[0101.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CKvdvKV-oh.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ckvdvkv-oh.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.583] GetFileType (hFile=0x204) returned 0x1
	[0101.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.583] GetFileType (hFile=0x204) returned 0x1
	[0101.583] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x4182
	[0101.584] ReadFile (in: hFile=0x204, lpBuffer=0x2742a24, nNumberOfBytesToRead=0x4182, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x2742a24*, lpNumberOfBytesRead=0x26efc4*=0x4182, lpOverlapped=0x0) returned 1
	[0101.587] CloseHandle (hObject=0x204) returned 1
	[0101.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CKvdvKV-oh.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CKvdvKV-oh.pptx.KEKW", lpFilePart=0x0) returned 0x3c
	[0101.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CKvdvKV-oh.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ckvdvkv-oh.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.588] GetFileType (hFile=0x204) returned 0x1
	[0101.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.589] GetFileType (hFile=0x204) returned 0x1
	[0101.589] WriteFile (in: hFile=0x204, lpBuffer=0x2748280*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2748280*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.592] CloseHandle (hObject=0x204) returned 1
	[0101.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CKvdvKV-oh.pptx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CKvdvKV-oh.pptx", lpFilePart=0x0) returned 0x37
	[0101.592] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CKvdvKV-oh.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ckvdvkv-oh.pptx")) returned 1
	[0101.599] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0101.600] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdab8c150, ftCreationTime.dwHighDateTime=0x1d5b06e, ftLastAccessTime.dwLowDateTime=0xc5efb3f0, ftLastAccessTime.dwHighDateTime=0x1d5aa1a, ftLastWriteTime.dwLowDateTime=0xc5efb3f0, ftLastWriteTime.dwHighDateTime=0x1d5aa1a, nFileSizeHigh=0x0, nFileSizeLow=0x159eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="dUMj7GuNWeG1d50zvU-W.xlsx", cAlternateFileName="DUMJ7G~1.XLS")) returned 1
	[0101.600] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76969890, ftCreationTime.dwHighDateTime=0x1d5d2a7, ftLastAccessTime.dwLowDateTime=0x1d028a00, ftLastAccessTime.dwHighDateTime=0x1d5e4ef, ftLastWriteTime.dwLowDateTime=0x1d028a00, ftLastWriteTime.dwHighDateTime=0x1d5e4ef, nFileSizeHigh=0x0, nFileSizeLow=0x13a8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERZf4Y5RBkSUzVt.xlsx", cAlternateFileName="ERZF4Y~1.XLS")) returned 1
	[0101.600] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x603c000, ftCreationTime.dwHighDateTime=0x1d57d37, ftLastAccessTime.dwLowDateTime=0xc654d720, ftLastAccessTime.dwHighDateTime=0x1d5d969, ftLastWriteTime.dwLowDateTime=0xc654d720, ftLastWriteTime.dwHighDateTime=0x1d5d969, nFileSizeHigh=0x0, nFileSizeLow=0x1868f, dwReserved0=0x0, dwReserved1=0x0, cFileName="f46Ms.docx", cAlternateFileName="F46MS~1.DOC")) returned 1
	[0101.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f46Ms.docx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f46Ms.docx", lpFilePart=0x0) returned 0x32
	[0101.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f46Ms.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f46ms.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.601] GetFileType (hFile=0x204) returned 0x1
	[0101.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.602] GetFileType (hFile=0x204) returned 0x1
	[0101.602] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x1868f
	[0101.603] ReadFile (in: hFile=0x204, lpBuffer=0x36611a0, nNumberOfBytesToRead=0x1868f, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x36611a0*, lpNumberOfBytesRead=0x26efc4*=0x1868f, lpOverlapped=0x0) returned 1
	[0101.610] CloseHandle (hObject=0x204) returned 1
	[0101.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f46Ms.docx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f46Ms.docx.KEKW", lpFilePart=0x0) returned 0x37
	[0101.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f46Ms.docx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f46ms.docx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.612] GetFileType (hFile=0x204) returned 0x1
	[0101.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.612] GetFileType (hFile=0x204) returned 0x1
	[0101.613] WriteFile (in: hFile=0x204, lpBuffer=0x274b7f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x274b7f0*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.616] CloseHandle (hObject=0x204) returned 1
	[0101.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f46Ms.docx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f46Ms.docx", lpFilePart=0x0) returned 0x32
	[0101.616] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\f46Ms.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f46ms.docx")) returned 1
	[0101.624] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3520290, ftCreationTime.dwHighDateTime=0x1d5817f, ftLastAccessTime.dwLowDateTime=0xd1c983b0, ftLastAccessTime.dwHighDateTime=0x1d574a8, ftLastWriteTime.dwLowDateTime=0xd1c983b0, ftLastWriteTime.dwHighDateTime=0x1d574a8, nFileSizeHigh=0x0, nFileSizeLow=0x56d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FIgAgA4hj5B3F2rQ-ow.pptx", cAlternateFileName="FIGAGA~1.PPT")) returned 1
	[0101.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FIgAgA4hj5B3F2rQ-ow.pptx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FIgAgA4hj5B3F2rQ-ow.pptx", lpFilePart=0x0) returned 0x40
	[0101.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FIgAgA4hj5B3F2rQ-ow.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\figaga4hj5b3f2rq-ow.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.625] GetFileType (hFile=0x204) returned 0x1
	[0101.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.625] GetFileType (hFile=0x204) returned 0x1
	[0101.625] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x56d8
	[0101.625] ReadFile (in: hFile=0x204, lpBuffer=0x274cd58, nNumberOfBytesToRead=0x56d8, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x274cd58*, lpNumberOfBytesRead=0x26efc4*=0x56d8, lpOverlapped=0x0) returned 1
	[0101.628] CloseHandle (hObject=0x204) returned 1
	[0101.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FIgAgA4hj5B3F2rQ-ow.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FIgAgA4hj5B3F2rQ-ow.pptx.KEKW", lpFilePart=0x0) returned 0x45
	[0101.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FIgAgA4hj5B3F2rQ-ow.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\figaga4hj5b3f2rq-ow.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.629] GetFileType (hFile=0x204) returned 0x1
	[0101.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.630] GetFileType (hFile=0x204) returned 0x1
	[0101.630] WriteFile (in: hFile=0x204, lpBuffer=0x2753b38*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2753b38*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.633] CloseHandle (hObject=0x204) returned 1
	[0101.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FIgAgA4hj5B3F2rQ-ow.pptx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FIgAgA4hj5B3F2rQ-ow.pptx", lpFilePart=0x0) returned 0x40
	[0101.633] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\FIgAgA4hj5B3F2rQ-ow.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\figaga4hj5b3f2rq-ow.pptx")) returned 1
	[0101.655] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbca1d500, ftCreationTime.dwHighDateTime=0x1d5e5c8, ftLastAccessTime.dwLowDateTime=0xd4be5d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xd4be5d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="f__WJP1S", cAlternateFileName="")) returned 1
	[0101.655] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44334a0, ftCreationTime.dwHighDateTime=0x1d5e026, ftLastAccessTime.dwLowDateTime=0x705449e0, ftLastAccessTime.dwHighDateTime=0x1d5e0cc, ftLastWriteTime.dwLowDateTime=0x705449e0, ftLastWriteTime.dwHighDateTime=0x1d5e0cc, nFileSizeHigh=0x0, nFileSizeLow=0x1132d, dwReserved0=0x0, dwReserved1=0x0, cFileName="g3IGI_8_b20Ns0MOJ9.odt", cAlternateFileName="G3IGI_~1.ODT")) returned 1
	[0101.656] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc1f7c0, ftCreationTime.dwHighDateTime=0x1d5ad15, ftLastAccessTime.dwLowDateTime=0xbdfc7460, ftLastAccessTime.dwHighDateTime=0x1d55b8e, ftLastWriteTime.dwLowDateTime=0xbdfc7460, ftLastWriteTime.dwHighDateTime=0x1d55b8e, nFileSizeHigh=0x0, nFileSizeLow=0x7375, dwReserved0=0x0, dwReserved1=0x0, cFileName="k9pFxS6ebZN.xlsx", cAlternateFileName="K9PFXS~1.XLS")) returned 1
	[0101.656] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6d27f0, ftCreationTime.dwHighDateTime=0x1d5a9bb, ftLastAccessTime.dwLowDateTime=0x96296330, ftLastAccessTime.dwHighDateTime=0x1d5bf3e, ftLastWriteTime.dwLowDateTime=0x96296330, ftLastWriteTime.dwHighDateTime=0x1d5bf3e, nFileSizeHigh=0x0, nFileSizeLow=0xec96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LejfGFmzj3PSoclK1Dyf.xlsx", cAlternateFileName="LEJFGF~1.XLS")) returned 1
	[0101.657] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x818e7900, ftCreationTime.dwHighDateTime=0x1d5ddfd, ftLastAccessTime.dwLowDateTime=0xd5ef0d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xd5ef0d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lssfz5", cAlternateFileName="")) returned 1
	[0101.657] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9be61a0, ftCreationTime.dwHighDateTime=0x1d5dfc9, ftLastAccessTime.dwLowDateTime=0x8af59240, ftLastAccessTime.dwHighDateTime=0x1d5e61c, ftLastWriteTime.dwLowDateTime=0x8af59240, ftLastWriteTime.dwHighDateTime=0x1d5e61c, nFileSizeHigh=0x0, nFileSizeLow=0xfa83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mc9jttJNds c6wX8O-L.rtf", cAlternateFileName="MC9JTT~1.RTF")) returned 1
	[0101.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Mc9jttJNds c6wX8O-L.rtf", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Mc9jttJNds c6wX8O-L.rtf", lpFilePart=0x0) returned 0x3f
	[0101.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Mc9jttJNds c6wX8O-L.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mc9jttjnds c6wx8o-l.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.658] GetFileType (hFile=0x204) returned 0x1
	[0101.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.659] GetFileType (hFile=0x204) returned 0x1
	[0101.659] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xfa83
	[0101.659] ReadFile (in: hFile=0x204, lpBuffer=0x2755d78, nNumberOfBytesToRead=0xfa83, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x2755d78*, lpNumberOfBytesRead=0x26efc4*=0xfa83, lpOverlapped=0x0) returned 1
	[0101.663] CloseHandle (hObject=0x204) returned 1
	[0101.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Mc9jttJNds c6wX8O-L.rtf.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Mc9jttJNds c6wX8O-L.rtf.KEKW", lpFilePart=0x0) returned 0x44
	[0101.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Mc9jttJNds c6wX8O-L.rtf.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mc9jttjnds c6wx8o-l.rtf.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.665] GetFileType (hFile=0x204) returned 0x1
	[0101.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.665] GetFileType (hFile=0x204) returned 0x1
	[0101.665] WriteFile (in: hFile=0x204, lpBuffer=0x2766f04*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2766f04*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.670] CloseHandle (hObject=0x204) returned 1
	[0101.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Mc9jttJNds c6wX8O-L.rtf", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Mc9jttJNds c6wX8O-L.rtf", lpFilePart=0x0) returned 0x3f
	[0101.670] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Mc9jttJNds c6wX8O-L.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mc9jttjnds c6wx8o-l.rtf")) returned 1
	[0101.676] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0101.677] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0101.677] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xd6614f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xd6614f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1
	[0101.678] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0101.679] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bede530, ftCreationTime.dwHighDateTime=0x1d5df9d, ftLastAccessTime.dwLowDateTime=0x19edb100, ftLastAccessTime.dwHighDateTime=0x1d5d94b, ftLastWriteTime.dwLowDateTime=0x19edb100, ftLastWriteTime.dwHighDateTime=0x1d5d94b, nFileSizeHigh=0x0, nFileSizeLow=0x759c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="N28MvGiCVwSz7l-D2f.xlsx", cAlternateFileName="N28MVG~1.XLS")) returned 1
	[0101.679] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xd6ad7b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xd6ad7b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1
	[0101.680] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc381e3f0, ftCreationTime.dwHighDateTime=0x1d5da0c, ftLastAccessTime.dwLowDateTime=0xb5b499d0, ftLastAccessTime.dwHighDateTime=0x1d5dd03, ftLastWriteTime.dwLowDateTime=0xb5b499d0, ftLastWriteTime.dwHighDateTime=0x1d5dd03, nFileSizeHigh=0x0, nFileSizeLow=0x126ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="rHnnn.pps", cAlternateFileName="")) returned 1
	[0101.680] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x266cbf60, ftCreationTime.dwHighDateTime=0x1d573df, ftLastAccessTime.dwLowDateTime=0xab28cc70, ftLastAccessTime.dwHighDateTime=0x1d56f67, ftLastWriteTime.dwLowDateTime=0xab28cc70, ftLastWriteTime.dwHighDateTime=0x1d56f67, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x0, dwReserved1=0x0, cFileName="sgyB7GXPtsnhQSYJ0.pptx", cAlternateFileName="SGYB7G~1.PPT")) returned 1
	[0101.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sgyB7GXPtsnhQSYJ0.pptx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sgyB7GXPtsnhQSYJ0.pptx", lpFilePart=0x0) returned 0x3e
	[0101.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sgyB7GXPtsnhQSYJ0.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sgyb7gxptsnhqsyj0.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.681] GetFileType (hFile=0x204) returned 0x1
	[0101.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.682] GetFileType (hFile=0x204) returned 0x1
	[0101.682] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x3f45
	[0101.682] ReadFile (in: hFile=0x204, lpBuffer=0x276910c, nNumberOfBytesToRead=0x3f45, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x276910c*, lpNumberOfBytesRead=0x26efc4*=0x3f45, lpOverlapped=0x0) returned 1
	[0101.686] CloseHandle (hObject=0x204) returned 1
	[0101.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sgyB7GXPtsnhQSYJ0.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sgyB7GXPtsnhQSYJ0.pptx.KEKW", lpFilePart=0x0) returned 0x43
	[0101.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sgyB7GXPtsnhQSYJ0.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sgyb7gxptsnhqsyj0.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.687] GetFileType (hFile=0x204) returned 0x1
	[0101.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.687] GetFileType (hFile=0x204) returned 0x1
	[0101.688] WriteFile (in: hFile=0x204, lpBuffer=0x276e750*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x276e750*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.691] CloseHandle (hObject=0x204) returned 1
	[0101.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sgyB7GXPtsnhQSYJ0.pptx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sgyB7GXPtsnhQSYJ0.pptx", lpFilePart=0x0) returned 0x3e
	[0101.691] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\sgyB7GXPtsnhQSYJ0.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sgyb7gxptsnhqsyj0.pptx")) returned 1
	[0101.697] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93a1f00, ftCreationTime.dwHighDateTime=0x1d5e4e9, ftLastAccessTime.dwLowDateTime=0x2d8b3a70, ftLastAccessTime.dwHighDateTime=0x1d5e283, ftLastWriteTime.dwLowDateTime=0x2d8b3a70, ftLastWriteTime.dwHighDateTime=0x1d5e283, nFileSizeHigh=0x0, nFileSizeLow=0x12c17, dwReserved0=0x0, dwReserved1=0x0, cFileName="TJowR7p3onxdwUlc.ots", cAlternateFileName="TJOWR7~1.OTS")) returned 1
	[0101.698] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488ba1f0, ftCreationTime.dwHighDateTime=0x1d5acbb, ftLastAccessTime.dwLowDateTime=0x2830ff30, ftLastAccessTime.dwHighDateTime=0x1d5d8a9, ftLastWriteTime.dwLowDateTime=0x2830ff30, ftLastWriteTime.dwHighDateTime=0x1d5d8a9, nFileSizeHigh=0x0, nFileSizeLow=0x5e34, dwReserved0=0x0, dwReserved1=0x0, cFileName="VlDWNqZ9Oy-yQqpS.pptx", cAlternateFileName="VLDWNQ~1.PPT")) returned 1
	[0101.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlDWNqZ9Oy-yQqpS.pptx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlDWNqZ9Oy-yQqpS.pptx", lpFilePart=0x0) returned 0x3d
	[0101.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlDWNqZ9Oy-yQqpS.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vldwnqz9oy-yqqps.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.699] GetFileType (hFile=0x204) returned 0x1
	[0101.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.699] GetFileType (hFile=0x204) returned 0x1
	[0101.700] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x5e34
	[0101.700] ReadFile (in: hFile=0x204, lpBuffer=0x2770020, nNumberOfBytesToRead=0x5e34, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x2770020*, lpNumberOfBytesRead=0x26efc4*=0x5e34, lpOverlapped=0x0) returned 1
	[0101.703] CloseHandle (hObject=0x204) returned 1
	[0101.703] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlDWNqZ9Oy-yQqpS.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlDWNqZ9Oy-yQqpS.pptx.KEKW", lpFilePart=0x0) returned 0x42
	[0101.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlDWNqZ9Oy-yQqpS.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vldwnqz9oy-yqqps.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.704] GetFileType (hFile=0x204) returned 0x1
	[0101.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.705] GetFileType (hFile=0x204) returned 0x1
	[0101.705] WriteFile (in: hFile=0x204, lpBuffer=0x2777550*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2777550*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.708] CloseHandle (hObject=0x204) returned 1
	[0101.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlDWNqZ9Oy-yQqpS.pptx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlDWNqZ9Oy-yQqpS.pptx", lpFilePart=0x0) returned 0x3d
	[0101.708] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlDWNqZ9Oy-yQqpS.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vldwnqz9oy-yqqps.pptx")) returned 1
	[0101.713] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5754fb0, ftCreationTime.dwHighDateTime=0x1d5dcc9, ftLastAccessTime.dwLowDateTime=0xfbcc1f70, ftLastAccessTime.dwHighDateTime=0x1d5cfb0, ftLastWriteTime.dwLowDateTime=0xfbcc1f70, ftLastWriteTime.dwHighDateTime=0x1d5cfb0, nFileSizeHigh=0x0, nFileSizeLow=0x15983, dwReserved0=0x0, dwReserved1=0x0, cFileName="VsMue.docx", cAlternateFileName="VSMUE~1.DOC")) returned 1
	[0101.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VsMue.docx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VsMue.docx", lpFilePart=0x0) returned 0x32
	[0101.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VsMue.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vsmue.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.714] GetFileType (hFile=0x204) returned 0x1
	[0101.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.714] GetFileType (hFile=0x204) returned 0x1
	[0101.714] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x15983
	[0101.716] ReadFile (in: hFile=0x204, lpBuffer=0x3679850, nNumberOfBytesToRead=0x15983, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x3679850*, lpNumberOfBytesRead=0x26efc4*=0x15983, lpOverlapped=0x0) returned 1
	[0101.722] CloseHandle (hObject=0x204) returned 1
	[0101.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VsMue.docx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VsMue.docx.KEKW", lpFilePart=0x0) returned 0x37
	[0101.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VsMue.docx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vsmue.docx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.724] GetFileType (hFile=0x204) returned 0x1
	[0101.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.724] GetFileType (hFile=0x204) returned 0x1
	[0101.725] WriteFile (in: hFile=0x204, lpBuffer=0x277a090*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x277a090*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.727] CloseHandle (hObject=0x204) returned 1
	[0101.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VsMue.docx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VsMue.docx", lpFilePart=0x0) returned 0x32
	[0101.728] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VsMue.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vsmue.docx")) returned 1
	[0101.737] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f3887d0, ftCreationTime.dwHighDateTime=0x1d5c751, ftLastAccessTime.dwLowDateTime=0xc6519710, ftLastAccessTime.dwHighDateTime=0x1d572c4, ftLastWriteTime.dwLowDateTime=0xc6519710, ftLastWriteTime.dwHighDateTime=0x1d572c4, nFileSizeHigh=0x0, nFileSizeLow=0x181de, dwReserved0=0x0, dwReserved1=0x0, cFileName="wUXc6EhnWHZbuYOaWjpH.docx", cAlternateFileName="WUXC6E~1.DOC")) returned 1
	[0101.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wUXc6EhnWHZbuYOaWjpH.docx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wUXc6EhnWHZbuYOaWjpH.docx", lpFilePart=0x0) returned 0x41
	[0101.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wUXc6EhnWHZbuYOaWjpH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wuxc6ehnwhzbuyoawjph.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.738] GetFileType (hFile=0x204) returned 0x1
	[0101.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.738] GetFileType (hFile=0x204) returned 0x1
	[0101.738] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x181de
	[0101.739] ReadFile (in: hFile=0x204, lpBuffer=0x368f1f0, nNumberOfBytesToRead=0x181de, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x368f1f0*, lpNumberOfBytesRead=0x26efc4*=0x181de, lpOverlapped=0x0) returned 1
	[0101.746] CloseHandle (hObject=0x204) returned 1
	[0101.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wUXc6EhnWHZbuYOaWjpH.docx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wUXc6EhnWHZbuYOaWjpH.docx.KEKW", lpFilePart=0x0) returned 0x46
	[0101.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wUXc6EhnWHZbuYOaWjpH.docx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wuxc6ehnwhzbuyoawjph.docx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.750] GetFileType (hFile=0x204) returned 0x1
	[0101.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.750] GetFileType (hFile=0x204) returned 0x1
	[0101.750] WriteFile (in: hFile=0x204, lpBuffer=0x277cd08*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x277cd08*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.753] CloseHandle (hObject=0x204) returned 1
	[0101.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wUXc6EhnWHZbuYOaWjpH.docx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wUXc6EhnWHZbuYOaWjpH.docx", lpFilePart=0x0) returned 0x41
	[0101.754] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\wUXc6EhnWHZbuYOaWjpH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wuxc6ehnwhzbuyoawjph.docx")) returned 1
	[0101.760] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb334ed0, ftCreationTime.dwHighDateTime=0x1d598f7, ftLastAccessTime.dwLowDateTime=0xe7ed5b90, ftLastAccessTime.dwHighDateTime=0x1d57619, ftLastWriteTime.dwLowDateTime=0xe7ed5b90, ftLastWriteTime.dwHighDateTime=0x1d57619, nFileSizeHigh=0x0, nFileSizeLow=0xc2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="XE0 jUKMfFjCtfmBzTF.docx", cAlternateFileName="XE0JUK~1.DOC")) returned 1
	[0101.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XE0 jUKMfFjCtfmBzTF.docx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XE0 jUKMfFjCtfmBzTF.docx", lpFilePart=0x0) returned 0x40
	[0101.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XE0 jUKMfFjCtfmBzTF.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xe0 jukmffjctfmbztf.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.761] GetFileType (hFile=0x204) returned 0x1
	[0101.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.761] GetFileType (hFile=0x204) returned 0x1
	[0101.761] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xc2be
	[0101.762] ReadFile (in: hFile=0x204, lpBuffer=0x277e28c, nNumberOfBytesToRead=0xc2be, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x277e28c*, lpNumberOfBytesRead=0x26efc4*=0xc2be, lpOverlapped=0x0) returned 1
	[0101.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XE0 jUKMfFjCtfmBzTF.docx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XE0 jUKMfFjCtfmBzTF.docx.KEKW", lpFilePart=0x0) returned 0x45
	[0101.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XE0 jUKMfFjCtfmBzTF.docx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xe0 jukmffjctfmbztf.docx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.768] GetFileType (hFile=0x204) returned 0x1
	[0101.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.769] GetFileType (hFile=0x204) returned 0x1
	[0101.769] WriteFile (in: hFile=0x204, lpBuffer=0x278bc54*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x278bc54*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XE0 jUKMfFjCtfmBzTF.docx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XE0 jUKMfFjCtfmBzTF.docx", lpFilePart=0x0) returned 0x40
	[0101.775] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XE0 jUKMfFjCtfmBzTF.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xe0 jukmffjctfmbztf.docx")) returned 1
	[0101.783] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f009690, ftCreationTime.dwHighDateTime=0x1d5d99b, ftLastAccessTime.dwLowDateTime=0x131ede50, ftLastAccessTime.dwHighDateTime=0x1d5e7b3, ftLastWriteTime.dwLowDateTime=0x131ede50, ftLastWriteTime.dwHighDateTime=0x1d5e7b3, nFileSizeHigh=0x0, nFileSizeLow=0x17334, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZhvS4lX.xls", cAlternateFileName="")) returned 1
	[0101.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZhvS4lX.xls", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZhvS4lX.xls", lpFilePart=0x0) returned 0x33
	[0101.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.783] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZhvS4lX.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zhvs4lx.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.784] GetFileType (hFile=0x204) returned 0x1
	[0101.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.784] GetFileType (hFile=0x204) returned 0x1
	[0101.784] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x17334
	[0101.785] ReadFile (in: hFile=0x204, lpBuffer=0x36a73f0, nNumberOfBytesToRead=0x17334, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x36a73f0*, lpNumberOfBytesRead=0x26efc4*=0x17334, lpOverlapped=0x0) returned 1
	[0101.792] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZhvS4lX.xls.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZhvS4lX.xls.KEKW", lpFilePart=0x0) returned 0x38
	[0101.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZhvS4lX.xls.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zhvs4lx.xls.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.794] GetFileType (hFile=0x204) returned 0x1
	[0101.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.794] GetFileType (hFile=0x204) returned 0x1
	[0101.794] WriteFile (in: hFile=0x204, lpBuffer=0x278e784*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x278e784*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZhvS4lX.xls", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZhvS4lX.xls", lpFilePart=0x0) returned 0x33
	[0101.798] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZhvS4lX.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zhvs4lx.xls")) returned 1
	[0101.804] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e11d30, ftCreationTime.dwHighDateTime=0x1d59fb1, ftLastAccessTime.dwLowDateTime=0x1e837210, ftLastAccessTime.dwHighDateTime=0x1d59308, ftLastWriteTime.dwLowDateTime=0x1e837210, ftLastWriteTime.dwHighDateTime=0x1d59308, nFileSizeHigh=0x0, nFileSizeLow=0x15c2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZjW5mk1OGDP3a2UPxB.pptx", cAlternateFileName="ZJW5MK~1.PPT")) returned 1
	[0101.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZjW5mk1OGDP3a2UPxB.pptx", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZjW5mk1OGDP3a2UPxB.pptx", lpFilePart=0x0) returned 0x3f
	[0101.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0101.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZjW5mk1OGDP3a2UPxB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zjw5mk1ogdp3a2upxb.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.805] GetFileType (hFile=0x204) returned 0x1
	[0101.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0101.805] GetFileType (hFile=0x204) returned 0x1
	[0101.805] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x15c2d
	[0101.806] ReadFile (in: hFile=0x204, lpBuffer=0x36be740, nNumberOfBytesToRead=0x15c2d, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x36be740*, lpNumberOfBytesRead=0x26efc4*=0x15c2d, lpOverlapped=0x0) returned 1
	[0101.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZjW5mk1OGDP3a2UPxB.pptx.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZjW5mk1OGDP3a2UPxB.pptx.KEKW", lpFilePart=0x0) returned 0x44
	[0101.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0101.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZjW5mk1OGDP3a2UPxB.pptx.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zjw5mk1ogdp3a2upxb.pptx.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0101.816] GetFileType (hFile=0x204) returned 0x1
	[0101.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0101.816] GetFileType (hFile=0x204) returned 0x1
	[0101.816] WriteFile (in: hFile=0x204, lpBuffer=0x27913d0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x27913d0*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0101.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZjW5mk1OGDP3a2UPxB.pptx", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZjW5mk1OGDP3a2UPxB.pptx", lpFilePart=0x0) returned 0x3f
	[0101.819] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZjW5mk1OGDP3a2UPxB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zjw5mk1ogdp3a2upxb.pptx")) returned 1
	[0101.827] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0101.827] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0101.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0101.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0101.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0101.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0101.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0101.829] GetFileType (hFile=0x200) returned 0x1
	[0101.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0101.829] GetFileType (hFile=0x200) returned 0x1
	[0101.830] WriteFile (in: hFile=0x200, lpBuffer=0x2793a94*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2793a94*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0101.833] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0101.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0101.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27
	[0101.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28
	[0101.833] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0101.834] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.835] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0101.835] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0101.836] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0101.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0101.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0101.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0101.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27
	[0101.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28
	[0101.837] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0101.837] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.838] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0101.838] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0101.839] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0101.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0101.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0101.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0101.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0101.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0101.841] GetFileType (hFile=0x200) returned 0x1
	[0101.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0101.841] GetFileType (hFile=0x200) returned 0x1
	[0101.841] WriteFile (in: hFile=0x200, lpBuffer=0x2797478*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2797478*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0101.844] CloseHandle (hObject=0x200) returned 1
	[0101.844] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0101.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0101.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27
	[0101.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28
	[0101.845] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0101.846] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.847] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0101.847] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0101.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0101.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d
	[0101.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpFilePart=0x0) returned 0x2e
	[0101.848] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0101.849] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.849] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0101.850] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1
	[0101.851] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1
	[0101.851] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0
	[0101.852] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0101.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0101.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0101.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0101.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d
	[0101.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpFilePart=0x0) returned 0x2e
	[0101.853] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0101.854] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0101.854] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0101.855] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1
	[0101.855] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1
	[0102.159] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.160] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0102.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0102.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0102.162] GetFileType (hFile=0x204) returned 0x1
	[0102.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0102.162] GetFileType (hFile=0x204) returned 0x1
	[0102.162] WriteFile (in: hFile=0x204, lpBuffer=0x279c434*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x279c434*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0102.165] CloseHandle (hObject=0x204) returned 1
	[0102.166] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1
	[0102.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0102.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a
	[0102.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x3b
	[0102.167] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0102.215] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.216] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1
	[0102.217] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1
	[0102.217] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1
	[0102.218] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1
	[0102.218] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1
	[0102.219] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0
	[0102.219] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0102.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a
	[0102.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x3b
	[0102.223] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0102.225] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.226] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1
	[0102.226] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1
	[0102.227] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1
	[0102.228] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1
	[0102.228] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1
	[0102.229] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.229] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0102.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0102.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0102.236] GetFileType (hFile=0x204) returned 0x1
	[0102.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0102.236] GetFileType (hFile=0x204) returned 0x1
	[0102.236] WriteFile (in: hFile=0x204, lpBuffer=0x27a1dc4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27a1dc4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0102.240] CloseHandle (hObject=0x204) returned 1
	[0102.240] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1
	[0102.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0102.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34
	[0102.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x35
	[0102.241] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0102.286] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.286] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1
	[0102.287] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1
	[0102.288] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1
	[0102.288] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1
	[0102.289] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1
	[0102.289] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1
	[0102.290] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0
	[0102.290] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0102.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34
	[0102.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x35
	[0102.328] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0102.330] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.331] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1
	[0102.331] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1
	[0102.332] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1
	[0102.332] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1
	[0102.333] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1
	[0102.333] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1
	[0102.334] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.334] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0102.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0102.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0102.342] GetFileType (hFile=0x204) returned 0x1
	[0102.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0102.342] GetFileType (hFile=0x204) returned 0x1
	[0102.342] WriteFile (in: hFile=0x204, lpBuffer=0x27a7668*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27a7668*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0102.346] CloseHandle (hObject=0x204) returned 1
	[0102.346] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1
	[0102.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0102.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34
	[0102.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpFilePart=0x0) returned 0x35
	[0102.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0102.387] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.388] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1
	[0102.388] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1
	[0102.389] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1
	[0102.390] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1
	[0102.390] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0
	[0102.391] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0102.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34
	[0102.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\", lpFilePart=0x0) returned 0x35
	[0102.394] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0102.397] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.398] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1
	[0102.398] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1
	[0102.399] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1
	[0102.399] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1
	[0102.400] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.400] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0102.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0102.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0102.412] GetFileType (hFile=0x204) returned 0x1
	[0102.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0102.412] GetFileType (hFile=0x204) returned 0x1
	[0102.412] WriteFile (in: hFile=0x204, lpBuffer=0x27ac72c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27ac72c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0102.415] CloseHandle (hObject=0x204) returned 1
	[0102.416] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.416] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0102.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0102.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0102.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0102.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27
	[0102.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28
	[0102.417] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0102.418] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.419] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0102.419] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdd5f590, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xdd5f590, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0102.420] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xde1dc70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xde1dc70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1
	[0102.420] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdf28610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xdf28610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1
	[0102.421] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdfc0b90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xdfc0b90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1
	[0102.421] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdfc0b90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xdfc0b90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0
	[0102.422] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0102.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0102.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0102.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0102.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0102.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0102.423] GetFileType (hFile=0x200) returned 0x1
	[0102.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0102.424] GetFileType (hFile=0x200) returned 0x1
	[0102.424] WriteFile (in: hFile=0x200, lpBuffer=0x27afcd4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27afcd4*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0102.427] CloseHandle (hObject=0x200) returned 1
	[0102.427] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0102.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0102.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", lpFilePart=0x0) returned 0x23
	[0102.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpFilePart=0x0) returned 0x24
	[0102.428] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0102.429] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.430] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0102.430] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1
	[0102.431] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1
	[0102.432] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1
	[0102.432] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0
	[0102.433] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0102.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0102.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0102.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0102.433] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", lpFilePart=0x0) returned 0x23
	[0102.434] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpFilePart=0x0) returned 0x24
	[0102.434] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0102.434] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.435] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0102.435] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1
	[0102.436] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1
	[0102.436] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1
	[0102.437] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.437] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0102.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0102.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0102.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0102.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0102.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0102.439] GetFileType (hFile=0x200) returned 0x1
	[0102.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0102.439] GetFileType (hFile=0x200) returned 0x1
	[0102.439] WriteFile (in: hFile=0x200, lpBuffer=0x27b4244*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27b4244*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0102.442] CloseHandle (hObject=0x200) returned 1
	[0102.443] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1
	[0102.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0102.443] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings", lpFilePart=0x0) returned 0x2c
	[0102.443] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\", lpFilePart=0x0) returned 0x2d
	[0102.443] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0102.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0102.448] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda8c0ea0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda8c0ea0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0102.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0102.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23
	[0102.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24
	[0102.451] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda8c0ea0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda8c0ea0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0102.451] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda8c0ea0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda8c0ea0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.452] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf517bc0, ftCreationTime.dwHighDateTime=0x1d5d958, ftLastAccessTime.dwLowDateTime=0x5adc5d10, ftLastAccessTime.dwHighDateTime=0x1d5dab3, ftLastWriteTime.dwLowDateTime=0x5adc5d10, ftLastWriteTime.dwHighDateTime=0x1d5dab3, nFileSizeHigh=0x0, nFileSizeLow=0xe155, dwReserved0=0x0, dwReserved1=0x0, cFileName="5ATSvZKBYa0r.wav", cAlternateFileName="5ATSVZ~1.WAV")) returned 1
	[0102.453] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x241c3d30, ftCreationTime.dwHighDateTime=0x1d5d94c, ftLastAccessTime.dwLowDateTime=0xfb075580, ftLastAccessTime.dwHighDateTime=0x1d5da48, ftLastWriteTime.dwLowDateTime=0xfb075580, ftLastWriteTime.dwHighDateTime=0x1d5da48, nFileSizeHigh=0x0, nFileSizeLow=0x13127, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIPSNu1C.wav", cAlternateFileName="")) returned 1
	[0102.453] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdab1cb00, ftCreationTime.dwHighDateTime=0x1d5dc35, ftLastAccessTime.dwLowDateTime=0xe1fdb5e0, ftLastAccessTime.dwHighDateTime=0x1d5e266, ftLastWriteTime.dwLowDateTime=0xe1fdb5e0, ftLastWriteTime.dwHighDateTime=0x1d5e266, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bWJnkhq1ltM", cAlternateFileName="BWJNKH~1")) returned 1
	[0102.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0102.453] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM", lpFilePart=0x0) returned 0x2f
	[0102.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\", lpFilePart=0x0) returned 0x30
	[0102.454] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdab1cb00, ftCreationTime.dwHighDateTime=0x1d5dc35, ftLastAccessTime.dwLowDateTime=0xe1fdb5e0, ftLastAccessTime.dwHighDateTime=0x1d5e266, ftLastWriteTime.dwLowDateTime=0xe1fdb5e0, ftLastWriteTime.dwHighDateTime=0x1d5e266, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0102.454] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdab1cb00, ftCreationTime.dwHighDateTime=0x1d5dc35, ftLastAccessTime.dwLowDateTime=0xe1fdb5e0, ftLastAccessTime.dwHighDateTime=0x1d5e266, ftLastWriteTime.dwLowDateTime=0xe1fdb5e0, ftLastWriteTime.dwHighDateTime=0x1d5e266, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.455] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x352dbd40, ftCreationTime.dwHighDateTime=0x1d5e6a5, ftLastAccessTime.dwLowDateTime=0xbc2b0910, ftLastAccessTime.dwHighDateTime=0x1d5de4e, ftLastWriteTime.dwLowDateTime=0xbc2b0910, ftLastWriteTime.dwHighDateTime=0x1d5de4e, nFileSizeHigh=0x0, nFileSizeLow=0x1694f, dwReserved0=0x0, dwReserved1=0x0, cFileName="-0tOCMl6X_O.m4a", cAlternateFileName="-0TOCM~1.M4A")) returned 1
	[0102.456] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc74e730, ftCreationTime.dwHighDateTime=0x1d5e74b, ftLastAccessTime.dwLowDateTime=0xd99624d0, ftLastAccessTime.dwHighDateTime=0x1d5de85, ftLastWriteTime.dwLowDateTime=0xd99624d0, ftLastWriteTime.dwHighDateTime=0x1d5de85, nFileSizeHigh=0x0, nFileSizeLow=0x15a4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="4QKrVT1-0vnhvi.wav", cAlternateFileName="4QKRVT~1.WAV")) returned 1
	[0102.456] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2ab740, ftCreationTime.dwHighDateTime=0x1d5dbda, ftLastAccessTime.dwLowDateTime=0xa2edb2a0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa2edb2a0, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xe961, dwReserved0=0x0, dwReserved1=0x0, cFileName="9QaW97EMu.mp3", cAlternateFileName="9QAW97~1.MP3")) returned 1
	[0102.457] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6fa870, ftCreationTime.dwHighDateTime=0x1d5daca, ftLastAccessTime.dwLowDateTime=0xd6cc08f0, ftLastAccessTime.dwHighDateTime=0x1d5e0a1, ftLastWriteTime.dwLowDateTime=0xd6cc08f0, ftLastWriteTime.dwHighDateTime=0x1d5e0a1, nFileSizeHigh=0x0, nFileSizeLow=0x13153, dwReserved0=0x0, dwReserved1=0x0, cFileName="DfLimWlyq2oMAQ.wav", cAlternateFileName="DFLIMW~1.WAV")) returned 1
	[0102.458] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82c59760, ftCreationTime.dwHighDateTime=0x1d5e62a, ftLastAccessTime.dwLowDateTime=0x4b9d04d0, ftLastAccessTime.dwHighDateTime=0x1d5e4db, ftLastWriteTime.dwLowDateTime=0x4b9d04d0, ftLastWriteTime.dwHighDateTime=0x1d5e4db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EGE_KPTyydU18O7nLBW", cAlternateFileName="EGE_KP~1")) returned 1
	[0102.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0102.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW", lpFilePart=0x0) returned 0x43
	[0102.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW\\", lpFilePart=0x0) returned 0x44
	[0102.458] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82c59760, ftCreationTime.dwHighDateTime=0x1d5e62a, ftLastAccessTime.dwLowDateTime=0x4b9d04d0, ftLastAccessTime.dwHighDateTime=0x1d5e4db, ftLastWriteTime.dwLowDateTime=0x4b9d04d0, ftLastWriteTime.dwHighDateTime=0x1d5e4db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0102.459] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82c59760, ftCreationTime.dwHighDateTime=0x1d5e62a, ftLastAccessTime.dwLowDateTime=0x4b9d04d0, ftLastAccessTime.dwHighDateTime=0x1d5e4db, ftLastWriteTime.dwLowDateTime=0x4b9d04d0, ftLastWriteTime.dwHighDateTime=0x1d5e4db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.460] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82c59760, ftCreationTime.dwHighDateTime=0x1d5e62a, ftLastAccessTime.dwLowDateTime=0x4b9d04d0, ftLastAccessTime.dwHighDateTime=0x1d5e4db, ftLastWriteTime.dwLowDateTime=0x4b9d04d0, ftLastWriteTime.dwHighDateTime=0x1d5e4db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0102.460] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0102.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0102.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0102.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0102.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW", lpFilePart=0x0) returned 0x43
	[0102.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW\\", lpFilePart=0x0) returned 0x44
	[0102.461] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82c59760, ftCreationTime.dwHighDateTime=0x1d5e62a, ftLastAccessTime.dwLowDateTime=0x4b9d04d0, ftLastAccessTime.dwHighDateTime=0x1d5e4db, ftLastWriteTime.dwLowDateTime=0x4b9d04d0, ftLastWriteTime.dwHighDateTime=0x1d5e4db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0102.462] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82c59760, ftCreationTime.dwHighDateTime=0x1d5e62a, ftLastAccessTime.dwLowDateTime=0x4b9d04d0, ftLastAccessTime.dwHighDateTime=0x1d5e4db, ftLastWriteTime.dwLowDateTime=0x4b9d04d0, ftLastWriteTime.dwHighDateTime=0x1d5e4db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.463] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82c59760, ftCreationTime.dwHighDateTime=0x1d5e62a, ftLastAccessTime.dwLowDateTime=0x4b9d04d0, ftLastAccessTime.dwHighDateTime=0x1d5e4db, ftLastWriteTime.dwLowDateTime=0x4b9d04d0, ftLastWriteTime.dwHighDateTime=0x1d5e4db, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0102.463] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0102.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0102.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0102.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0102.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0102.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\EGE_KPTyydU18O7nLBW\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\ege_kptyydu18o7nlbw\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0102.532] GetFileType (hFile=0x208) returned 0x1
	[0102.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0102.532] GetFileType (hFile=0x208) returned 0x1
	[0102.532] WriteFile (in: hFile=0x208, lpBuffer=0x27ba25c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27ba25c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0102.535] CloseHandle (hObject=0x208) returned 1
	[0102.536] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61973b90, ftCreationTime.dwHighDateTime=0x1d5dcff, ftLastAccessTime.dwLowDateTime=0x6c9df3c0, ftLastAccessTime.dwHighDateTime=0x1d5df7b, ftLastWriteTime.dwLowDateTime=0x6c9df3c0, ftLastWriteTime.dwHighDateTime=0x1d5df7b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sfCIPM_LIy8Lq5LU", cAlternateFileName="SFCIPM~1")) returned 1
	[0102.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0102.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU", lpFilePart=0x0) returned 0x40
	[0102.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\", lpFilePart=0x0) returned 0x41
	[0102.537] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61973b90, ftCreationTime.dwHighDateTime=0x1d5dcff, ftLastAccessTime.dwLowDateTime=0x6c9df3c0, ftLastAccessTime.dwHighDateTime=0x1d5df7b, ftLastWriteTime.dwLowDateTime=0x6c9df3c0, ftLastWriteTime.dwHighDateTime=0x1d5df7b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0102.537] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61973b90, ftCreationTime.dwHighDateTime=0x1d5dcff, ftLastAccessTime.dwLowDateTime=0x6c9df3c0, ftLastAccessTime.dwHighDateTime=0x1d5df7b, ftLastWriteTime.dwLowDateTime=0x6c9df3c0, ftLastWriteTime.dwHighDateTime=0x1d5df7b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.538] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6574f80, ftCreationTime.dwHighDateTime=0x1d5de96, ftLastAccessTime.dwLowDateTime=0x5d38e9d0, ftLastAccessTime.dwHighDateTime=0x1d5e2fa, ftLastWriteTime.dwLowDateTime=0x5d38e9d0, ftLastWriteTime.dwHighDateTime=0x1d5e2fa, nFileSizeHigh=0x0, nFileSizeLow=0x13722, dwReserved0=0x0, dwReserved1=0x0, cFileName="aMZT3umQu3jdRLHXHUh.m4a", cAlternateFileName="AMZT3U~1.M4A")) returned 1
	[0102.539] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d993d30, ftCreationTime.dwHighDateTime=0x1d5dc67, ftLastAccessTime.dwLowDateTime=0x915d420, ftLastAccessTime.dwHighDateTime=0x1d5ddf1, ftLastWriteTime.dwLowDateTime=0x915d420, ftLastWriteTime.dwHighDateTime=0x1d5ddf1, nFileSizeHigh=0x0, nFileSizeLow=0x14fe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eFDj7L0 SsxG6nP36.wav", cAlternateFileName="EFDJ7L~1.WAV")) returned 1
	[0102.539] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96a03670, ftCreationTime.dwHighDateTime=0x1d5dd72, ftLastAccessTime.dwLowDateTime=0xb56b2800, ftLastAccessTime.dwHighDateTime=0x1d5d811, ftLastWriteTime.dwLowDateTime=0xb56b2800, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x9d5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NJUBRNXaxoXCEWF.m4a", cAlternateFileName="NJUBRN~1.M4A")) returned 1
	[0102.540] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72d97750, ftCreationTime.dwHighDateTime=0x1d5d93b, ftLastAccessTime.dwLowDateTime=0xe727480, ftLastAccessTime.dwHighDateTime=0x1d5da92, ftLastWriteTime.dwLowDateTime=0xe727480, ftLastWriteTime.dwHighDateTime=0x1d5da92, nFileSizeHigh=0x0, nFileSizeLow=0x18dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="tPXps8I9yGOpj_Dk.mp3", cAlternateFileName="TPXPS8~1.MP3")) returned 1
	[0102.541] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a96e350, ftCreationTime.dwHighDateTime=0x1d5e5c2, ftLastAccessTime.dwLowDateTime=0x46d1260, ftLastAccessTime.dwHighDateTime=0x1d5d8a8, ftLastWriteTime.dwLowDateTime=0x46d1260, ftLastWriteTime.dwHighDateTime=0x1d5d8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WJNv", cAlternateFileName="")) returned 1
	[0102.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0102.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv", lpFilePart=0x0) returned 0x45
	[0102.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\", lpFilePart=0x0) returned 0x46
	[0102.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a96e350, ftCreationTime.dwHighDateTime=0x1d5e5c2, ftLastAccessTime.dwLowDateTime=0x46d1260, ftLastAccessTime.dwHighDateTime=0x1d5d8a8, ftLastWriteTime.dwLowDateTime=0x46d1260, ftLastWriteTime.dwHighDateTime=0x1d5d8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0102.543] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a96e350, ftCreationTime.dwHighDateTime=0x1d5e5c2, ftLastAccessTime.dwLowDateTime=0x46d1260, ftLastAccessTime.dwHighDateTime=0x1d5d8a8, ftLastWriteTime.dwLowDateTime=0x46d1260, ftLastWriteTime.dwHighDateTime=0x1d5d8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.543] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2256260, ftCreationTime.dwHighDateTime=0x1d5d7b5, ftLastAccessTime.dwLowDateTime=0x9f024030, ftLastAccessTime.dwHighDateTime=0x1d5e27a, ftLastWriteTime.dwLowDateTime=0x9f024030, ftLastWriteTime.dwHighDateTime=0x1d5e27a, nFileSizeHigh=0x0, nFileSizeLow=0x965f, dwReserved0=0x0, dwReserved1=0x0, cFileName="93VETuB1V.m4a", cAlternateFileName="93VETU~1.M4A")) returned 1
	[0102.544] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad71500, ftCreationTime.dwHighDateTime=0x1d5df16, ftLastAccessTime.dwLowDateTime=0x49d88120, ftLastAccessTime.dwHighDateTime=0x1d5e0ac, ftLastWriteTime.dwLowDateTime=0x49d88120, ftLastWriteTime.dwHighDateTime=0x1d5e0ac, nFileSizeHigh=0x0, nFileSizeLow=0x4e4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="jWWmmpMWfj.wav", cAlternateFileName="JWWMMP~1.WAV")) returned 1
	[0102.545] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd43c1d0, ftCreationTime.dwHighDateTime=0x1d5dfa9, ftLastAccessTime.dwLowDateTime=0x977b1ff0, ftLastAccessTime.dwHighDateTime=0x1d5e52f, ftLastWriteTime.dwLowDateTime=0x977b1ff0, ftLastWriteTime.dwHighDateTime=0x1d5e52f, nFileSizeHigh=0x0, nFileSizeLow=0x10206, dwReserved0=0x0, dwReserved1=0x0, cFileName="_pSkRz9NbK84G4zwY.mp3", cAlternateFileName="_PSKRZ~1.MP3")) returned 1
	[0102.545] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd43c1d0, ftCreationTime.dwHighDateTime=0x1d5dfa9, ftLastAccessTime.dwLowDateTime=0x977b1ff0, ftLastAccessTime.dwHighDateTime=0x1d5e52f, ftLastWriteTime.dwLowDateTime=0x977b1ff0, ftLastWriteTime.dwHighDateTime=0x1d5e52f, nFileSizeHigh=0x0, nFileSizeLow=0x10206, dwReserved0=0x0, dwReserved1=0x0, cFileName="_pSkRz9NbK84G4zwY.mp3", cAlternateFileName="_PSKRZ~1.MP3")) returned 0
	[0102.546] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0102.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0102.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0102.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0102.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv", lpFilePart=0x0) returned 0x45
	[0102.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\", lpFilePart=0x0) returned 0x46
	[0102.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a96e350, ftCreationTime.dwHighDateTime=0x1d5e5c2, ftLastAccessTime.dwLowDateTime=0x46d1260, ftLastAccessTime.dwHighDateTime=0x1d5d8a8, ftLastWriteTime.dwLowDateTime=0x46d1260, ftLastWriteTime.dwHighDateTime=0x1d5d8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0102.547] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a96e350, ftCreationTime.dwHighDateTime=0x1d5e5c2, ftLastAccessTime.dwLowDateTime=0x46d1260, ftLastAccessTime.dwHighDateTime=0x1d5d8a8, ftLastWriteTime.dwLowDateTime=0x46d1260, ftLastWriteTime.dwHighDateTime=0x1d5d8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.548] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2256260, ftCreationTime.dwHighDateTime=0x1d5d7b5, ftLastAccessTime.dwLowDateTime=0x9f024030, ftLastAccessTime.dwHighDateTime=0x1d5e27a, ftLastWriteTime.dwLowDateTime=0x9f024030, ftLastWriteTime.dwHighDateTime=0x1d5e27a, nFileSizeHigh=0x0, nFileSizeLow=0x965f, dwReserved0=0x0, dwReserved1=0x0, cFileName="93VETuB1V.m4a", cAlternateFileName="93VETU~1.M4A")) returned 1
	[0102.548] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad71500, ftCreationTime.dwHighDateTime=0x1d5df16, ftLastAccessTime.dwLowDateTime=0x49d88120, ftLastAccessTime.dwHighDateTime=0x1d5e0ac, ftLastWriteTime.dwLowDateTime=0x49d88120, ftLastWriteTime.dwHighDateTime=0x1d5e0ac, nFileSizeHigh=0x0, nFileSizeLow=0x4e4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="jWWmmpMWfj.wav", cAlternateFileName="JWWMMP~1.WAV")) returned 1
	[0102.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\jWWmmpMWfj.wav", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\jWWmmpMWfj.wav", lpFilePart=0x0) returned 0x54
	[0102.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0102.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\jWWmmpMWfj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\wjnv\\jwwmmpmwfj.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0102.549] GetFileType (hFile=0x224) returned 0x1
	[0102.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0102.549] GetFileType (hFile=0x224) returned 0x1
	[0102.550] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x4e4d
	[0102.550] ReadFile (in: hFile=0x224, lpBuffer=0x27beb48, nNumberOfBytesToRead=0x4e4d, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27beb48*, lpNumberOfBytesRead=0x26ede4*=0x4e4d, lpOverlapped=0x0) returned 1
	[0102.553] CloseHandle (hObject=0x224) returned 1
	[0102.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\jWWmmpMWfj.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\jWWmmpMWfj.wav.KEKW", lpFilePart=0x0) returned 0x59
	[0102.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0102.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\jWWmmpMWfj.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\wjnv\\jwwmmpmwfj.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0102.555] GetFileType (hFile=0x224) returned 0x1
	[0102.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0102.555] GetFileType (hFile=0x224) returned 0x1
	[0102.555] WriteFile (in: hFile=0x224, lpBuffer=0x27c50dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27c50dc*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0102.561] CloseHandle (hObject=0x224) returned 1
	[0102.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\jWWmmpMWfj.wav", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\jWWmmpMWfj.wav", lpFilePart=0x0) returned 0x54
	[0102.561] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\jWWmmpMWfj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\wjnv\\jwwmmpmwfj.wav")) returned 1
	[0102.565] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd43c1d0, ftCreationTime.dwHighDateTime=0x1d5dfa9, ftLastAccessTime.dwLowDateTime=0x977b1ff0, ftLastAccessTime.dwHighDateTime=0x1d5e52f, ftLastWriteTime.dwLowDateTime=0x977b1ff0, ftLastWriteTime.dwHighDateTime=0x1d5e52f, nFileSizeHigh=0x0, nFileSizeLow=0x10206, dwReserved0=0x0, dwReserved1=0x0, cFileName="_pSkRz9NbK84G4zwY.mp3", cAlternateFileName="_PSKRZ~1.MP3")) returned 1
	[0102.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\_pSkRz9NbK84G4zwY.mp3", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\_pSkRz9NbK84G4zwY.mp3", lpFilePart=0x0) returned 0x5b
	[0102.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0102.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\_pSkRz9NbK84G4zwY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\wjnv\\_pskrz9nbk84g4zwy.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0102.566] GetFileType (hFile=0x224) returned 0x1
	[0102.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0102.566] GetFileType (hFile=0x224) returned 0x1
	[0102.566] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x10206
	[0102.567] ReadFile (in: hFile=0x224, lpBuffer=0x27c67b0, nNumberOfBytesToRead=0x10206, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27c67b0*, lpNumberOfBytesRead=0x26ede4*=0x10206, lpOverlapped=0x0) returned 1
	[0102.571] CloseHandle (hObject=0x224) returned 1
	[0102.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\_pSkRz9NbK84G4zwY.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\_pSkRz9NbK84G4zwY.mp3.KEKW", lpFilePart=0x0) returned 0x60
	[0102.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0102.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\_pSkRz9NbK84G4zwY.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\wjnv\\_pskrz9nbk84g4zwy.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0102.572] GetFileType (hFile=0x224) returned 0x1
	[0102.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0102.572] GetFileType (hFile=0x224) returned 0x1
	[0102.573] WriteFile (in: hFile=0x224, lpBuffer=0x27d812c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27d812c*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0102.576] CloseHandle (hObject=0x224) returned 1
	[0102.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\_pSkRz9NbK84G4zwY.mp3", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\_pSkRz9NbK84G4zwY.mp3", lpFilePart=0x0) returned 0x5b
	[0102.576] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\_pSkRz9NbK84G4zwY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\wjnv\\_pskrz9nbk84g4zwy.mp3")) returned 1
	[0102.581] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.581] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0102.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0102.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0102.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0102.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0102.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\WJNv\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\wjnv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0102.583] GetFileType (hFile=0x220) returned 0x1
	[0102.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0102.583] GetFileType (hFile=0x220) returned 0x1
	[0102.583] WriteFile (in: hFile=0x220, lpBuffer=0x27da8a0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27da8a0*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0102.586] CloseHandle (hObject=0x220) returned 1
	[0102.586] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.587] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0102.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0102.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0102.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0102.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU", lpFilePart=0x0) returned 0x40
	[0102.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\", lpFilePart=0x0) returned 0x41
	[0102.588] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61973b90, ftCreationTime.dwHighDateTime=0x1d5dcff, ftLastAccessTime.dwLowDateTime=0x6c9df3c0, ftLastAccessTime.dwHighDateTime=0x1d5df7b, ftLastWriteTime.dwLowDateTime=0x6c9df3c0, ftLastWriteTime.dwHighDateTime=0x1d5df7b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0102.589] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61973b90, ftCreationTime.dwHighDateTime=0x1d5dcff, ftLastAccessTime.dwLowDateTime=0x6c9df3c0, ftLastAccessTime.dwHighDateTime=0x1d5df7b, ftLastWriteTime.dwLowDateTime=0x6c9df3c0, ftLastWriteTime.dwHighDateTime=0x1d5df7b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.590] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6574f80, ftCreationTime.dwHighDateTime=0x1d5de96, ftLastAccessTime.dwLowDateTime=0x5d38e9d0, ftLastAccessTime.dwHighDateTime=0x1d5e2fa, ftLastWriteTime.dwLowDateTime=0x5d38e9d0, ftLastWriteTime.dwHighDateTime=0x1d5e2fa, nFileSizeHigh=0x0, nFileSizeLow=0x13722, dwReserved0=0x0, dwReserved1=0x0, cFileName="aMZT3umQu3jdRLHXHUh.m4a", cAlternateFileName="AMZT3U~1.M4A")) returned 1
	[0102.590] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d993d30, ftCreationTime.dwHighDateTime=0x1d5dc67, ftLastAccessTime.dwLowDateTime=0x915d420, ftLastAccessTime.dwHighDateTime=0x1d5ddf1, ftLastWriteTime.dwLowDateTime=0x915d420, ftLastWriteTime.dwHighDateTime=0x1d5ddf1, nFileSizeHigh=0x0, nFileSizeLow=0x14fe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eFDj7L0 SsxG6nP36.wav", cAlternateFileName="EFDJ7L~1.WAV")) returned 1
	[0102.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\eFDj7L0 SsxG6nP36.wav", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\eFDj7L0 SsxG6nP36.wav", lpFilePart=0x0) returned 0x56
	[0102.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0102.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\eFDj7L0 SsxG6nP36.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\efdj7l0 ssxg6np36.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0102.591] GetFileType (hFile=0x220) returned 0x1
	[0102.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0102.591] GetFileType (hFile=0x220) returned 0x1
	[0102.592] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x14fe5
	[0102.593] ReadFile (in: hFile=0x220, lpBuffer=0x36d4390, nNumberOfBytesToRead=0x14fe5, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x36d4390*, lpNumberOfBytesRead=0x26ee84*=0x14fe5, lpOverlapped=0x0) returned 1
	[0102.602] CloseHandle (hObject=0x220) returned 1
	[0102.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\eFDj7L0 SsxG6nP36.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\eFDj7L0 SsxG6nP36.wav.KEKW", lpFilePart=0x0) returned 0x5b
	[0102.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0102.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\eFDj7L0 SsxG6nP36.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\efdj7l0 ssxg6np36.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0102.612] GetFileType (hFile=0x220) returned 0x1
	[0102.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0102.612] GetFileType (hFile=0x220) returned 0x1
	[0102.613] WriteFile (in: hFile=0x220, lpBuffer=0x25dedac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x25dedac*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0102.616] CloseHandle (hObject=0x220) returned 1
	[0102.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\eFDj7L0 SsxG6nP36.wav", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\eFDj7L0 SsxG6nP36.wav", lpFilePart=0x0) returned 0x56
	[0102.617] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\eFDj7L0 SsxG6nP36.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\efdj7l0 ssxg6np36.wav")) returned 1
	[0102.621] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96a03670, ftCreationTime.dwHighDateTime=0x1d5dd72, ftLastAccessTime.dwLowDateTime=0xb56b2800, ftLastAccessTime.dwHighDateTime=0x1d5d811, ftLastWriteTime.dwLowDateTime=0xb56b2800, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x9d5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NJUBRNXaxoXCEWF.m4a", cAlternateFileName="NJUBRN~1.M4A")) returned 1
	[0102.622] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72d97750, ftCreationTime.dwHighDateTime=0x1d5d93b, ftLastAccessTime.dwLowDateTime=0xe727480, ftLastAccessTime.dwHighDateTime=0x1d5da92, ftLastWriteTime.dwLowDateTime=0xe727480, ftLastWriteTime.dwHighDateTime=0x1d5da92, nFileSizeHigh=0x0, nFileSizeLow=0x18dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="tPXps8I9yGOpj_Dk.mp3", cAlternateFileName="TPXPS8~1.MP3")) returned 1
	[0102.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\tPXps8I9yGOpj_Dk.mp3", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\tPXps8I9yGOpj_Dk.mp3", lpFilePart=0x0) returned 0x55
	[0102.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0102.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\tPXps8I9yGOpj_Dk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\tpxps8i9ygopj_dk.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0102.623] GetFileType (hFile=0x220) returned 0x1
	[0102.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0102.623] GetFileType (hFile=0x220) returned 0x1
	[0102.623] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x18dca
	[0102.624] ReadFile (in: hFile=0x220, lpBuffer=0x36e9398, nNumberOfBytesToRead=0x18dca, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x36e9398*, lpNumberOfBytesRead=0x26ee84*=0x18dca, lpOverlapped=0x0) returned 1
	[0102.631] CloseHandle (hObject=0x220) returned 1
	[0102.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\tPXps8I9yGOpj_Dk.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\tPXps8I9yGOpj_Dk.mp3.KEKW", lpFilePart=0x0) returned 0x5a
	[0102.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0102.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\tPXps8I9yGOpj_Dk.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\tpxps8i9ygopj_dk.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0102.632] GetFileType (hFile=0x220) returned 0x1
	[0102.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0102.633] GetFileType (hFile=0x220) returned 0x1
	[0102.633] WriteFile (in: hFile=0x220, lpBuffer=0x25e1ffc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x25e1ffc*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0102.636] CloseHandle (hObject=0x220) returned 1
	[0102.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\tPXps8I9yGOpj_Dk.mp3", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\tPXps8I9yGOpj_Dk.mp3", lpFilePart=0x0) returned 0x55
	[0102.636] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\tPXps8I9yGOpj_Dk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\tpxps8i9ygopj_dk.mp3")) returned 1
	[0102.642] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a96e350, ftCreationTime.dwHighDateTime=0x1d5e5c2, ftLastAccessTime.dwLowDateTime=0xe163ab0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xe163ab0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WJNv", cAlternateFileName="")) returned 1
	[0102.642] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a96e350, ftCreationTime.dwHighDateTime=0x1d5e5c2, ftLastAccessTime.dwLowDateTime=0xe163ab0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xe163ab0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WJNv", cAlternateFileName="")) returned 0
	[0102.642] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0102.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0102.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0102.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0102.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0102.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\sfCIPM_LIy8Lq5LU\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\sfcipm_liy8lq5lu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0102.644] GetFileType (hFile=0x208) returned 0x1
	[0102.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0102.644] GetFileType (hFile=0x208) returned 0x1
	[0102.644] WriteFile (in: hFile=0x208, lpBuffer=0x25e48c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x25e48c8*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0102.647] CloseHandle (hObject=0x208) returned 1
	[0102.648] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b7c4c0, ftCreationTime.dwHighDateTime=0x1d5e773, ftLastAccessTime.dwLowDateTime=0x34df1730, ftLastAccessTime.dwHighDateTime=0x1d5e0f6, ftLastWriteTime.dwLowDateTime=0x34df1730, ftLastWriteTime.dwHighDateTime=0x1d5e0f6, nFileSizeHigh=0x0, nFileSizeLow=0x9884, dwReserved0=0x0, dwReserved1=0x0, cFileName="V jPG3Sj.wav", cAlternateFileName="VJPG3S~1.WAV")) returned 1
	[0102.648] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b7c4c0, ftCreationTime.dwHighDateTime=0x1d5e773, ftLastAccessTime.dwLowDateTime=0x34df1730, ftLastAccessTime.dwHighDateTime=0x1d5e0f6, ftLastWriteTime.dwLowDateTime=0x34df1730, ftLastWriteTime.dwHighDateTime=0x1d5e0f6, nFileSizeHigh=0x0, nFileSizeLow=0x9884, dwReserved0=0x0, dwReserved1=0x0, cFileName="V jPG3Sj.wav", cAlternateFileName="VJPG3S~1.WAV")) returned 0
	[0102.649] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0102.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM", lpFilePart=0x0) returned 0x2f
	[0102.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\", lpFilePart=0x0) returned 0x30
	[0102.650] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdab1cb00, ftCreationTime.dwHighDateTime=0x1d5dc35, ftLastAccessTime.dwLowDateTime=0xe1fdb5e0, ftLastAccessTime.dwHighDateTime=0x1d5e266, ftLastWriteTime.dwLowDateTime=0xe1fdb5e0, ftLastWriteTime.dwHighDateTime=0x1d5e266, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0102.650] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdab1cb00, ftCreationTime.dwHighDateTime=0x1d5dc35, ftLastAccessTime.dwLowDateTime=0xe1fdb5e0, ftLastAccessTime.dwHighDateTime=0x1d5e266, ftLastWriteTime.dwLowDateTime=0xe1fdb5e0, ftLastWriteTime.dwHighDateTime=0x1d5e266, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.664] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x352dbd40, ftCreationTime.dwHighDateTime=0x1d5e6a5, ftLastAccessTime.dwLowDateTime=0xbc2b0910, ftLastAccessTime.dwHighDateTime=0x1d5de4e, ftLastWriteTime.dwLowDateTime=0xbc2b0910, ftLastWriteTime.dwHighDateTime=0x1d5de4e, nFileSizeHigh=0x0, nFileSizeLow=0x1694f, dwReserved0=0x0, dwReserved1=0x0, cFileName="-0tOCMl6X_O.m4a", cAlternateFileName="-0TOCM~1.M4A")) returned 1
	[0102.665] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc74e730, ftCreationTime.dwHighDateTime=0x1d5e74b, ftLastAccessTime.dwLowDateTime=0xd99624d0, ftLastAccessTime.dwHighDateTime=0x1d5de85, ftLastWriteTime.dwLowDateTime=0xd99624d0, ftLastWriteTime.dwHighDateTime=0x1d5de85, nFileSizeHigh=0x0, nFileSizeLow=0x15a4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="4QKrVT1-0vnhvi.wav", cAlternateFileName="4QKRVT~1.WAV")) returned 1
	[0102.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\4QKrVT1-0vnhvi.wav", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\4QKrVT1-0vnhvi.wav", lpFilePart=0x0) returned 0x42
	[0102.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0102.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\4QKrVT1-0vnhvi.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\4qkrvt1-0vnhvi.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.666] GetFileType (hFile=0x208) returned 0x1
	[0102.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0102.666] GetFileType (hFile=0x208) returned 0x1
	[0102.666] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x15a4c
	[0102.668] ReadFile (in: hFile=0x208, lpBuffer=0x3702180, nNumberOfBytesToRead=0x15a4c, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x3702180*, lpNumberOfBytesRead=0x26ef24*=0x15a4c, lpOverlapped=0x0) returned 1
	[0102.674] CloseHandle (hObject=0x208) returned 1
	[0102.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\4QKrVT1-0vnhvi.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\4QKrVT1-0vnhvi.wav.KEKW", lpFilePart=0x0) returned 0x47
	[0102.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0102.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\4QKrVT1-0vnhvi.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\4qkrvt1-0vnhvi.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.676] GetFileType (hFile=0x208) returned 0x1
	[0102.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0102.676] GetFileType (hFile=0x208) returned 0x1
	[0102.677] WriteFile (in: hFile=0x208, lpBuffer=0x25e8210*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25e8210*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0102.680] CloseHandle (hObject=0x208) returned 1
	[0102.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\4QKrVT1-0vnhvi.wav", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\4QKrVT1-0vnhvi.wav", lpFilePart=0x0) returned 0x42
	[0102.680] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\4QKrVT1-0vnhvi.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\4qkrvt1-0vnhvi.wav")) returned 1
	[0102.686] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2ab740, ftCreationTime.dwHighDateTime=0x1d5dbda, ftLastAccessTime.dwLowDateTime=0xa2edb2a0, ftLastAccessTime.dwHighDateTime=0x1d5e1b3, ftLastWriteTime.dwLowDateTime=0xa2edb2a0, ftLastWriteTime.dwHighDateTime=0x1d5e1b3, nFileSizeHigh=0x0, nFileSizeLow=0xe961, dwReserved0=0x0, dwReserved1=0x0, cFileName="9QaW97EMu.mp3", cAlternateFileName="9QAW97~1.MP3")) returned 1
	[0102.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\9QaW97EMu.mp3", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\9QaW97EMu.mp3", lpFilePart=0x0) returned 0x3d
	[0102.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0102.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\9QaW97EMu.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\9qaw97emu.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.687] GetFileType (hFile=0x208) returned 0x1
	[0102.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0102.687] GetFileType (hFile=0x208) returned 0x1
	[0102.687] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xe961
	[0102.688] ReadFile (in: hFile=0x208, lpBuffer=0x25e9738, nNumberOfBytesToRead=0xe961, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x25e9738*, lpNumberOfBytesRead=0x26ef24*=0xe961, lpOverlapped=0x0) returned 1
	[0102.692] CloseHandle (hObject=0x208) returned 1
	[0102.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\9QaW97EMu.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\9QaW97EMu.mp3.KEKW", lpFilePart=0x0) returned 0x42
	[0102.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0102.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\9QaW97EMu.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\9qaw97emu.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.693] GetFileType (hFile=0x208) returned 0x1
	[0102.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0102.693] GetFileType (hFile=0x208) returned 0x1
	[0102.694] WriteFile (in: hFile=0x208, lpBuffer=0x25f9788*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25f9788*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0102.697] CloseHandle (hObject=0x208) returned 1
	[0102.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\9QaW97EMu.mp3", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\9QaW97EMu.mp3", lpFilePart=0x0) returned 0x3d
	[0102.697] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\9QaW97EMu.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\9qaw97emu.mp3")) returned 1
	[0102.707] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6fa870, ftCreationTime.dwHighDateTime=0x1d5daca, ftLastAccessTime.dwLowDateTime=0xd6cc08f0, ftLastAccessTime.dwHighDateTime=0x1d5e0a1, ftLastWriteTime.dwLowDateTime=0xd6cc08f0, ftLastWriteTime.dwHighDateTime=0x1d5e0a1, nFileSizeHigh=0x0, nFileSizeLow=0x13153, dwReserved0=0x0, dwReserved1=0x0, cFileName="DfLimWlyq2oMAQ.wav", cAlternateFileName="DFLIMW~1.WAV")) returned 1
	[0102.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\DfLimWlyq2oMAQ.wav", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\DfLimWlyq2oMAQ.wav", lpFilePart=0x0) returned 0x42
	[0102.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0102.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\DfLimWlyq2oMAQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\dflimwlyq2omaq.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.708] GetFileType (hFile=0x208) returned 0x1
	[0102.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0102.708] GetFileType (hFile=0x208) returned 0x1
	[0102.709] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x13153
	[0102.709] ReadFile (in: hFile=0x208, lpBuffer=0x25fad00, nNumberOfBytesToRead=0x13153, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x25fad00*, lpNumberOfBytesRead=0x26ef24*=0x13153, lpOverlapped=0x0) returned 1
	[0102.713] CloseHandle (hObject=0x208) returned 1
	[0102.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\DfLimWlyq2oMAQ.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\DfLimWlyq2oMAQ.wav.KEKW", lpFilePart=0x0) returned 0x47
	[0102.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0102.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\DfLimWlyq2oMAQ.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\dflimwlyq2omaq.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.714] GetFileType (hFile=0x208) returned 0x1
	[0102.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0102.715] GetFileType (hFile=0x208) returned 0x1
	[0102.721] WriteFile (in: hFile=0x208, lpBuffer=0x260f558*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x260f558*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0102.724] CloseHandle (hObject=0x208) returned 1
	[0102.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\DfLimWlyq2oMAQ.wav", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\DfLimWlyq2oMAQ.wav", lpFilePart=0x0) returned 0x42
	[0102.724] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\DfLimWlyq2oMAQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\dflimwlyq2omaq.wav")) returned 1
	[0102.729] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82c59760, ftCreationTime.dwHighDateTime=0x1d5e62a, ftLastAccessTime.dwLowDateTime=0xe0f1690, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xe0f1690, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EGE_KPTyydU18O7nLBW", cAlternateFileName="EGE_KP~1")) returned 1
	[0102.730] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61973b90, ftCreationTime.dwHighDateTime=0x1d5dcff, ftLastAccessTime.dwLowDateTime=0xe1fc030, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xe1fc030, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sfCIPM_LIy8Lq5LU", cAlternateFileName="SFCIPM~1")) returned 1
	[0102.730] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b7c4c0, ftCreationTime.dwHighDateTime=0x1d5e773, ftLastAccessTime.dwLowDateTime=0x34df1730, ftLastAccessTime.dwHighDateTime=0x1d5e0f6, ftLastWriteTime.dwLowDateTime=0x34df1730, ftLastWriteTime.dwHighDateTime=0x1d5e0f6, nFileSizeHigh=0x0, nFileSizeLow=0x9884, dwReserved0=0x0, dwReserved1=0x0, cFileName="V jPG3Sj.wav", cAlternateFileName="VJPG3S~1.WAV")) returned 1
	[0102.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\V jPG3Sj.wav", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\V jPG3Sj.wav", lpFilePart=0x0) returned 0x3c
	[0102.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0102.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\V jPG3Sj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\v jpg3sj.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.731] GetFileType (hFile=0x208) returned 0x1
	[0102.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0102.732] GetFileType (hFile=0x208) returned 0x1
	[0102.732] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x9884
	[0102.732] ReadFile (in: hFile=0x208, lpBuffer=0x2610d90, nNumberOfBytesToRead=0x9884, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2610d90*, lpNumberOfBytesRead=0x26ef24*=0x9884, lpOverlapped=0x0) returned 1
	[0102.735] CloseHandle (hObject=0x208) returned 1
	[0102.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\V jPG3Sj.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\V jPG3Sj.wav.KEKW", lpFilePart=0x0) returned 0x41
	[0102.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0102.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\V jPG3Sj.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\v jpg3sj.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.736] GetFileType (hFile=0x208) returned 0x1
	[0102.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0102.737] GetFileType (hFile=0x208) returned 0x1
	[0102.737] WriteFile (in: hFile=0x208, lpBuffer=0x261bcf4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x261bcf4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0102.740] CloseHandle (hObject=0x208) returned 1
	[0102.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\V jPG3Sj.wav", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\V jPG3Sj.wav", lpFilePart=0x0) returned 0x3c
	[0102.741] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\V jPG3Sj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\v jpg3sj.wav")) returned 1
	[0102.783] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.784] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0102.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0102.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\bWJnkhq1ltM\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bwjnkhq1ltm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0102.785] GetFileType (hFile=0x204) returned 0x1
	[0102.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0102.786] GetFileType (hFile=0x204) returned 0x1
	[0102.786] WriteFile (in: hFile=0x204, lpBuffer=0x261e3d4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x261e3d4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0102.789] CloseHandle (hObject=0x204) returned 1
	[0102.789] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0102.789] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d42f00, ftCreationTime.dwHighDateTime=0x1d5e773, ftLastAccessTime.dwLowDateTime=0xe4309e50, ftLastAccessTime.dwHighDateTime=0x1d5dc7a, ftLastWriteTime.dwLowDateTime=0xe4309e50, ftLastWriteTime.dwHighDateTime=0x1d5dc7a, nFileSizeHigh=0x0, nFileSizeLow=0x16ba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jn5X.mp3", cAlternateFileName="")) returned 1
	[0102.790] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857a9830, ftCreationTime.dwHighDateTime=0x1d5e29b, ftLastAccessTime.dwLowDateTime=0xa80f7de0, ftLastAccessTime.dwHighDateTime=0x1d5e4ec, ftLastWriteTime.dwLowDateTime=0xa80f7de0, ftLastWriteTime.dwHighDateTime=0x1d5e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jQne6sDTP0gLRRMM9w", cAlternateFileName="JQNE6S~1")) returned 1
	[0102.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0102.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w", lpFilePart=0x0) returned 0x36
	[0102.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\", lpFilePart=0x0) returned 0x37
	[0102.791] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857a9830, ftCreationTime.dwHighDateTime=0x1d5e29b, ftLastAccessTime.dwLowDateTime=0xa80f7de0, ftLastAccessTime.dwHighDateTime=0x1d5e4ec, ftLastWriteTime.dwLowDateTime=0xa80f7de0, ftLastWriteTime.dwHighDateTime=0x1d5e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0102.792] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857a9830, ftCreationTime.dwHighDateTime=0x1d5e29b, ftLastAccessTime.dwLowDateTime=0xa80f7de0, ftLastAccessTime.dwHighDateTime=0x1d5e4ec, ftLastWriteTime.dwLowDateTime=0xa80f7de0, ftLastWriteTime.dwHighDateTime=0x1d5e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.792] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b7910b0, ftCreationTime.dwHighDateTime=0x1d5e6d2, ftLastAccessTime.dwLowDateTime=0xd62af370, ftLastAccessTime.dwHighDateTime=0x1d5e632, ftLastWriteTime.dwLowDateTime=0xd62af370, ftLastWriteTime.dwHighDateTime=0x1d5e632, nFileSizeHigh=0x0, nFileSizeLow=0x14afb, dwReserved0=0x0, dwReserved1=0x0, cFileName="dYgs60vMpLWLnGO25-e.mp3", cAlternateFileName="DYGS60~1.MP3")) returned 1
	[0102.793] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57d273f0, ftCreationTime.dwHighDateTime=0x1d5e0ff, ftLastAccessTime.dwLowDateTime=0x1617cdf0, ftLastAccessTime.dwHighDateTime=0x1d5e15b, ftLastWriteTime.dwLowDateTime=0x1617cdf0, ftLastWriteTime.dwHighDateTime=0x1d5e15b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xAMGL", cAlternateFileName="")) returned 1
	[0102.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0102.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL", lpFilePart=0x0) returned 0x3c
	[0102.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\", lpFilePart=0x0) returned 0x3d
	[0102.794] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57d273f0, ftCreationTime.dwHighDateTime=0x1d5e0ff, ftLastAccessTime.dwLowDateTime=0x1617cdf0, ftLastAccessTime.dwHighDateTime=0x1d5e15b, ftLastWriteTime.dwLowDateTime=0x1617cdf0, ftLastWriteTime.dwHighDateTime=0x1d5e15b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0102.794] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57d273f0, ftCreationTime.dwHighDateTime=0x1d5e0ff, ftLastAccessTime.dwLowDateTime=0x1617cdf0, ftLastAccessTime.dwHighDateTime=0x1d5e15b, ftLastWriteTime.dwLowDateTime=0x1617cdf0, ftLastWriteTime.dwHighDateTime=0x1d5e15b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.795] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x432604e0, ftCreationTime.dwHighDateTime=0x1d5e333, ftLastAccessTime.dwLowDateTime=0x5a32f380, ftLastAccessTime.dwHighDateTime=0x1d5e731, ftLastWriteTime.dwLowDateTime=0x5a32f380, ftLastWriteTime.dwHighDateTime=0x1d5e731, nFileSizeHigh=0x0, nFileSizeLow=0xdbee, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Ok_HjScLxD_HWC.mp3", cAlternateFileName="8OK_HJ~1.MP3")) returned 1
	[0102.796] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ac856e0, ftCreationTime.dwHighDateTime=0x1d5ddae, ftLastAccessTime.dwLowDateTime=0x7df8c200, ftLastAccessTime.dwHighDateTime=0x1d5e014, ftLastWriteTime.dwLowDateTime=0x7df8c200, ftLastWriteTime.dwHighDateTime=0x1d5e014, nFileSizeHigh=0x0, nFileSizeLow=0x14c39, dwReserved0=0x0, dwReserved1=0x0, cFileName="gNTBpjT.mp3", cAlternateFileName="")) returned 1
	[0102.796] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2d4300, ftCreationTime.dwHighDateTime=0x1d5dc64, ftLastAccessTime.dwLowDateTime=0x1e7d8760, ftLastAccessTime.dwHighDateTime=0x1d5da11, ftLastWriteTime.dwLowDateTime=0x1e7d8760, ftLastWriteTime.dwHighDateTime=0x1d5da11, nFileSizeHigh=0x0, nFileSizeLow=0x1477a, dwReserved0=0x0, dwReserved1=0x0, cFileName="tUog2SWFo.wav", cAlternateFileName="TUOG2S~1.WAV")) returned 1
	[0102.797] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b056df0, ftCreationTime.dwHighDateTime=0x1d5e551, ftLastAccessTime.dwLowDateTime=0xedc39200, ftLastAccessTime.dwHighDateTime=0x1d5e527, ftLastWriteTime.dwLowDateTime=0xedc39200, ftLastWriteTime.dwHighDateTime=0x1d5e527, nFileSizeHigh=0x0, nFileSizeLow=0xf00b, dwReserved0=0x0, dwReserved1=0x0, cFileName="V s0AMvreWrxm_Us.wav", cAlternateFileName="VS0AMV~1.WAV")) returned 1
	[0102.797] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b056df0, ftCreationTime.dwHighDateTime=0x1d5e551, ftLastAccessTime.dwLowDateTime=0xedc39200, ftLastAccessTime.dwHighDateTime=0x1d5e527, ftLastWriteTime.dwLowDateTime=0xedc39200, ftLastWriteTime.dwHighDateTime=0x1d5e527, nFileSizeHigh=0x0, nFileSizeLow=0xf00b, dwReserved0=0x0, dwReserved1=0x0, cFileName="V s0AMvreWrxm_Us.wav", cAlternateFileName="VS0AMV~1.WAV")) returned 0
	[0102.798] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0102.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0102.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0102.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0102.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL", lpFilePart=0x0) returned 0x3c
	[0102.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\", lpFilePart=0x0) returned 0x3d
	[0102.799] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57d273f0, ftCreationTime.dwHighDateTime=0x1d5e0ff, ftLastAccessTime.dwLowDateTime=0x1617cdf0, ftLastAccessTime.dwHighDateTime=0x1d5e15b, ftLastWriteTime.dwLowDateTime=0x1617cdf0, ftLastWriteTime.dwHighDateTime=0x1d5e15b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0102.799] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57d273f0, ftCreationTime.dwHighDateTime=0x1d5e0ff, ftLastAccessTime.dwLowDateTime=0x1617cdf0, ftLastAccessTime.dwHighDateTime=0x1d5e15b, ftLastWriteTime.dwLowDateTime=0x1617cdf0, ftLastWriteTime.dwHighDateTime=0x1d5e15b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.800] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x432604e0, ftCreationTime.dwHighDateTime=0x1d5e333, ftLastAccessTime.dwLowDateTime=0x5a32f380, ftLastAccessTime.dwHighDateTime=0x1d5e731, ftLastWriteTime.dwLowDateTime=0x5a32f380, ftLastWriteTime.dwHighDateTime=0x1d5e731, nFileSizeHigh=0x0, nFileSizeLow=0xdbee, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Ok_HjScLxD_HWC.mp3", cAlternateFileName="8OK_HJ~1.MP3")) returned 1
	[0102.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\8Ok_HjScLxD_HWC.mp3", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\8Ok_HjScLxD_HWC.mp3", lpFilePart=0x0) returned 0x50
	[0102.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0102.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\8Ok_HjScLxD_HWC.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\8ok_hjsclxd_hwc.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0102.801] GetFileType (hFile=0x220) returned 0x1
	[0102.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0102.801] GetFileType (hFile=0x220) returned 0x1
	[0102.801] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xdbee
	[0102.801] ReadFile (in: hFile=0x220, lpBuffer=0x26222a4, nNumberOfBytesToRead=0xdbee, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26222a4*, lpNumberOfBytesRead=0x26ee84*=0xdbee, lpOverlapped=0x0) returned 1
	[0102.805] CloseHandle (hObject=0x220) returned 1
	[0102.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\8Ok_HjScLxD_HWC.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\8Ok_HjScLxD_HWC.mp3.KEKW", lpFilePart=0x0) returned 0x55
	[0102.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0102.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\8Ok_HjScLxD_HWC.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\8ok_hjsclxd_hwc.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0102.806] GetFileType (hFile=0x220) returned 0x1
	[0102.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0102.807] GetFileType (hFile=0x220) returned 0x1
	[0102.807] WriteFile (in: hFile=0x220, lpBuffer=0x26315d4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26315d4*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0102.810] CloseHandle (hObject=0x220) returned 1
	[0102.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\8Ok_HjScLxD_HWC.mp3", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\8Ok_HjScLxD_HWC.mp3", lpFilePart=0x0) returned 0x50
	[0102.841] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\8Ok_HjScLxD_HWC.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\8ok_hjsclxd_hwc.mp3")) returned 1
	[0102.847] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ac856e0, ftCreationTime.dwHighDateTime=0x1d5ddae, ftLastAccessTime.dwLowDateTime=0x7df8c200, ftLastAccessTime.dwHighDateTime=0x1d5e014, ftLastWriteTime.dwLowDateTime=0x7df8c200, ftLastWriteTime.dwHighDateTime=0x1d5e014, nFileSizeHigh=0x0, nFileSizeLow=0x14c39, dwReserved0=0x0, dwReserved1=0x0, cFileName="gNTBpjT.mp3", cAlternateFileName="")) returned 1
	[0102.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\gNTBpjT.mp3", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\gNTBpjT.mp3", lpFilePart=0x0) returned 0x48
	[0102.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0102.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\gNTBpjT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\gntbpjt.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0102.848] GetFileType (hFile=0x220) returned 0x1
	[0102.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0102.848] GetFileType (hFile=0x220) returned 0x1
	[0102.848] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x14c39
	[0102.849] ReadFile (in: hFile=0x220, lpBuffer=0x3717be8, nNumberOfBytesToRead=0x14c39, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x3717be8*, lpNumberOfBytesRead=0x26ee84*=0x14c39, lpOverlapped=0x0) returned 1
	[0102.857] CloseHandle (hObject=0x220) returned 1
	[0102.857] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\gNTBpjT.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\gNTBpjT.mp3.KEKW", lpFilePart=0x0) returned 0x4d
	[0102.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0102.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\gNTBpjT.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\gntbpjt.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0102.858] GetFileType (hFile=0x220) returned 0x1
	[0102.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0102.859] GetFileType (hFile=0x220) returned 0x1
	[0102.859] WriteFile (in: hFile=0x220, lpBuffer=0x2634278*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2634278*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0102.862] CloseHandle (hObject=0x220) returned 1
	[0102.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\gNTBpjT.mp3", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\gNTBpjT.mp3", lpFilePart=0x0) returned 0x48
	[0102.862] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\gNTBpjT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\gntbpjt.mp3")) returned 1
	[0102.867] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2d4300, ftCreationTime.dwHighDateTime=0x1d5dc64, ftLastAccessTime.dwLowDateTime=0x1e7d8760, ftLastAccessTime.dwHighDateTime=0x1d5da11, ftLastWriteTime.dwLowDateTime=0x1e7d8760, ftLastWriteTime.dwHighDateTime=0x1d5da11, nFileSizeHigh=0x0, nFileSizeLow=0x1477a, dwReserved0=0x0, dwReserved1=0x0, cFileName="tUog2SWFo.wav", cAlternateFileName="TUOG2S~1.WAV")) returned 1
	[0102.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\tUog2SWFo.wav", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\tUog2SWFo.wav", lpFilePart=0x0) returned 0x4a
	[0102.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0102.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\tUog2SWFo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\tuog2swfo.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0102.868] GetFileType (hFile=0x220) returned 0x1
	[0102.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0102.868] GetFileType (hFile=0x220) returned 0x1
	[0102.868] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x1477a
	[0102.869] ReadFile (in: hFile=0x220, lpBuffer=0x2635850, nNumberOfBytesToRead=0x1477a, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2635850*, lpNumberOfBytesRead=0x26ee84*=0x1477a, lpOverlapped=0x0) returned 1
	[0102.878] CloseHandle (hObject=0x220) returned 1
	[0102.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\tUog2SWFo.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\tUog2SWFo.wav.KEKW", lpFilePart=0x0) returned 0x4f
	[0102.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0102.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\tUog2SWFo.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\tuog2swfo.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0102.879] GetFileType (hFile=0x220) returned 0x1
	[0102.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0102.880] GetFileType (hFile=0x220) returned 0x1
	[0102.880] WriteFile (in: hFile=0x220, lpBuffer=0x264b6e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x264b6e8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0102.883] CloseHandle (hObject=0x220) returned 1
	[0102.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\tUog2SWFo.wav", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\tUog2SWFo.wav", lpFilePart=0x0) returned 0x4a
	[0102.883] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\tUog2SWFo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\tuog2swfo.wav")) returned 1
	[0102.888] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b056df0, ftCreationTime.dwHighDateTime=0x1d5e551, ftLastAccessTime.dwLowDateTime=0xedc39200, ftLastAccessTime.dwHighDateTime=0x1d5e527, ftLastWriteTime.dwLowDateTime=0xedc39200, ftLastWriteTime.dwHighDateTime=0x1d5e527, nFileSizeHigh=0x0, nFileSizeLow=0xf00b, dwReserved0=0x0, dwReserved1=0x0, cFileName="V s0AMvreWrxm_Us.wav", cAlternateFileName="VS0AMV~1.WAV")) returned 1
	[0102.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\V s0AMvreWrxm_Us.wav", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\V s0AMvreWrxm_Us.wav", lpFilePart=0x0) returned 0x51
	[0102.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0102.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\V s0AMvreWrxm_Us.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\v s0amvrewrxm_us.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0102.888] GetFileType (hFile=0x220) returned 0x1
	[0102.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0102.889] GetFileType (hFile=0x220) returned 0x1
	[0102.889] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xf00b
	[0102.889] ReadFile (in: hFile=0x220, lpBuffer=0x264cd30, nNumberOfBytesToRead=0xf00b, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x264cd30*, lpNumberOfBytesRead=0x26ee84*=0xf00b, lpOverlapped=0x0) returned 1
	[0102.893] CloseHandle (hObject=0x220) returned 1
	[0102.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\V s0AMvreWrxm_Us.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\V s0AMvreWrxm_Us.wav.KEKW", lpFilePart=0x0) returned 0x56
	[0102.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0102.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\V s0AMvreWrxm_Us.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\v s0amvrewrxm_us.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0102.894] GetFileType (hFile=0x220) returned 0x1
	[0102.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0102.894] GetFileType (hFile=0x220) returned 0x1
	[0102.895] WriteFile (in: hFile=0x220, lpBuffer=0x265d484*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x265d484*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0102.898] CloseHandle (hObject=0x220) returned 1
	[0102.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\V s0AMvreWrxm_Us.wav", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\V s0AMvreWrxm_Us.wav", lpFilePart=0x0) returned 0x51
	[0102.899] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\V s0AMvreWrxm_Us.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\v s0amvrewrxm_us.wav")) returned 1
	[0102.906] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.907] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0102.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0102.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0102.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0102.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0102.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\xAMGL\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\xamgl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0102.908] GetFileType (hFile=0x208) returned 0x1
	[0102.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0102.908] GetFileType (hFile=0x208) returned 0x1
	[0102.909] WriteFile (in: hFile=0x208, lpBuffer=0x265fbc4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x265fbc4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0102.912] CloseHandle (hObject=0x208) returned 1
	[0102.912] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f665dd0, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0xe25794d0, ftLastAccessTime.dwHighDateTime=0x1d5e35a, ftLastWriteTime.dwLowDateTime=0xe25794d0, ftLastWriteTime.dwHighDateTime=0x1d5e35a, nFileSizeHigh=0x0, nFileSizeLow=0x13379, dwReserved0=0x0, dwReserved1=0x0, cFileName="zWNlMA1rOl8.wav", cAlternateFileName="ZWNLMA~1.WAV")) returned 1
	[0102.913] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f665dd0, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0xe25794d0, ftLastAccessTime.dwHighDateTime=0x1d5e35a, ftLastWriteTime.dwLowDateTime=0xe25794d0, ftLastWriteTime.dwHighDateTime=0x1d5e35a, nFileSizeHigh=0x0, nFileSizeLow=0x13379, dwReserved0=0x0, dwReserved1=0x0, cFileName="zWNlMA1rOl8.wav", cAlternateFileName="ZWNLMA~1.WAV")) returned 0
	[0102.913] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0102.914] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w", lpFilePart=0x0) returned 0x36
	[0102.914] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\", lpFilePart=0x0) returned 0x37
	[0102.914] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857a9830, ftCreationTime.dwHighDateTime=0x1d5e29b, ftLastAccessTime.dwLowDateTime=0xa80f7de0, ftLastAccessTime.dwHighDateTime=0x1d5e4ec, ftLastWriteTime.dwLowDateTime=0xa80f7de0, ftLastWriteTime.dwHighDateTime=0x1d5e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0102.915] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857a9830, ftCreationTime.dwHighDateTime=0x1d5e29b, ftLastAccessTime.dwLowDateTime=0xa80f7de0, ftLastAccessTime.dwHighDateTime=0x1d5e4ec, ftLastWriteTime.dwLowDateTime=0xa80f7de0, ftLastWriteTime.dwHighDateTime=0x1d5e4ec, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.916] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b7910b0, ftCreationTime.dwHighDateTime=0x1d5e6d2, ftLastAccessTime.dwLowDateTime=0xd62af370, ftLastAccessTime.dwHighDateTime=0x1d5e632, ftLastWriteTime.dwLowDateTime=0xd62af370, ftLastWriteTime.dwHighDateTime=0x1d5e632, nFileSizeHigh=0x0, nFileSizeLow=0x14afb, dwReserved0=0x0, dwReserved1=0x0, cFileName="dYgs60vMpLWLnGO25-e.mp3", cAlternateFileName="DYGS60~1.MP3")) returned 1
	[0102.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\dYgs60vMpLWLnGO25-e.mp3", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\dYgs60vMpLWLnGO25-e.mp3", lpFilePart=0x0) returned 0x4e
	[0102.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0102.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\dYgs60vMpLWLnGO25-e.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\dygs60vmplwlngo25-e.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.918] GetFileType (hFile=0x208) returned 0x1
	[0102.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0102.918] GetFileType (hFile=0x208) returned 0x1
	[0102.918] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x14afb
	[0102.919] ReadFile (in: hFile=0x208, lpBuffer=0x2661c10, nNumberOfBytesToRead=0x14afb, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2661c10*, lpNumberOfBytesRead=0x26ef24*=0x14afb, lpOverlapped=0x0) returned 1
	[0102.923] CloseHandle (hObject=0x208) returned 1
	[0102.923] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\dYgs60vMpLWLnGO25-e.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\dYgs60vMpLWLnGO25-e.mp3.KEKW", lpFilePart=0x0) returned 0x53
	[0102.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0102.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\dYgs60vMpLWLnGO25-e.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\dygs60vmplwlngo25-e.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.924] GetFileType (hFile=0x208) returned 0x1
	[0102.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0102.924] GetFileType (hFile=0x208) returned 0x1
	[0102.925] WriteFile (in: hFile=0x208, lpBuffer=0x2677e4c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2677e4c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0102.928] CloseHandle (hObject=0x208) returned 1
	[0102.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\dYgs60vMpLWLnGO25-e.mp3", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\dYgs60vMpLWLnGO25-e.mp3", lpFilePart=0x0) returned 0x4e
	[0102.928] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\dYgs60vMpLWLnGO25-e.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\dygs60vmplwlngo25-e.mp3")) returned 1
	[0102.933] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57d273f0, ftCreationTime.dwHighDateTime=0x1d5e0ff, ftLastAccessTime.dwLowDateTime=0xe483790, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xe483790, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xAMGL", cAlternateFileName="")) returned 1
	[0102.934] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f665dd0, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0xe25794d0, ftLastAccessTime.dwHighDateTime=0x1d5e35a, ftLastWriteTime.dwLowDateTime=0xe25794d0, ftLastWriteTime.dwHighDateTime=0x1d5e35a, nFileSizeHigh=0x0, nFileSizeLow=0x13379, dwReserved0=0x0, dwReserved1=0x0, cFileName="zWNlMA1rOl8.wav", cAlternateFileName="ZWNLMA~1.WAV")) returned 1
	[0102.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\zWNlMA1rOl8.wav", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\zWNlMA1rOl8.wav", lpFilePart=0x0) returned 0x46
	[0102.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0102.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\zWNlMA1rOl8.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\zwnlma1rol8.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.934] GetFileType (hFile=0x208) returned 0x1
	[0102.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0102.935] GetFileType (hFile=0x208) returned 0x1
	[0102.935] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x13379
	[0102.935] ReadFile (in: hFile=0x208, lpBuffer=0x2679544, nNumberOfBytesToRead=0x13379, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2679544*, lpNumberOfBytesRead=0x26ef24*=0x13379, lpOverlapped=0x0) returned 1
	[0102.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\zWNlMA1rOl8.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\zWNlMA1rOl8.wav.KEKW", lpFilePart=0x0) returned 0x4b
	[0102.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0102.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\zWNlMA1rOl8.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\zwnlma1rol8.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.942] GetFileType (hFile=0x208) returned 0x1
	[0102.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0102.942] GetFileType (hFile=0x208) returned 0x1
	[0102.943] WriteFile (in: hFile=0x208, lpBuffer=0x268dfd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x268dfd0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0102.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\zWNlMA1rOl8.wav", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\zWNlMA1rOl8.wav", lpFilePart=0x0) returned 0x46
	[0102.947] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\zWNlMA1rOl8.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\zwnlma1rol8.wav")) returned 1
	[0102.951] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.952] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.952] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\Decrypt.txt", lpFilePart=0x0) returned 0x42
	[0102.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0102.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\jQne6sDTP0gLRRMM9w\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jqne6sdtp0glrrmm9w\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0102.953] GetFileType (hFile=0x204) returned 0x1
	[0102.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0102.953] GetFileType (hFile=0x204) returned 0x1
	[0102.953] WriteFile (in: hFile=0x204, lpBuffer=0x26906e4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26906e4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0102.956] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4cb6840, ftCreationTime.dwHighDateTime=0x1d5dc39, ftLastAccessTime.dwLowDateTime=0x1c79f400, ftLastAccessTime.dwHighDateTime=0x1d5e379, ftLastWriteTime.dwLowDateTime=0x1c79f400, ftLastWriteTime.dwHighDateTime=0x1d5e379, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="u8c QRVcJJVI3A", cAlternateFileName="U8CQRV~1")) returned 1
	[0102.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0102.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A", lpFilePart=0x0) returned 0x32
	[0102.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\", lpFilePart=0x0) returned 0x33
	[0102.957] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4cb6840, ftCreationTime.dwHighDateTime=0x1d5dc39, ftLastAccessTime.dwLowDateTime=0x1c79f400, ftLastAccessTime.dwHighDateTime=0x1d5e379, ftLastWriteTime.dwLowDateTime=0x1c79f400, ftLastWriteTime.dwHighDateTime=0x1d5e379, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0102.958] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4cb6840, ftCreationTime.dwHighDateTime=0x1d5dc39, ftLastAccessTime.dwLowDateTime=0x1c79f400, ftLastAccessTime.dwHighDateTime=0x1d5e379, ftLastWriteTime.dwLowDateTime=0x1c79f400, ftLastWriteTime.dwHighDateTime=0x1d5e379, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.959] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81fd3a60, ftCreationTime.dwHighDateTime=0x1d5e592, ftLastAccessTime.dwLowDateTime=0x848f0520, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0x848f0520, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0xcbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3-dllDGZQHV3RTJ_YEJ.m4a", cAlternateFileName="3-DLLD~1.M4A")) returned 1
	[0102.959] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x135a1af0, ftCreationTime.dwHighDateTime=0x1d5e2c3, ftLastAccessTime.dwLowDateTime=0xf497fc20, ftLastAccessTime.dwHighDateTime=0x1d5e6e8, ftLastWriteTime.dwLowDateTime=0xf497fc20, ftLastWriteTime.dwHighDateTime=0x1d5e6e8, nFileSizeHigh=0x0, nFileSizeLow=0x5672, dwReserved0=0x0, dwReserved1=0x0, cFileName="poav.mp3", cAlternateFileName="")) returned 1
	[0102.960] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a404980, ftCreationTime.dwHighDateTime=0x1d5e219, ftLastAccessTime.dwLowDateTime=0x95556100, ftLastAccessTime.dwHighDateTime=0x1d5e6b4, ftLastWriteTime.dwLowDateTime=0x95556100, ftLastWriteTime.dwHighDateTime=0x1d5e6b4, nFileSizeHigh=0x0, nFileSizeLow=0x43ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZbcwzdAcP4Ij3MLSLW.mp3", cAlternateFileName="ZBCWZD~1.MP3")) returned 1
	[0102.960] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a404980, ftCreationTime.dwHighDateTime=0x1d5e219, ftLastAccessTime.dwLowDateTime=0x95556100, ftLastAccessTime.dwHighDateTime=0x1d5e6b4, ftLastWriteTime.dwLowDateTime=0x95556100, ftLastWriteTime.dwHighDateTime=0x1d5e6b4, nFileSizeHigh=0x0, nFileSizeLow=0x43ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZbcwzdAcP4Ij3MLSLW.mp3", cAlternateFileName="ZBCWZD~1.MP3")) returned 0
	[0102.961] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0102.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A", lpFilePart=0x0) returned 0x32
	[0102.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\", lpFilePart=0x0) returned 0x33
	[0102.962] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4cb6840, ftCreationTime.dwHighDateTime=0x1d5dc39, ftLastAccessTime.dwLowDateTime=0x1c79f400, ftLastAccessTime.dwHighDateTime=0x1d5e379, ftLastWriteTime.dwLowDateTime=0x1c79f400, ftLastWriteTime.dwHighDateTime=0x1d5e379, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0102.963] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4cb6840, ftCreationTime.dwHighDateTime=0x1d5dc39, ftLastAccessTime.dwLowDateTime=0x1c79f400, ftLastAccessTime.dwHighDateTime=0x1d5e379, ftLastWriteTime.dwLowDateTime=0x1c79f400, ftLastWriteTime.dwHighDateTime=0x1d5e379, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0102.964] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81fd3a60, ftCreationTime.dwHighDateTime=0x1d5e592, ftLastAccessTime.dwLowDateTime=0x848f0520, ftLastAccessTime.dwHighDateTime=0x1d5df79, ftLastWriteTime.dwLowDateTime=0x848f0520, ftLastWriteTime.dwHighDateTime=0x1d5df79, nFileSizeHigh=0x0, nFileSizeLow=0xcbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3-dllDGZQHV3RTJ_YEJ.m4a", cAlternateFileName="3-DLLD~1.M4A")) returned 1
	[0102.967] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x135a1af0, ftCreationTime.dwHighDateTime=0x1d5e2c3, ftLastAccessTime.dwLowDateTime=0xf497fc20, ftLastAccessTime.dwHighDateTime=0x1d5e6e8, ftLastWriteTime.dwLowDateTime=0xf497fc20, ftLastWriteTime.dwHighDateTime=0x1d5e6e8, nFileSizeHigh=0x0, nFileSizeLow=0x5672, dwReserved0=0x0, dwReserved1=0x0, cFileName="poav.mp3", cAlternateFileName="")) returned 1
	[0102.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\poav.mp3", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\poav.mp3", lpFilePart=0x0) returned 0x3b
	[0102.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0102.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\poav.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\u8c qrvcjjvi3a\\poav.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.968] GetFileType (hFile=0x208) returned 0x1
	[0102.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0102.969] GetFileType (hFile=0x208) returned 0x1
	[0102.969] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x5672
	[0102.969] ReadFile (in: hFile=0x208, lpBuffer=0x2693660, nNumberOfBytesToRead=0x5672, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2693660*, lpNumberOfBytesRead=0x26ef24*=0x5672, lpOverlapped=0x0) returned 1
	[0102.972] CloseHandle (hObject=0x208) returned 1
	[0102.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\poav.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\poav.mp3.KEKW", lpFilePart=0x0) returned 0x40
	[0102.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0102.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\poav.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\u8c qrvcjjvi3a\\poav.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.974] GetFileType (hFile=0x208) returned 0x1
	[0102.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0102.974] GetFileType (hFile=0x208) returned 0x1
	[0102.974] WriteFile (in: hFile=0x208, lpBuffer=0x269a3ac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x269a3ac*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0102.977] CloseHandle (hObject=0x208) returned 1
	[0102.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\poav.mp3", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\poav.mp3", lpFilePart=0x0) returned 0x3b
	[0102.978] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\poav.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\u8c qrvcjjvi3a\\poav.mp3")) returned 1
	[0102.981] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a404980, ftCreationTime.dwHighDateTime=0x1d5e219, ftLastAccessTime.dwLowDateTime=0x95556100, ftLastAccessTime.dwHighDateTime=0x1d5e6b4, ftLastWriteTime.dwLowDateTime=0x95556100, ftLastWriteTime.dwHighDateTime=0x1d5e6b4, nFileSizeHigh=0x0, nFileSizeLow=0x43ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZbcwzdAcP4Ij3MLSLW.mp3", cAlternateFileName="ZBCWZD~1.MP3")) returned 1
	[0102.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\ZbcwzdAcP4Ij3MLSLW.mp3", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\ZbcwzdAcP4Ij3MLSLW.mp3", lpFilePart=0x0) returned 0x49
	[0102.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0102.982] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\ZbcwzdAcP4Ij3MLSLW.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\u8c qrvcjjvi3a\\zbcwzdacp4ij3mlslw.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.983] GetFileType (hFile=0x208) returned 0x1
	[0102.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0102.983] GetFileType (hFile=0x208) returned 0x1
	[0102.983] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x43ae
	[0102.983] ReadFile (in: hFile=0x208, lpBuffer=0x269b97c, nNumberOfBytesToRead=0x43ae, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x269b97c*, lpNumberOfBytesRead=0x26ef24*=0x43ae, lpOverlapped=0x0) returned 1
	[0102.987] CloseHandle (hObject=0x208) returned 1
	[0102.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\ZbcwzdAcP4Ij3MLSLW.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\ZbcwzdAcP4Ij3MLSLW.mp3.KEKW", lpFilePart=0x0) returned 0x4e
	[0102.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0102.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\ZbcwzdAcP4Ij3MLSLW.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\u8c qrvcjjvi3a\\zbcwzdacp4ij3mlslw.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0102.988] GetFileType (hFile=0x208) returned 0x1
	[0102.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0102.989] GetFileType (hFile=0x208) returned 0x1
	[0102.989] WriteFile (in: hFile=0x208, lpBuffer=0x26a1458*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26a1458*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0102.992] CloseHandle (hObject=0x208) returned 1
	[0102.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\ZbcwzdAcP4Ij3MLSLW.mp3", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\ZbcwzdAcP4Ij3MLSLW.mp3", lpFilePart=0x0) returned 0x49
	[0102.993] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\ZbcwzdAcP4Ij3MLSLW.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\u8c qrvcjjvi3a\\zbcwzdacp4ij3mlslw.mp3")) returned 1
	[0102.997] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0102.997] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0102.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0102.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0102.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0102.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0102.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\u8c QRVcJJVI3A\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\u8c qrvcjjvi3a\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0102.999] GetFileType (hFile=0x204) returned 0x1
	[0102.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0102.999] GetFileType (hFile=0x204) returned 0x1
	[0103.000] WriteFile (in: hFile=0x204, lpBuffer=0x26a3b60*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26a3b60*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0103.003] CloseHandle (hObject=0x204) returned 1
	[0103.003] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbda68620, ftCreationTime.dwHighDateTime=0x1d5e2db, ftLastAccessTime.dwLowDateTime=0xa3512e70, ftLastAccessTime.dwHighDateTime=0x1d5e5dc, ftLastWriteTime.dwLowDateTime=0xa3512e70, ftLastWriteTime.dwHighDateTime=0x1d5e5dc, nFileSizeHigh=0x0, nFileSizeLow=0x10ab4, dwReserved0=0x0, dwReserved1=0x0, cFileName="xZ7ZFTC7v.wav", cAlternateFileName="XZ7ZFT~1.WAV")) returned 1
	[0103.004] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbda68620, ftCreationTime.dwHighDateTime=0x1d5e2db, ftLastAccessTime.dwLowDateTime=0xa3512e70, ftLastAccessTime.dwHighDateTime=0x1d5e5dc, ftLastWriteTime.dwLowDateTime=0xa3512e70, ftLastWriteTime.dwHighDateTime=0x1d5e5dc, nFileSizeHigh=0x0, nFileSizeLow=0x10ab4, dwReserved0=0x0, dwReserved1=0x0, cFileName="xZ7ZFTC7v.wav", cAlternateFileName="XZ7ZFT~1.WAV")) returned 0
	[0103.004] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0103.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0103.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0103.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0103.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23
	[0103.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24
	[0103.005] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda8c0ea0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda8c0ea0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0103.006] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda8c0ea0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xda8c0ea0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.007] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf517bc0, ftCreationTime.dwHighDateTime=0x1d5d958, ftLastAccessTime.dwLowDateTime=0x5adc5d10, ftLastAccessTime.dwHighDateTime=0x1d5dab3, ftLastWriteTime.dwLowDateTime=0x5adc5d10, ftLastWriteTime.dwHighDateTime=0x1d5dab3, nFileSizeHigh=0x0, nFileSizeLow=0xe155, dwReserved0=0x0, dwReserved1=0x0, cFileName="5ATSvZKBYa0r.wav", cAlternateFileName="5ATSVZ~1.WAV")) returned 1
	[0103.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5ATSvZKBYa0r.wav", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5ATSvZKBYa0r.wav", lpFilePart=0x0) returned 0x34
	[0103.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0103.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5ATSvZKBYa0r.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5atsvzkbya0r.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0103.008] GetFileType (hFile=0x204) returned 0x1
	[0103.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0103.008] GetFileType (hFile=0x204) returned 0x1
	[0103.008] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xe155
	[0103.009] ReadFile (in: hFile=0x204, lpBuffer=0x26a5804, nNumberOfBytesToRead=0xe155, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x26a5804*, lpNumberOfBytesRead=0x26efc4*=0xe155, lpOverlapped=0x0) returned 1
	[0103.013] CloseHandle (hObject=0x204) returned 1
	[0103.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5ATSvZKBYa0r.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5ATSvZKBYa0r.wav.KEKW", lpFilePart=0x0) returned 0x39
	[0103.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0103.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5ATSvZKBYa0r.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5atsvzkbya0r.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0103.015] GetFileType (hFile=0x204) returned 0x1
	[0103.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0103.015] GetFileType (hFile=0x204) returned 0x1
	[0103.015] WriteFile (in: hFile=0x204, lpBuffer=0x26b5024*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26b5024*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0103.019] CloseHandle (hObject=0x204) returned 1
	[0103.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5ATSvZKBYa0r.wav", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5ATSvZKBYa0r.wav", lpFilePart=0x0) returned 0x34
	[0103.019] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5ATSvZKBYa0r.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5atsvzkbya0r.wav")) returned 1
	[0103.023] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x241c3d30, ftCreationTime.dwHighDateTime=0x1d5d94c, ftLastAccessTime.dwLowDateTime=0xfb075580, ftLastAccessTime.dwHighDateTime=0x1d5da48, ftLastWriteTime.dwLowDateTime=0xfb075580, ftLastWriteTime.dwHighDateTime=0x1d5da48, nFileSizeHigh=0x0, nFileSizeLow=0x13127, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIPSNu1C.wav", cAlternateFileName="")) returned 1
	[0103.024] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AIPSNu1C.wav", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AIPSNu1C.wav", lpFilePart=0x0) returned 0x30
	[0103.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0103.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AIPSNu1C.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\aipsnu1c.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0103.024] GetFileType (hFile=0x204) returned 0x1
	[0103.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0103.025] GetFileType (hFile=0x204) returned 0x1
	[0103.025] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x13127
	[0103.026] ReadFile (in: hFile=0x204, lpBuffer=0x26b6474, nNumberOfBytesToRead=0x13127, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x26b6474*, lpNumberOfBytesRead=0x26efc4*=0x13127, lpOverlapped=0x0) returned 1
	[0103.029] CloseHandle (hObject=0x204) returned 1
	[0103.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AIPSNu1C.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AIPSNu1C.wav.KEKW", lpFilePart=0x0) returned 0x35
	[0103.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0103.030] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AIPSNu1C.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\aipsnu1c.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0103.030] GetFileType (hFile=0x204) returned 0x1
	[0103.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0103.031] GetFileType (hFile=0x204) returned 0x1
	[0103.031] WriteFile (in: hFile=0x204, lpBuffer=0x26cac4c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26cac4c*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0103.034] CloseHandle (hObject=0x204) returned 1
	[0103.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AIPSNu1C.wav", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AIPSNu1C.wav", lpFilePart=0x0) returned 0x30
	[0103.035] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\AIPSNu1C.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\aipsnu1c.wav")) returned 1
	[0103.039] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdab1cb00, ftCreationTime.dwHighDateTime=0x1d5dc35, ftLastAccessTime.dwLowDateTime=0xe352c90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xe352c90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bWJnkhq1ltM", cAlternateFileName="BWJNKH~1")) returned 1
	[0103.040] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0103.040] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d42f00, ftCreationTime.dwHighDateTime=0x1d5e773, ftLastAccessTime.dwLowDateTime=0xe4309e50, ftLastAccessTime.dwHighDateTime=0x1d5dc7a, ftLastWriteTime.dwLowDateTime=0xe4309e50, ftLastWriteTime.dwHighDateTime=0x1d5dc7a, nFileSizeHigh=0x0, nFileSizeLow=0x16ba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jn5X.mp3", cAlternateFileName="")) returned 1
	[0103.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Jn5X.mp3", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Jn5X.mp3", lpFilePart=0x0) returned 0x2c
	[0103.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0103.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Jn5X.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jn5x.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0103.042] GetFileType (hFile=0x204) returned 0x1
	[0103.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0103.042] GetFileType (hFile=0x204) returned 0x1
	[0103.042] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x16ba7
	[0103.043] ReadFile (in: hFile=0x204, lpBuffer=0x372c840, nNumberOfBytesToRead=0x16ba7, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x372c840*, lpNumberOfBytesRead=0x26efc4*=0x16ba7, lpOverlapped=0x0) returned 1
	[0103.051] CloseHandle (hObject=0x204) returned 1
	[0103.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Jn5X.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Jn5X.mp3.KEKW", lpFilePart=0x0) returned 0x31
	[0103.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0103.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Jn5X.mp3.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jn5x.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0103.052] GetFileType (hFile=0x204) returned 0x1
	[0103.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0103.052] GetFileType (hFile=0x204) returned 0x1
	[0103.053] WriteFile (in: hFile=0x204, lpBuffer=0x26cdad4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26cdad4*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0103.056] CloseHandle (hObject=0x204) returned 1
	[0103.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Jn5X.mp3", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Jn5X.mp3", lpFilePart=0x0) returned 0x2c
	[0103.056] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Jn5X.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\jn5x.mp3")) returned 1
	[0103.062] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857a9830, ftCreationTime.dwHighDateTime=0x1d5e29b, ftLastAccessTime.dwLowDateTime=0xe4f5bb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xe4f5bb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jQne6sDTP0gLRRMM9w", cAlternateFileName="JQNE6S~1")) returned 1
	[0103.062] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4cb6840, ftCreationTime.dwHighDateTime=0x1d5dc39, ftLastAccessTime.dwLowDateTime=0xe567fd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xe567fd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="u8c QRVcJJVI3A", cAlternateFileName="U8CQRV~1")) returned 1
	[0103.063] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbda68620, ftCreationTime.dwHighDateTime=0x1d5e2db, ftLastAccessTime.dwLowDateTime=0xa3512e70, ftLastAccessTime.dwHighDateTime=0x1d5e5dc, ftLastWriteTime.dwLowDateTime=0xa3512e70, ftLastWriteTime.dwHighDateTime=0x1d5e5dc, nFileSizeHigh=0x0, nFileSizeLow=0x10ab4, dwReserved0=0x0, dwReserved1=0x0, cFileName="xZ7ZFTC7v.wav", cAlternateFileName="XZ7ZFT~1.WAV")) returned 1
	[0103.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xZ7ZFTC7v.wav", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xZ7ZFTC7v.wav", lpFilePart=0x0) returned 0x31
	[0103.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0103.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xZ7ZFTC7v.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xz7zftc7v.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0103.064] GetFileType (hFile=0x204) returned 0x1
	[0103.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0103.064] GetFileType (hFile=0x204) returned 0x1
	[0103.064] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x10ab4
	[0103.064] ReadFile (in: hFile=0x204, lpBuffer=0x26cf1e8, nNumberOfBytesToRead=0x10ab4, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x26cf1e8*, lpNumberOfBytesRead=0x26efc4*=0x10ab4, lpOverlapped=0x0) returned 1
	[0103.068] CloseHandle (hObject=0x204) returned 1
	[0103.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xZ7ZFTC7v.wav.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xZ7ZFTC7v.wav.KEKW", lpFilePart=0x0) returned 0x36
	[0103.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0103.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xZ7ZFTC7v.wav.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xz7zftc7v.wav.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0103.069] GetFileType (hFile=0x204) returned 0x1
	[0103.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0103.070] GetFileType (hFile=0x204) returned 0x1
	[0103.070] WriteFile (in: hFile=0x204, lpBuffer=0x26e1358*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26e1358*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0103.073] CloseHandle (hObject=0x204) returned 1
	[0103.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xZ7ZFTC7v.wav", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xZ7ZFTC7v.wav", lpFilePart=0x0) returned 0x31
	[0103.073] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\xZ7ZFTC7v.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\xz7zftc7v.wav")) returned 1
	[0103.078] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0103.078] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0103.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0103.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0103.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0103.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0103.079] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0103.079] GetFileType (hFile=0x200) returned 0x1
	[0103.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0103.080] GetFileType (hFile=0x200) returned 0x1
	[0103.080] WriteFile (in: hFile=0x200, lpBuffer=0x26e39f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x26e39f0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0103.083] CloseHandle (hObject=0x200) returned 1
	[0103.083] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1
	[0103.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0103.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents", lpFilePart=0x0) returned 0x2a
	[0103.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\", lpFilePart=0x0) returned 0x2b
	[0103.084] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0103.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0103.087] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1
	[0103.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0103.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood", lpFilePart=0x0) returned 0x25
	[0103.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\", lpFilePart=0x0) returned 0x26
	[0103.089] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0103.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0103.093] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8f3afd80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8f3afd80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1
	[0103.094] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8f389c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1
	[0103.094] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1
	[0103.095] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1
	[0103.095] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1
	[0103.096] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1
	[0103.097] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1
	[0103.097] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdab224a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdab224a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0103.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0103.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26
	[0103.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27
	[0103.098] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdab224a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdab224a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0103.099] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdab224a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdab224a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.099] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a5ad9b0, ftCreationTime.dwHighDateTime=0x1d5db8c, ftLastAccessTime.dwLowDateTime=0x9aa807c0, ftLastAccessTime.dwHighDateTime=0x1d5e380, ftLastWriteTime.dwLowDateTime=0x9aa807c0, ftLastWriteTime.dwHighDateTime=0x1d5e380, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-UucLCm", cAlternateFileName="")) returned 1
	[0103.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0103.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm", lpFilePart=0x0) returned 0x2e
	[0103.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\", lpFilePart=0x0) returned 0x2f
	[0103.100] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a5ad9b0, ftCreationTime.dwHighDateTime=0x1d5db8c, ftLastAccessTime.dwLowDateTime=0x9aa807c0, ftLastAccessTime.dwHighDateTime=0x1d5e380, ftLastWriteTime.dwLowDateTime=0x9aa807c0, ftLastWriteTime.dwHighDateTime=0x1d5e380, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0103.101] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a5ad9b0, ftCreationTime.dwHighDateTime=0x1d5db8c, ftLastAccessTime.dwLowDateTime=0x9aa807c0, ftLastAccessTime.dwHighDateTime=0x1d5e380, ftLastWriteTime.dwLowDateTime=0x9aa807c0, ftLastWriteTime.dwHighDateTime=0x1d5e380, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.101] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6a7afb0, ftCreationTime.dwHighDateTime=0x1d5d90e, ftLastAccessTime.dwLowDateTime=0xd2911d30, ftLastAccessTime.dwHighDateTime=0x1d5e2f8, ftLastWriteTime.dwLowDateTime=0xd2911d30, ftLastWriteTime.dwHighDateTime=0x1d5e2f8, nFileSizeHigh=0x0, nFileSizeLow=0x6203, dwReserved0=0x0, dwReserved1=0x0, cFileName="5K_i0.png", cAlternateFileName="")) returned 1
	[0103.102] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b113a20, ftCreationTime.dwHighDateTime=0x1d5ddc4, ftLastAccessTime.dwLowDateTime=0x5dd7b880, ftLastAccessTime.dwHighDateTime=0x1d5e584, ftLastWriteTime.dwLowDateTime=0x5dd7b880, ftLastWriteTime.dwHighDateTime=0x1d5e584, nFileSizeHigh=0x0, nFileSizeLow=0x80ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ojoUWQSFlWHqnLEwX.gif", cAlternateFileName="OJOUWQ~1.GIF")) returned 1
	[0103.103] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0a829a0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xa25b7f90, ftLastAccessTime.dwHighDateTime=0x1d5e1c5, ftLastWriteTime.dwLowDateTime=0xa25b7f90, ftLastWriteTime.dwHighDateTime=0x1d5e1c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pb9DrQgx", cAlternateFileName="")) returned 1
	[0103.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0103.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx", lpFilePart=0x0) returned 0x37
	[0103.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\", lpFilePart=0x0) returned 0x38
	[0103.109] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0a829a0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xa25b7f90, ftLastAccessTime.dwHighDateTime=0x1d5e1c5, ftLastWriteTime.dwLowDateTime=0xa25b7f90, ftLastWriteTime.dwHighDateTime=0x1d5e1c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0103.110] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0a829a0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xa25b7f90, ftLastAccessTime.dwHighDateTime=0x1d5e1c5, ftLastWriteTime.dwLowDateTime=0xa25b7f90, ftLastWriteTime.dwHighDateTime=0x1d5e1c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.111] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382ef320, ftCreationTime.dwHighDateTime=0x1d5da1f, ftLastAccessTime.dwLowDateTime=0xe764b90, ftLastAccessTime.dwHighDateTime=0x1d5db83, ftLastWriteTime.dwLowDateTime=0xe764b90, ftLastWriteTime.dwHighDateTime=0x1d5db83, nFileSizeHigh=0x0, nFileSizeLow=0x14242, dwReserved0=0x0, dwReserved1=0x0, cFileName="4R3h1Iwy.png", cAlternateFileName="")) returned 1
	[0103.111] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf58430, ftCreationTime.dwHighDateTime=0x1d5e583, ftLastAccessTime.dwLowDateTime=0x336b45d0, ftLastAccessTime.dwHighDateTime=0x1d5e3bd, ftLastWriteTime.dwLowDateTime=0x336b45d0, ftLastWriteTime.dwHighDateTime=0x1d5e3bd, nFileSizeHigh=0x0, nFileSizeLow=0xf42e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmKdf2U.png", cAlternateFileName="")) returned 1
	[0103.112] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d22d350, ftCreationTime.dwHighDateTime=0x1d5de72, ftLastAccessTime.dwLowDateTime=0xbd298160, ftLastAccessTime.dwHighDateTime=0x1d5e07f, ftLastWriteTime.dwLowDateTime=0xbd298160, ftLastWriteTime.dwHighDateTime=0x1d5e07f, nFileSizeHigh=0x0, nFileSizeLow=0x6bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="N-j-EX_PS9INrbRVKPt.jpg", cAlternateFileName="N-J-EX~1.JPG")) returned 1
	[0103.112] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdec35520, ftCreationTime.dwHighDateTime=0x1d5e297, ftLastAccessTime.dwLowDateTime=0xe295e8b0, ftLastAccessTime.dwHighDateTime=0x1d5ddfc, ftLastWriteTime.dwLowDateTime=0xe295e8b0, ftLastWriteTime.dwHighDateTime=0x1d5ddfc, nFileSizeHigh=0x0, nFileSizeLow=0x9f2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NabPcDM35oz3x.gif", cAlternateFileName="NABPCD~1.GIF")) returned 1
	[0103.113] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x647a8b00, ftCreationTime.dwHighDateTime=0x1d5e3c6, ftLastAccessTime.dwLowDateTime=0x791ad140, ftLastAccessTime.dwHighDateTime=0x1d5dc51, ftLastWriteTime.dwLowDateTime=0x791ad140, ftLastWriteTime.dwHighDateTime=0x1d5dc51, nFileSizeHigh=0x0, nFileSizeLow=0xb19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtzmSMXc.png", cAlternateFileName="")) returned 1
	[0103.114] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x647a8b00, ftCreationTime.dwHighDateTime=0x1d5e3c6, ftLastAccessTime.dwLowDateTime=0x791ad140, ftLastAccessTime.dwHighDateTime=0x1d5dc51, ftLastWriteTime.dwLowDateTime=0x791ad140, ftLastWriteTime.dwHighDateTime=0x1d5dc51, nFileSizeHigh=0x0, nFileSizeLow=0xb19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtzmSMXc.png", cAlternateFileName="")) returned 0
	[0103.114] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0103.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0103.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0103.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0103.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx", lpFilePart=0x0) returned 0x37
	[0103.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\", lpFilePart=0x0) returned 0x38
	[0103.115] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0a829a0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xa25b7f90, ftLastAccessTime.dwHighDateTime=0x1d5e1c5, ftLastWriteTime.dwLowDateTime=0xa25b7f90, ftLastWriteTime.dwHighDateTime=0x1d5e1c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0103.116] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0a829a0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xa25b7f90, ftLastAccessTime.dwHighDateTime=0x1d5e1c5, ftLastWriteTime.dwLowDateTime=0xa25b7f90, ftLastWriteTime.dwHighDateTime=0x1d5e1c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.117] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382ef320, ftCreationTime.dwHighDateTime=0x1d5da1f, ftLastAccessTime.dwLowDateTime=0xe764b90, ftLastAccessTime.dwHighDateTime=0x1d5db83, ftLastWriteTime.dwLowDateTime=0xe764b90, ftLastWriteTime.dwHighDateTime=0x1d5db83, nFileSizeHigh=0x0, nFileSizeLow=0x14242, dwReserved0=0x0, dwReserved1=0x0, cFileName="4R3h1Iwy.png", cAlternateFileName="")) returned 1
	[0103.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\4R3h1Iwy.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\4R3h1Iwy.png", lpFilePart=0x0) returned 0x44
	[0103.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0103.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\4R3h1Iwy.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\4r3h1iwy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.118] GetFileType (hFile=0x220) returned 0x1
	[0103.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0103.118] GetFileType (hFile=0x220) returned 0x1
	[0103.118] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x14242
	[0103.118] ReadFile (in: hFile=0x220, lpBuffer=0x26e9d20, nNumberOfBytesToRead=0x14242, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26e9d20*, lpNumberOfBytesRead=0x26ee84*=0x14242, lpOverlapped=0x0) returned 1
	[0103.123] CloseHandle (hObject=0x220) returned 1
	[0103.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\4R3h1Iwy.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\4R3h1Iwy.png.KEKW", lpFilePart=0x0) returned 0x49
	[0103.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0103.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\4R3h1Iwy.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\4r3h1iwy.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.125] GetFileType (hFile=0x220) returned 0x1
	[0103.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0103.125] GetFileType (hFile=0x220) returned 0x1
	[0103.126] WriteFile (in: hFile=0x220, lpBuffer=0x26ff664*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26ff664*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0103.129] CloseHandle (hObject=0x220) returned 1
	[0103.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\4R3h1Iwy.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\4R3h1Iwy.png", lpFilePart=0x0) returned 0x44
	[0103.129] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\4R3h1Iwy.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\4r3h1iwy.png")) returned 1
	[0103.136] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf58430, ftCreationTime.dwHighDateTime=0x1d5e583, ftLastAccessTime.dwLowDateTime=0x336b45d0, ftLastAccessTime.dwHighDateTime=0x1d5e3bd, ftLastWriteTime.dwLowDateTime=0x336b45d0, ftLastWriteTime.dwHighDateTime=0x1d5e3bd, nFileSizeHigh=0x0, nFileSizeLow=0xf42e, dwReserved0=0x0, dwReserved1=0x0, cFileName="jmKdf2U.png", cAlternateFileName="")) returned 1
	[0103.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\jmKdf2U.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\jmKdf2U.png", lpFilePart=0x0) returned 0x43
	[0103.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0103.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\jmKdf2U.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\jmkdf2u.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.137] GetFileType (hFile=0x220) returned 0x1
	[0103.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0103.137] GetFileType (hFile=0x220) returned 0x1
	[0103.137] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xf42e
	[0103.137] ReadFile (in: hFile=0x220, lpBuffer=0x2700ba8, nNumberOfBytesToRead=0xf42e, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2700ba8*, lpNumberOfBytesRead=0x26ee84*=0xf42e, lpOverlapped=0x0) returned 1
	[0103.141] CloseHandle (hObject=0x220) returned 1
	[0103.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\jmKdf2U.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\jmKdf2U.png.KEKW", lpFilePart=0x0) returned 0x48
	[0103.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0103.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\jmKdf2U.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\jmkdf2u.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.143] GetFileType (hFile=0x220) returned 0x1
	[0103.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0103.143] GetFileType (hFile=0x220) returned 0x1
	[0103.143] WriteFile (in: hFile=0x220, lpBuffer=0x27116d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27116d8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0103.146] CloseHandle (hObject=0x220) returned 1
	[0103.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\jmKdf2U.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\jmKdf2U.png", lpFilePart=0x0) returned 0x43
	[0103.146] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\jmKdf2U.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\jmkdf2u.png")) returned 1
	[0103.153] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d22d350, ftCreationTime.dwHighDateTime=0x1d5de72, ftLastAccessTime.dwLowDateTime=0xbd298160, ftLastAccessTime.dwHighDateTime=0x1d5e07f, ftLastWriteTime.dwLowDateTime=0xbd298160, ftLastWriteTime.dwHighDateTime=0x1d5e07f, nFileSizeHigh=0x0, nFileSizeLow=0x6bd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="N-j-EX_PS9INrbRVKPt.jpg", cAlternateFileName="N-J-EX~1.JPG")) returned 1
	[0103.154] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\N-j-EX_PS9INrbRVKPt.jpg", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\N-j-EX_PS9INrbRVKPt.jpg", lpFilePart=0x0) returned 0x4f
	[0103.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0103.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\N-j-EX_PS9INrbRVKPt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\n-j-ex_ps9inrbrvkpt.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.154] GetFileType (hFile=0x220) returned 0x1
	[0103.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0103.155] GetFileType (hFile=0x220) returned 0x1
	[0103.155] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x6bd3
	[0103.155] ReadFile (in: hFile=0x220, lpBuffer=0x2712d00, nNumberOfBytesToRead=0x6bd3, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2712d00*, lpNumberOfBytesRead=0x26ee84*=0x6bd3, lpOverlapped=0x0) returned 1
	[0103.158] CloseHandle (hObject=0x220) returned 1
	[0103.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\N-j-EX_PS9INrbRVKPt.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\N-j-EX_PS9INrbRVKPt.jpg.KEKW", lpFilePart=0x0) returned 0x54
	[0103.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0103.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\N-j-EX_PS9INrbRVKPt.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\n-j-ex_ps9inrbrvkpt.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.159] GetFileType (hFile=0x220) returned 0x1
	[0103.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0103.159] GetFileType (hFile=0x220) returned 0x1
	[0103.160] WriteFile (in: hFile=0x220, lpBuffer=0x271b01c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x271b01c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0103.163] CloseHandle (hObject=0x220) returned 1
	[0103.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\N-j-EX_PS9INrbRVKPt.jpg", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\N-j-EX_PS9INrbRVKPt.jpg", lpFilePart=0x0) returned 0x4f
	[0103.163] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\N-j-EX_PS9INrbRVKPt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\n-j-ex_ps9inrbrvkpt.jpg")) returned 1
	[0103.169] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdec35520, ftCreationTime.dwHighDateTime=0x1d5e297, ftLastAccessTime.dwLowDateTime=0xe295e8b0, ftLastAccessTime.dwHighDateTime=0x1d5ddfc, ftLastWriteTime.dwLowDateTime=0xe295e8b0, ftLastWriteTime.dwHighDateTime=0x1d5ddfc, nFileSizeHigh=0x0, nFileSizeLow=0x9f2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NabPcDM35oz3x.gif", cAlternateFileName="NABPCD~1.GIF")) returned 1
	[0103.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\NabPcDM35oz3x.gif", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\NabPcDM35oz3x.gif", lpFilePart=0x0) returned 0x49
	[0103.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0103.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\NabPcDM35oz3x.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\nabpcdm35oz3x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.170] GetFileType (hFile=0x220) returned 0x1
	[0103.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0103.170] GetFileType (hFile=0x220) returned 0x1
	[0103.170] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x9f2e
	[0103.170] ReadFile (in: hFile=0x220, lpBuffer=0x271c5fc, nNumberOfBytesToRead=0x9f2e, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x271c5fc*, lpNumberOfBytesRead=0x26ee84*=0x9f2e, lpOverlapped=0x0) returned 1
	[0103.173] CloseHandle (hObject=0x220) returned 1
	[0103.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\NabPcDM35oz3x.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\NabPcDM35oz3x.gif.KEKW", lpFilePart=0x0) returned 0x4e
	[0103.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0103.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\NabPcDM35oz3x.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\nabpcdm35oz3x.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.175] GetFileType (hFile=0x220) returned 0x1
	[0103.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0103.175] GetFileType (hFile=0x220) returned 0x1
	[0103.175] WriteFile (in: hFile=0x220, lpBuffer=0x2727c50*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2727c50*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0103.178] CloseHandle (hObject=0x220) returned 1
	[0103.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\NabPcDM35oz3x.gif", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\NabPcDM35oz3x.gif", lpFilePart=0x0) returned 0x49
	[0103.179] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\NabPcDM35oz3x.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\nabpcdm35oz3x.gif")) returned 1
	[0103.184] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x647a8b00, ftCreationTime.dwHighDateTime=0x1d5e3c6, ftLastAccessTime.dwLowDateTime=0x791ad140, ftLastAccessTime.dwHighDateTime=0x1d5dc51, ftLastWriteTime.dwLowDateTime=0x791ad140, ftLastWriteTime.dwHighDateTime=0x1d5dc51, nFileSizeHigh=0x0, nFileSizeLow=0xb19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtzmSMXc.png", cAlternateFileName="")) returned 1
	[0103.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\rtzmSMXc.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\rtzmSMXc.png", lpFilePart=0x0) returned 0x44
	[0103.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0103.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\rtzmSMXc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\rtzmsmxc.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.184] GetFileType (hFile=0x220) returned 0x1
	[0103.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0103.185] GetFileType (hFile=0x220) returned 0x1
	[0103.185] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xb19d
	[0103.185] ReadFile (in: hFile=0x220, lpBuffer=0x27291b8, nNumberOfBytesToRead=0xb19d, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27291b8*, lpNumberOfBytesRead=0x26ee84*=0xb19d, lpOverlapped=0x0) returned 1
	[0103.189] CloseHandle (hObject=0x220) returned 1
	[0103.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\rtzmSMXc.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\rtzmSMXc.png.KEKW", lpFilePart=0x0) returned 0x49
	[0103.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0103.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\rtzmSMXc.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\rtzmsmxc.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.190] GetFileType (hFile=0x220) returned 0x1
	[0103.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0103.190] GetFileType (hFile=0x220) returned 0x1
	[0103.190] WriteFile (in: hFile=0x220, lpBuffer=0x2735a58*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2735a58*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0103.193] CloseHandle (hObject=0x220) returned 1
	[0103.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\rtzmSMXc.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\rtzmSMXc.png", lpFilePart=0x0) returned 0x44
	[0103.194] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\rtzmSMXc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\rtzmsmxc.png")) returned 1
	[0103.201] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0103.202] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0103.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0103.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0103.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0103.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0103.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\pb9DrQgx\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\pb9drqgx\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0103.203] GetFileType (hFile=0x208) returned 0x1
	[0103.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0103.203] GetFileType (hFile=0x208) returned 0x1
	[0103.203] WriteFile (in: hFile=0x208, lpBuffer=0x2738168*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2738168*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0103.206] CloseHandle (hObject=0x208) returned 1
	[0103.207] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b0d970, ftCreationTime.dwHighDateTime=0x1d5df30, ftLastAccessTime.dwLowDateTime=0x43e2f430, ftLastAccessTime.dwHighDateTime=0x1d5dc4c, ftLastWriteTime.dwLowDateTime=0x43e2f430, ftLastWriteTime.dwHighDateTime=0x1d5dc4c, nFileSizeHigh=0x0, nFileSizeLow=0xb319, dwReserved0=0x0, dwReserved1=0x0, cFileName="Srk8Uh.gif", cAlternateFileName="")) returned 1
	[0103.207] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2846980, ftCreationTime.dwHighDateTime=0x1d5e70a, ftLastAccessTime.dwLowDateTime=0xc933d810, ftLastAccessTime.dwHighDateTime=0x1d5dff4, ftLastWriteTime.dwLowDateTime=0xc933d810, ftLastWriteTime.dwHighDateTime=0x1d5dff4, nFileSizeHigh=0x0, nFileSizeLow=0x10e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="tT7hDOlV_i.png", cAlternateFileName="TT7HDO~1.PNG")) returned 1
	[0103.208] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2846980, ftCreationTime.dwHighDateTime=0x1d5e70a, ftLastAccessTime.dwLowDateTime=0xc933d810, ftLastAccessTime.dwHighDateTime=0x1d5dff4, ftLastWriteTime.dwLowDateTime=0xc933d810, ftLastWriteTime.dwHighDateTime=0x1d5dff4, nFileSizeHigh=0x0, nFileSizeLow=0x10e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="tT7hDOlV_i.png", cAlternateFileName="TT7HDO~1.PNG")) returned 0
	[0103.208] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0103.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0103.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0103.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0103.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm", lpFilePart=0x0) returned 0x2e
	[0103.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\", lpFilePart=0x0) returned 0x2f
	[0103.210] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a5ad9b0, ftCreationTime.dwHighDateTime=0x1d5db8c, ftLastAccessTime.dwLowDateTime=0x9aa807c0, ftLastAccessTime.dwHighDateTime=0x1d5e380, ftLastWriteTime.dwLowDateTime=0x9aa807c0, ftLastWriteTime.dwHighDateTime=0x1d5e380, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0103.210] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a5ad9b0, ftCreationTime.dwHighDateTime=0x1d5db8c, ftLastAccessTime.dwLowDateTime=0x9aa807c0, ftLastAccessTime.dwHighDateTime=0x1d5e380, ftLastWriteTime.dwLowDateTime=0x9aa807c0, ftLastWriteTime.dwHighDateTime=0x1d5e380, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.211] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6a7afb0, ftCreationTime.dwHighDateTime=0x1d5d90e, ftLastAccessTime.dwLowDateTime=0xd2911d30, ftLastAccessTime.dwHighDateTime=0x1d5e2f8, ftLastWriteTime.dwLowDateTime=0xd2911d30, ftLastWriteTime.dwHighDateTime=0x1d5e2f8, nFileSizeHigh=0x0, nFileSizeLow=0x6203, dwReserved0=0x0, dwReserved1=0x0, cFileName="5K_i0.png", cAlternateFileName="")) returned 1
	[0103.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\5K_i0.png", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\5K_i0.png", lpFilePart=0x0) returned 0x38
	[0103.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0103.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\5K_i0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\5k_i0.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0103.212] GetFileType (hFile=0x208) returned 0x1
	[0103.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0103.212] GetFileType (hFile=0x208) returned 0x1
	[0103.212] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x6203
	[0103.213] ReadFile (in: hFile=0x208, lpBuffer=0x273a08c, nNumberOfBytesToRead=0x6203, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x273a08c*, lpNumberOfBytesRead=0x26ef24*=0x6203, lpOverlapped=0x0) returned 1
	[0103.216] CloseHandle (hObject=0x208) returned 1
	[0103.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\5K_i0.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\5K_i0.png.KEKW", lpFilePart=0x0) returned 0x3d
	[0103.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0103.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\5K_i0.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\5k_i0.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0103.217] GetFileType (hFile=0x208) returned 0x1
	[0103.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0103.217] GetFileType (hFile=0x208) returned 0x1
	[0103.218] WriteFile (in: hFile=0x208, lpBuffer=0x274195c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x274195c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0103.220] CloseHandle (hObject=0x208) returned 1
	[0103.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\5K_i0.png", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\5K_i0.png", lpFilePart=0x0) returned 0x38
	[0103.221] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\5K_i0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\5k_i0.png")) returned 1
	[0103.226] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b113a20, ftCreationTime.dwHighDateTime=0x1d5ddc4, ftLastAccessTime.dwLowDateTime=0x5dd7b880, ftLastAccessTime.dwHighDateTime=0x1d5e584, ftLastWriteTime.dwLowDateTime=0x5dd7b880, ftLastWriteTime.dwHighDateTime=0x1d5e584, nFileSizeHigh=0x0, nFileSizeLow=0x80ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ojoUWQSFlWHqnLEwX.gif", cAlternateFileName="OJOUWQ~1.GIF")) returned 1
	[0103.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\ojoUWQSFlWHqnLEwX.gif", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\ojoUWQSFlWHqnLEwX.gif", lpFilePart=0x0) returned 0x44
	[0103.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0103.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\ojoUWQSFlWHqnLEwX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\ojouwqsflwhqnlewx.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0103.227] GetFileType (hFile=0x208) returned 0x1
	[0103.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0103.227] GetFileType (hFile=0x208) returned 0x1
	[0103.227] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x80ef
	[0103.227] ReadFile (in: hFile=0x208, lpBuffer=0x2742eec, nNumberOfBytesToRead=0x80ef, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2742eec*, lpNumberOfBytesRead=0x26ef24*=0x80ef, lpOverlapped=0x0) returned 1
	[0103.231] CloseHandle (hObject=0x208) returned 1
	[0103.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\ojoUWQSFlWHqnLEwX.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\ojoUWQSFlWHqnLEwX.gif.KEKW", lpFilePart=0x0) returned 0x49
	[0103.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0103.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\ojoUWQSFlWHqnLEwX.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\ojouwqsflwhqnlewx.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0103.232] GetFileType (hFile=0x208) returned 0x1
	[0103.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0103.232] GetFileType (hFile=0x208) returned 0x1
	[0103.233] WriteFile (in: hFile=0x208, lpBuffer=0x274c6f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x274c6f0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0103.236] CloseHandle (hObject=0x208) returned 1
	[0103.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\ojoUWQSFlWHqnLEwX.gif", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\ojoUWQSFlWHqnLEwX.gif", lpFilePart=0x0) returned 0x44
	[0103.236] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\ojoUWQSFlWHqnLEwX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\ojouwqsflwhqnlewx.gif")) returned 1
	[0103.244] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0a829a0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xe7571b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xe7571b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pb9DrQgx", cAlternateFileName="")) returned 1
	[0103.244] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b0d970, ftCreationTime.dwHighDateTime=0x1d5df30, ftLastAccessTime.dwLowDateTime=0x43e2f430, ftLastAccessTime.dwHighDateTime=0x1d5dc4c, ftLastWriteTime.dwLowDateTime=0x43e2f430, ftLastWriteTime.dwHighDateTime=0x1d5dc4c, nFileSizeHigh=0x0, nFileSizeLow=0xb319, dwReserved0=0x0, dwReserved1=0x0, cFileName="Srk8Uh.gif", cAlternateFileName="")) returned 1
	[0103.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\Srk8Uh.gif", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\Srk8Uh.gif", lpFilePart=0x0) returned 0x39
	[0103.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0103.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\Srk8Uh.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\srk8uh.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0103.245] GetFileType (hFile=0x208) returned 0x1
	[0103.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0103.245] GetFileType (hFile=0x208) returned 0x1
	[0103.246] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xb319
	[0103.246] ReadFile (in: hFile=0x208, lpBuffer=0x274dce8, nNumberOfBytesToRead=0xb319, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x274dce8*, lpNumberOfBytesRead=0x26ef24*=0xb319, lpOverlapped=0x0) returned 1
	[0103.249] CloseHandle (hObject=0x208) returned 1
	[0103.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\Srk8Uh.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\Srk8Uh.gif.KEKW", lpFilePart=0x0) returned 0x3e
	[0103.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0103.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\Srk8Uh.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\srk8uh.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0103.251] GetFileType (hFile=0x208) returned 0x1
	[0103.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0103.251] GetFileType (hFile=0x208) returned 0x1
	[0103.251] WriteFile (in: hFile=0x208, lpBuffer=0x275a6d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x275a6d8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0103.254] CloseHandle (hObject=0x208) returned 1
	[0103.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\Srk8Uh.gif", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\Srk8Uh.gif", lpFilePart=0x0) returned 0x39
	[0103.254] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\Srk8Uh.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\srk8uh.gif")) returned 1
	[0103.534] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2846980, ftCreationTime.dwHighDateTime=0x1d5e70a, ftLastAccessTime.dwLowDateTime=0xc933d810, ftLastAccessTime.dwHighDateTime=0x1d5dff4, ftLastWriteTime.dwLowDateTime=0xc933d810, ftLastWriteTime.dwHighDateTime=0x1d5dff4, nFileSizeHigh=0x0, nFileSizeLow=0x10e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="tT7hDOlV_i.png", cAlternateFileName="TT7HDO~1.PNG")) returned 1
	[0103.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\tT7hDOlV_i.png", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\tT7hDOlV_i.png", lpFilePart=0x0) returned 0x3d
	[0103.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0103.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\tT7hDOlV_i.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\tt7hdolv_i.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0103.535] GetFileType (hFile=0x208) returned 0x1
	[0103.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0103.535] GetFileType (hFile=0x208) returned 0x1
	[0103.535] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x10e7c
	[0103.536] ReadFile (in: hFile=0x208, lpBuffer=0x275bbf4, nNumberOfBytesToRead=0x10e7c, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x275bbf4*, lpNumberOfBytesRead=0x26ef24*=0x10e7c, lpOverlapped=0x0) returned 1
	[0103.539] CloseHandle (hObject=0x208) returned 1
	[0103.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\tT7hDOlV_i.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\tT7hDOlV_i.png.KEKW", lpFilePart=0x0) returned 0x42
	[0103.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0103.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\tT7hDOlV_i.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\tt7hdolv_i.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0103.541] GetFileType (hFile=0x208) returned 0x1
	[0103.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0103.542] GetFileType (hFile=0x208) returned 0x1
	[0103.542] WriteFile (in: hFile=0x208, lpBuffer=0x276e15c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x276e15c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0103.545] CloseHandle (hObject=0x208) returned 1
	[0103.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\tT7hDOlV_i.png", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\tT7hDOlV_i.png", lpFilePart=0x0) returned 0x3d
	[0103.546] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\tT7hDOlV_i.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\tt7hdolv_i.png")) returned 1
	[0103.651] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0103.651] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0103.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0103.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0103.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0103.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0103.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-UucLCm\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-uuclcm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0103.653] GetFileType (hFile=0x204) returned 0x1
	[0103.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0103.653] GetFileType (hFile=0x204) returned 0x1
	[0103.654] WriteFile (in: hFile=0x204, lpBuffer=0x277083c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x277083c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0103.656] CloseHandle (hObject=0x204) returned 1
	[0103.657] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb204320, ftCreationTime.dwHighDateTime=0x1d5dfeb, ftLastAccessTime.dwLowDateTime=0xe486ce90, ftLastAccessTime.dwHighDateTime=0x1d5e4d3, ftLastWriteTime.dwLowDateTime=0xe486ce90, ftLastWriteTime.dwHighDateTime=0x1d5e4d3, nFileSizeHigh=0x0, nFileSizeLow=0xad14, dwReserved0=0x0, dwReserved1=0x0, cFileName="CKK20aLXbvslgLua3s5d.bmp", cAlternateFileName="CKK20A~1.BMP")) returned 1
	[0103.657] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bac61b0, ftCreationTime.dwHighDateTime=0x1d5e64e, ftLastAccessTime.dwLowDateTime=0x67c1bb20, ftLastAccessTime.dwHighDateTime=0x1d5e494, ftLastWriteTime.dwLowDateTime=0x67c1bb20, ftLastWriteTime.dwHighDateTime=0x1d5e494, nFileSizeHigh=0x0, nFileSizeLow=0x65fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="cQJyPrU4N.gif", cAlternateFileName="CQJYPR~1.GIF")) returned 1
	[0103.658] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0103.659] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3bd6090, ftCreationTime.dwHighDateTime=0x1d5de6a, ftLastAccessTime.dwLowDateTime=0xc0e164d0, ftLastAccessTime.dwHighDateTime=0x1d5de04, ftLastWriteTime.dwLowDateTime=0xc0e164d0, ftLastWriteTime.dwHighDateTime=0x1d5de04, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fJWc1mtAmAsE8H FQtfy", cAlternateFileName="FJWC1M~1")) returned 1
	[0103.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0103.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy", lpFilePart=0x0) returned 0x3b
	[0103.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\", lpFilePart=0x0) returned 0x3c
	[0103.659] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3bd6090, ftCreationTime.dwHighDateTime=0x1d5de6a, ftLastAccessTime.dwLowDateTime=0xc0e164d0, ftLastAccessTime.dwHighDateTime=0x1d5de04, ftLastWriteTime.dwLowDateTime=0xc0e164d0, ftLastWriteTime.dwHighDateTime=0x1d5de04, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0103.660] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3bd6090, ftCreationTime.dwHighDateTime=0x1d5de6a, ftLastAccessTime.dwLowDateTime=0xc0e164d0, ftLastAccessTime.dwHighDateTime=0x1d5de04, ftLastWriteTime.dwLowDateTime=0xc0e164d0, ftLastWriteTime.dwHighDateTime=0x1d5de04, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.661] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x738b0ba0, ftCreationTime.dwHighDateTime=0x1d5deef, ftLastAccessTime.dwLowDateTime=0x8fa71a30, ftLastAccessTime.dwHighDateTime=0x1d5de0a, ftLastWriteTime.dwLowDateTime=0x8fa71a30, ftLastWriteTime.dwHighDateTime=0x1d5de0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8alGuK51aX", cAlternateFileName="8ALGUK~1")) returned 1
	[0103.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0103.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX", lpFilePart=0x0) returned 0x46
	[0103.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\", lpFilePart=0x0) returned 0x47
	[0103.662] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x738b0ba0, ftCreationTime.dwHighDateTime=0x1d5deef, ftLastAccessTime.dwLowDateTime=0x8fa71a30, ftLastAccessTime.dwHighDateTime=0x1d5de0a, ftLastWriteTime.dwLowDateTime=0x8fa71a30, ftLastWriteTime.dwHighDateTime=0x1d5de0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0103.663] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x738b0ba0, ftCreationTime.dwHighDateTime=0x1d5deef, ftLastAccessTime.dwLowDateTime=0x8fa71a30, ftLastAccessTime.dwHighDateTime=0x1d5de0a, ftLastWriteTime.dwLowDateTime=0x8fa71a30, ftLastWriteTime.dwHighDateTime=0x1d5de0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.663] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94d1cd60, ftCreationTime.dwHighDateTime=0x1d5df46, ftLastAccessTime.dwLowDateTime=0xcbaff020, ftLastAccessTime.dwHighDateTime=0x1d5da58, ftLastWriteTime.dwLowDateTime=0xcbaff020, ftLastWriteTime.dwHighDateTime=0x1d5da58, nFileSizeHigh=0x0, nFileSizeLow=0x170b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ItgQf9oCsRCV.gif", cAlternateFileName="ITGQF9~1.GIF")) returned 1
	[0103.664] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e988f0, ftCreationTime.dwHighDateTime=0x1d5dc65, ftLastAccessTime.dwLowDateTime=0x28287d90, ftLastAccessTime.dwHighDateTime=0x1d5e116, ftLastWriteTime.dwLowDateTime=0x28287d90, ftLastWriteTime.dwHighDateTime=0x1d5e116, nFileSizeHigh=0x0, nFileSizeLow=0x13092, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ldcnj_-F.gif", cAlternateFileName="")) returned 1
	[0103.664] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46e6a1c0, ftCreationTime.dwHighDateTime=0x1d5daa0, ftLastAccessTime.dwLowDateTime=0x9b4f52b0, ftLastAccessTime.dwHighDateTime=0x1d5dd8a, ftLastWriteTime.dwLowDateTime=0x9b4f52b0, ftLastWriteTime.dwHighDateTime=0x1d5dd8a, nFileSizeHigh=0x0, nFileSizeLow=0x17198, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLnbw98BN0OZqVzk9.jpg", cAlternateFileName="SLNBW9~1.JPG")) returned 1
	[0103.666] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf70fb700, ftCreationTime.dwHighDateTime=0x1d5e052, ftLastAccessTime.dwLowDateTime=0x4f54f660, ftLastAccessTime.dwHighDateTime=0x1d5db5c, ftLastWriteTime.dwLowDateTime=0x4f54f660, ftLastWriteTime.dwHighDateTime=0x1d5db5c, nFileSizeHigh=0x0, nFileSizeLow=0x61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="txXHEm8A.jpg", cAlternateFileName="")) returned 1
	[0103.666] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619340b0, ftCreationTime.dwHighDateTime=0x1d5e030, ftLastAccessTime.dwLowDateTime=0xf0b09e30, ftLastAccessTime.dwHighDateTime=0x1d5dbc3, ftLastWriteTime.dwLowDateTime=0xf0b09e30, ftLastWriteTime.dwHighDateTime=0x1d5dbc3, nFileSizeHigh=0x0, nFileSizeLow=0x14e20, dwReserved0=0x0, dwReserved1=0x0, cFileName="VjlnNgrmZO0sS_.png", cAlternateFileName="VJLNNG~1.PNG")) returned 1
	[0103.667] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab730e60, ftCreationTime.dwHighDateTime=0x1d5e182, ftLastAccessTime.dwLowDateTime=0xdd098eb0, ftLastAccessTime.dwHighDateTime=0x1d5dcda, ftLastWriteTime.dwLowDateTime=0xdd098eb0, ftLastWriteTime.dwHighDateTime=0x1d5dcda, nFileSizeHigh=0x0, nFileSizeLow=0x9ba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="X-y0EtjtslK.png", cAlternateFileName="X-Y0ET~1.PNG")) returned 1
	[0103.667] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeea6e80, ftCreationTime.dwHighDateTime=0x1d5dab6, ftLastAccessTime.dwLowDateTime=0x2c949d0, ftLastAccessTime.dwHighDateTime=0x1d5de00, ftLastWriteTime.dwLowDateTime=0x2c949d0, ftLastWriteTime.dwHighDateTime=0x1d5de00, nFileSizeHigh=0x0, nFileSizeLow=0xc331, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZjN0.png", cAlternateFileName="")) returned 1
	[0103.668] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd95e0800, ftCreationTime.dwHighDateTime=0x1d5dbcb, ftLastAccessTime.dwLowDateTime=0x5576a020, ftLastAccessTime.dwHighDateTime=0x1d5e02f, ftLastWriteTime.dwLowDateTime=0x5576a020, ftLastWriteTime.dwHighDateTime=0x1d5e02f, nFileSizeHigh=0x0, nFileSizeLow=0x7033, dwReserved0=0x0, dwReserved1=0x0, cFileName="zNwJR.png", cAlternateFileName="")) returned 1
	[0103.668] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd95e0800, ftCreationTime.dwHighDateTime=0x1d5dbcb, ftLastAccessTime.dwLowDateTime=0x5576a020, ftLastAccessTime.dwHighDateTime=0x1d5e02f, ftLastWriteTime.dwLowDateTime=0x5576a020, ftLastWriteTime.dwHighDateTime=0x1d5e02f, nFileSizeHigh=0x0, nFileSizeLow=0x7033, dwReserved0=0x0, dwReserved1=0x0, cFileName="zNwJR.png", cAlternateFileName="")) returned 0
	[0103.669] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0103.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0103.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0103.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0103.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX", lpFilePart=0x0) returned 0x46
	[0103.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\", lpFilePart=0x0) returned 0x47
	[0103.670] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x738b0ba0, ftCreationTime.dwHighDateTime=0x1d5deef, ftLastAccessTime.dwLowDateTime=0x8fa71a30, ftLastAccessTime.dwHighDateTime=0x1d5de0a, ftLastWriteTime.dwLowDateTime=0x8fa71a30, ftLastWriteTime.dwHighDateTime=0x1d5de0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0103.670] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x738b0ba0, ftCreationTime.dwHighDateTime=0x1d5deef, ftLastAccessTime.dwLowDateTime=0x8fa71a30, ftLastAccessTime.dwHighDateTime=0x1d5de0a, ftLastWriteTime.dwLowDateTime=0x8fa71a30, ftLastWriteTime.dwHighDateTime=0x1d5de0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0103.671] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94d1cd60, ftCreationTime.dwHighDateTime=0x1d5df46, ftLastAccessTime.dwLowDateTime=0xcbaff020, ftLastAccessTime.dwHighDateTime=0x1d5da58, ftLastWriteTime.dwLowDateTime=0xcbaff020, ftLastWriteTime.dwHighDateTime=0x1d5da58, nFileSizeHigh=0x0, nFileSizeLow=0x170b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ItgQf9oCsRCV.gif", cAlternateFileName="ITGQF9~1.GIF")) returned 1
	[0103.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ItgQf9oCsRCV.gif", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ItgQf9oCsRCV.gif", lpFilePart=0x0) returned 0x57
	[0103.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0103.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ItgQf9oCsRCV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\itgqf9ocsrcv.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.672] GetFileType (hFile=0x220) returned 0x1
	[0103.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0103.672] GetFileType (hFile=0x220) returned 0x1
	[0103.672] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x170b5
	[0103.673] ReadFile (in: hFile=0x220, lpBuffer=0x3743408, nNumberOfBytesToRead=0x170b5, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x3743408*, lpNumberOfBytesRead=0x26ee84*=0x170b5, lpOverlapped=0x0) returned 1
	[0103.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ItgQf9oCsRCV.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ItgQf9oCsRCV.gif.KEKW", lpFilePart=0x0) returned 0x5c
	[0103.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0103.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ItgQf9oCsRCV.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\itgqf9ocsrcv.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.784] GetFileType (hFile=0x220) returned 0x1
	[0103.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0103.784] GetFileType (hFile=0x220) returned 0x1
	[0103.784] WriteFile (in: hFile=0x220, lpBuffer=0x27768c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27768c0*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0103.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ItgQf9oCsRCV.gif", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ItgQf9oCsRCV.gif", lpFilePart=0x0) returned 0x57
	[0103.788] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ItgQf9oCsRCV.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\itgqf9ocsrcv.gif")) returned 1
	[0103.796] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e988f0, ftCreationTime.dwHighDateTime=0x1d5dc65, ftLastAccessTime.dwLowDateTime=0x28287d90, ftLastAccessTime.dwHighDateTime=0x1d5e116, ftLastWriteTime.dwLowDateTime=0x28287d90, ftLastWriteTime.dwHighDateTime=0x1d5e116, nFileSizeHigh=0x0, nFileSizeLow=0x13092, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ldcnj_-F.gif", cAlternateFileName="")) returned 1
	[0103.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\Ldcnj_-F.gif", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\Ldcnj_-F.gif", lpFilePart=0x0) returned 0x53
	[0103.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0103.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\Ldcnj_-F.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\ldcnj_-f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.797] GetFileType (hFile=0x220) returned 0x1
	[0103.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0103.797] GetFileType (hFile=0x220) returned 0x1
	[0103.797] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x13092
	[0103.798] ReadFile (in: hFile=0x220, lpBuffer=0x2777ef0, nNumberOfBytesToRead=0x13092, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2777ef0*, lpNumberOfBytesRead=0x26ee84*=0x13092, lpOverlapped=0x0) returned 1
	[0103.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\Ldcnj_-F.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\Ldcnj_-F.gif.KEKW", lpFilePart=0x0) returned 0x58
	[0103.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0103.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\Ldcnj_-F.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\ldcnj_-f.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.803] GetFileType (hFile=0x220) returned 0x1
	[0103.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0103.803] GetFileType (hFile=0x220) returned 0x1
	[0103.803] WriteFile (in: hFile=0x220, lpBuffer=0x278c6c4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x278c6c4*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0103.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\Ldcnj_-F.gif", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\Ldcnj_-F.gif", lpFilePart=0x0) returned 0x53
	[0103.806] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\Ldcnj_-F.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\ldcnj_-f.gif")) returned 1
	[0103.812] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46e6a1c0, ftCreationTime.dwHighDateTime=0x1d5daa0, ftLastAccessTime.dwLowDateTime=0x9b4f52b0, ftLastAccessTime.dwHighDateTime=0x1d5dd8a, ftLastWriteTime.dwLowDateTime=0x9b4f52b0, ftLastWriteTime.dwHighDateTime=0x1d5dd8a, nFileSizeHigh=0x0, nFileSizeLow=0x17198, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLnbw98BN0OZqVzk9.jpg", cAlternateFileName="SLNBW9~1.JPG")) returned 1
	[0103.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\SLnbw98BN0OZqVzk9.jpg", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\SLnbw98BN0OZqVzk9.jpg", lpFilePart=0x0) returned 0x5c
	[0103.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0103.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\SLnbw98BN0OZqVzk9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\slnbw98bn0ozqvzk9.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.813] GetFileType (hFile=0x220) returned 0x1
	[0103.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0103.814] GetFileType (hFile=0x220) returned 0x1
	[0103.814] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x17198
	[0103.815] ReadFile (in: hFile=0x220, lpBuffer=0x375a4e0, nNumberOfBytesToRead=0x17198, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x375a4e0*, lpNumberOfBytesRead=0x26ee84*=0x17198, lpOverlapped=0x0) returned 1
	[0103.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\SLnbw98BN0OZqVzk9.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\SLnbw98BN0OZqVzk9.jpg.KEKW", lpFilePart=0x0) returned 0x61
	[0103.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0103.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\SLnbw98BN0OZqVzk9.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\slnbw98bn0ozqvzk9.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.866] GetFileType (hFile=0x220) returned 0x1
	[0103.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0103.866] GetFileType (hFile=0x220) returned 0x1
	[0103.866] WriteFile (in: hFile=0x220, lpBuffer=0x278f510*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x278f510*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0103.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\SLnbw98BN0OZqVzk9.jpg", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\SLnbw98BN0OZqVzk9.jpg", lpFilePart=0x0) returned 0x5c
	[0103.871] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\SLnbw98BN0OZqVzk9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\slnbw98bn0ozqvzk9.jpg")) returned 1
	[0103.878] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf70fb700, ftCreationTime.dwHighDateTime=0x1d5e052, ftLastAccessTime.dwLowDateTime=0x4f54f660, ftLastAccessTime.dwHighDateTime=0x1d5db5c, ftLastWriteTime.dwLowDateTime=0x4f54f660, ftLastWriteTime.dwHighDateTime=0x1d5db5c, nFileSizeHigh=0x0, nFileSizeLow=0x61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="txXHEm8A.jpg", cAlternateFileName="")) returned 1
	[0103.879] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\txXHEm8A.jpg", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\txXHEm8A.jpg", lpFilePart=0x0) returned 0x53
	[0103.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0103.879] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\txXHEm8A.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\txxhem8a.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.879] GetFileType (hFile=0x220) returned 0x1
	[0103.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0103.880] GetFileType (hFile=0x220) returned 0x1
	[0103.880] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x61e
	[0103.880] ReadFile (in: hFile=0x220, lpBuffer=0x2791178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2791178*, lpNumberOfBytesRead=0x26ee84*=0x61e, lpOverlapped=0x0) returned 1
	[0103.883] CloseHandle (hObject=0x220) returned 1
	[0103.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\txXHEm8A.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\txXHEm8A.jpg.KEKW", lpFilePart=0x0) returned 0x58
	[0103.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0103.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\txXHEm8A.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\txxhem8a.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.885] GetFileType (hFile=0x220) returned 0x1
	[0103.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0103.885] GetFileType (hFile=0x220) returned 0x1
	[0103.885] WriteFile (in: hFile=0x220, lpBuffer=0x27938b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27938b8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0103.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\txXHEm8A.jpg", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\txXHEm8A.jpg", lpFilePart=0x0) returned 0x53
	[0103.889] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\txXHEm8A.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\txxhem8a.jpg")) returned 1
	[0103.894] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619340b0, ftCreationTime.dwHighDateTime=0x1d5e030, ftLastAccessTime.dwLowDateTime=0xf0b09e30, ftLastAccessTime.dwHighDateTime=0x1d5dbc3, ftLastWriteTime.dwLowDateTime=0xf0b09e30, ftLastWriteTime.dwHighDateTime=0x1d5dbc3, nFileSizeHigh=0x0, nFileSizeLow=0x14e20, dwReserved0=0x0, dwReserved1=0x0, cFileName="VjlnNgrmZO0sS_.png", cAlternateFileName="VJLNNG~1.PNG")) returned 1
	[0103.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\VjlnNgrmZO0sS_.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\VjlnNgrmZO0sS_.png", lpFilePart=0x0) returned 0x59
	[0103.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0103.894] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\VjlnNgrmZO0sS_.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\vjlnngrmzo0ss_.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.895] GetFileType (hFile=0x220) returned 0x1
	[0103.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0103.895] GetFileType (hFile=0x220) returned 0x1
	[0103.895] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x14e20
	[0103.896] ReadFile (in: hFile=0x220, lpBuffer=0x3771698, nNumberOfBytesToRead=0x14e20, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x3771698*, lpNumberOfBytesRead=0x26ee84*=0x14e20, lpOverlapped=0x0) returned 1
	[0103.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\VjlnNgrmZO0sS_.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\VjlnNgrmZO0sS_.png.KEKW", lpFilePart=0x0) returned 0x5e
	[0103.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0103.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\VjlnNgrmZO0sS_.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\vjlnngrmzo0ss_.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0103.904] GetFileType (hFile=0x220) returned 0x1
	[0103.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0103.904] GetFileType (hFile=0x220) returned 0x1
	[0103.904] WriteFile (in: hFile=0x220, lpBuffer=0x27966c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27966c0*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0103.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\VjlnNgrmZO0sS_.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\VjlnNgrmZO0sS_.png", lpFilePart=0x0) returned 0x59
	[0103.907] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\VjlnNgrmZO0sS_.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\vjlnngrmzo0ss_.png")) returned 1
	[0104.121] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab730e60, ftCreationTime.dwHighDateTime=0x1d5e182, ftLastAccessTime.dwLowDateTime=0xdd098eb0, ftLastAccessTime.dwHighDateTime=0x1d5dcda, ftLastWriteTime.dwLowDateTime=0xdd098eb0, ftLastWriteTime.dwHighDateTime=0x1d5dcda, nFileSizeHigh=0x0, nFileSizeLow=0x9ba3, dwReserved0=0x0, dwReserved1=0x0, cFileName="X-y0EtjtslK.png", cAlternateFileName="X-Y0ET~1.PNG")) returned 1
	[0104.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\X-y0EtjtslK.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\X-y0EtjtslK.png", lpFilePart=0x0) returned 0x56
	[0104.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0104.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\X-y0EtjtslK.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\x-y0etjtslk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0104.122] GetFileType (hFile=0x220) returned 0x1
	[0104.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0104.122] GetFileType (hFile=0x220) returned 0x1
	[0104.122] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x9ba3
	[0104.122] ReadFile (in: hFile=0x220, lpBuffer=0x2797d50, nNumberOfBytesToRead=0x9ba3, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2797d50*, lpNumberOfBytesRead=0x26ee84*=0x9ba3, lpOverlapped=0x0) returned 1
	[0104.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\X-y0EtjtslK.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\X-y0EtjtslK.png.KEKW", lpFilePart=0x0) returned 0x5b
	[0104.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0104.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\X-y0EtjtslK.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\x-y0etjtslk.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0104.127] GetFileType (hFile=0x220) returned 0x1
	[0104.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0104.127] GetFileType (hFile=0x220) returned 0x1
	[0104.127] WriteFile (in: hFile=0x220, lpBuffer=0x27a3044*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27a3044*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0104.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\X-y0EtjtslK.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\X-y0EtjtslK.png", lpFilePart=0x0) returned 0x56
	[0104.131] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\X-y0EtjtslK.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\x-y0etjtslk.png")) returned 1
	[0104.137] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeea6e80, ftCreationTime.dwHighDateTime=0x1d5dab6, ftLastAccessTime.dwLowDateTime=0x2c949d0, ftLastAccessTime.dwHighDateTime=0x1d5de00, ftLastWriteTime.dwLowDateTime=0x2c949d0, ftLastWriteTime.dwHighDateTime=0x1d5de00, nFileSizeHigh=0x0, nFileSizeLow=0xc331, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZjN0.png", cAlternateFileName="")) returned 1
	[0104.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ZjN0.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ZjN0.png", lpFilePart=0x0) returned 0x4f
	[0104.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0104.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ZjN0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\zjn0.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0104.138] GetFileType (hFile=0x220) returned 0x1
	[0104.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0104.138] GetFileType (hFile=0x220) returned 0x1
	[0104.138] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc331
	[0104.138] ReadFile (in: hFile=0x220, lpBuffer=0x27a4634, nNumberOfBytesToRead=0xc331, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27a4634*, lpNumberOfBytesRead=0x26ee84*=0xc331, lpOverlapped=0x0) returned 1
	[0104.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ZjN0.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ZjN0.png.KEKW", lpFilePart=0x0) returned 0x54
	[0104.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0104.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ZjN0.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\zjn0.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0104.143] GetFileType (hFile=0x220) returned 0x1
	[0104.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0104.144] GetFileType (hFile=0x220) returned 0x1
	[0104.144] WriteFile (in: hFile=0x220, lpBuffer=0x27b2090*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27b2090*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0104.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ZjN0.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ZjN0.png", lpFilePart=0x0) returned 0x4f
	[0104.147] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\ZjN0.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\zjn0.png")) returned 1
	[0104.157] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd95e0800, ftCreationTime.dwHighDateTime=0x1d5dbcb, ftLastAccessTime.dwLowDateTime=0x5576a020, ftLastAccessTime.dwHighDateTime=0x1d5e02f, ftLastWriteTime.dwLowDateTime=0x5576a020, ftLastWriteTime.dwHighDateTime=0x1d5e02f, nFileSizeHigh=0x0, nFileSizeLow=0x7033, dwReserved0=0x0, dwReserved1=0x0, cFileName="zNwJR.png", cAlternateFileName="")) returned 1
	[0104.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\zNwJR.png", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\zNwJR.png", lpFilePart=0x0) returned 0x50
	[0104.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0104.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\zNwJR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\znwjr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0104.158] GetFileType (hFile=0x220) returned 0x1
	[0104.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0104.159] GetFileType (hFile=0x220) returned 0x1
	[0104.159] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x7033
	[0104.159] ReadFile (in: hFile=0x220, lpBuffer=0x27b3684, nNumberOfBytesToRead=0x7033, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27b3684*, lpNumberOfBytesRead=0x26ee84*=0x7033, lpOverlapped=0x0) returned 1
	[0104.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\zNwJR.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\zNwJR.png.KEKW", lpFilePart=0x0) returned 0x55
	[0104.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0104.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\zNwJR.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\znwjr.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0104.165] GetFileType (hFile=0x220) returned 0x1
	[0104.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0104.165] GetFileType (hFile=0x220) returned 0x1
	[0104.166] WriteFile (in: hFile=0x220, lpBuffer=0x27bbde4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27bbde4*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0104.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\zNwJR.png", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\zNwJR.png", lpFilePart=0x0) returned 0x50
	[0104.169] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\zNwJR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\znwjr.png")) returned 1
	[0104.172] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.172] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0104.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0104.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0104.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0104.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0104.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\8alGuK51aX\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\8alguk51ax\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0104.174] GetFileType (hFile=0x208) returned 0x1
	[0104.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0104.174] GetFileType (hFile=0x208) returned 0x1
	[0104.174] WriteFile (in: hFile=0x208, lpBuffer=0x27be54c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27be54c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0104.177] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff791340, ftCreationTime.dwHighDateTime=0x1d5df45, ftLastAccessTime.dwLowDateTime=0x420a3d40, ftLastAccessTime.dwHighDateTime=0x1d5d8c2, ftLastWriteTime.dwLowDateTime=0x420a3d40, ftLastWriteTime.dwHighDateTime=0x1d5d8c2, nFileSizeHigh=0x0, nFileSizeLow=0xf6f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="k qlWax.bmp", cAlternateFileName="KQLWAX~1.BMP")) returned 1
	[0104.178] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2f4620, ftCreationTime.dwHighDateTime=0x1d5e283, ftLastAccessTime.dwLowDateTime=0x85d01750, ftLastAccessTime.dwHighDateTime=0x1d5e7e2, ftLastWriteTime.dwLowDateTime=0x85d01750, ftLastWriteTime.dwHighDateTime=0x1d5e7e2, nFileSizeHigh=0x0, nFileSizeLow=0xaa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpYm1C_C.gif", cAlternateFileName="")) returned 1
	[0104.178] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9586b10, ftCreationTime.dwHighDateTime=0x1d5d94c, ftLastAccessTime.dwLowDateTime=0xf5af85e0, ftLastAccessTime.dwHighDateTime=0x1d5dc90, ftLastWriteTime.dwLowDateTime=0xf5af85e0, ftLastWriteTime.dwHighDateTime=0x1d5dc90, nFileSizeHigh=0x0, nFileSizeLow=0x36ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="WKSj.png", cAlternateFileName="")) returned 1
	[0104.179] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d899670, ftCreationTime.dwHighDateTime=0x1d5dbfe, ftLastAccessTime.dwLowDateTime=0x5d39aef0, ftLastAccessTime.dwHighDateTime=0x1d5d8fb, ftLastWriteTime.dwLowDateTime=0x5d39aef0, ftLastWriteTime.dwHighDateTime=0x1d5d8fb, nFileSizeHigh=0x0, nFileSizeLow=0xe58a, dwReserved0=0x0, dwReserved1=0x0, cFileName="yBRVF.gif", cAlternateFileName="")) returned 1
	[0104.179] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa4c990, ftCreationTime.dwHighDateTime=0x1d5e580, ftLastAccessTime.dwLowDateTime=0xa10cffb0, ftLastAccessTime.dwHighDateTime=0x1d5de19, ftLastWriteTime.dwLowDateTime=0xa10cffb0, ftLastWriteTime.dwHighDateTime=0x1d5de19, nFileSizeHigh=0x0, nFileSizeLow=0xcf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zmb8syXX3tXQxQ.png", cAlternateFileName="ZMB8SY~1.PNG")) returned 1
	[0104.180] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa4c990, ftCreationTime.dwHighDateTime=0x1d5e580, ftLastAccessTime.dwLowDateTime=0xa10cffb0, ftLastAccessTime.dwHighDateTime=0x1d5de19, ftLastWriteTime.dwLowDateTime=0xa10cffb0, ftLastWriteTime.dwHighDateTime=0x1d5de19, nFileSizeHigh=0x0, nFileSizeLow=0xcf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zmb8syXX3tXQxQ.png", cAlternateFileName="ZMB8SY~1.PNG")) returned 0
	[0104.180] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0104.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0104.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0104.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0104.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy", lpFilePart=0x0) returned 0x3b
	[0104.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\", lpFilePart=0x0) returned 0x3c
	[0104.181] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3bd6090, ftCreationTime.dwHighDateTime=0x1d5de6a, ftLastAccessTime.dwLowDateTime=0xc0e164d0, ftLastAccessTime.dwHighDateTime=0x1d5de04, ftLastWriteTime.dwLowDateTime=0xc0e164d0, ftLastWriteTime.dwHighDateTime=0x1d5de04, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0104.182] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3bd6090, ftCreationTime.dwHighDateTime=0x1d5de6a, ftLastAccessTime.dwLowDateTime=0xc0e164d0, ftLastAccessTime.dwHighDateTime=0x1d5de04, ftLastWriteTime.dwLowDateTime=0xc0e164d0, ftLastWriteTime.dwHighDateTime=0x1d5de04, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.182] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x738b0ba0, ftCreationTime.dwHighDateTime=0x1d5deef, ftLastAccessTime.dwLowDateTime=0xf0906f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf0906f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8alGuK51aX", cAlternateFileName="8ALGUK~1")) returned 1
	[0104.183] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff791340, ftCreationTime.dwHighDateTime=0x1d5df45, ftLastAccessTime.dwLowDateTime=0x420a3d40, ftLastAccessTime.dwHighDateTime=0x1d5d8c2, ftLastWriteTime.dwLowDateTime=0x420a3d40, ftLastWriteTime.dwHighDateTime=0x1d5d8c2, nFileSizeHigh=0x0, nFileSizeLow=0xf6f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="k qlWax.bmp", cAlternateFileName="KQLWAX~1.BMP")) returned 1
	[0104.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\k qlWax.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\k qlWax.bmp", lpFilePart=0x0) returned 0x47
	[0104.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0104.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\k qlWax.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\k qlwax.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.184] GetFileType (hFile=0x208) returned 0x1
	[0104.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0104.184] GetFileType (hFile=0x208) returned 0x1
	[0104.184] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xf6f5
	[0104.185] ReadFile (in: hFile=0x208, lpBuffer=0x27c0d20, nNumberOfBytesToRead=0xf6f5, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27c0d20*, lpNumberOfBytesRead=0x26ef24*=0xf6f5, lpOverlapped=0x0) returned 1
	[0104.188] CloseHandle (hObject=0x208) returned 1
	[0104.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\k qlWax.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\k qlWax.bmp.KEKW", lpFilePart=0x0) returned 0x4c
	[0104.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0104.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\k qlWax.bmp.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\k qlwax.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.190] GetFileType (hFile=0x208) returned 0x1
	[0104.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0104.190] GetFileType (hFile=0x208) returned 0x1
	[0104.190] WriteFile (in: hFile=0x208, lpBuffer=0x27d1b28*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27d1b28*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0104.193] CloseHandle (hObject=0x208) returned 1
	[0104.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\k qlWax.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\k qlWax.bmp", lpFilePart=0x0) returned 0x47
	[0104.194] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\k qlWax.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\k qlwax.bmp")) returned 1
	[0104.201] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2f4620, ftCreationTime.dwHighDateTime=0x1d5e283, ftLastAccessTime.dwLowDateTime=0x85d01750, ftLastAccessTime.dwHighDateTime=0x1d5e7e2, ftLastWriteTime.dwLowDateTime=0x85d01750, ftLastWriteTime.dwHighDateTime=0x1d5e7e2, nFileSizeHigh=0x0, nFileSizeLow=0xaa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpYm1C_C.gif", cAlternateFileName="")) returned 1
	[0104.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\tpYm1C_C.gif", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\tpYm1C_C.gif", lpFilePart=0x0) returned 0x48
	[0104.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0104.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\tpYm1C_C.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\tpym1c_c.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.202] GetFileType (hFile=0x208) returned 0x1
	[0104.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0104.202] GetFileType (hFile=0x208) returned 0x1
	[0104.202] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xaa7
	[0104.202] ReadFile (in: hFile=0x208, lpBuffer=0x27d3b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27d3b70*, lpNumberOfBytesRead=0x26ef24*=0xaa7, lpOverlapped=0x0) returned 1
	[0104.205] CloseHandle (hObject=0x208) returned 1
	[0104.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\tpYm1C_C.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\tpYm1C_C.gif.KEKW", lpFilePart=0x0) returned 0x4d
	[0104.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0104.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\tpYm1C_C.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\tpym1c_c.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.207] GetFileType (hFile=0x208) returned 0x1
	[0104.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0104.207] GetFileType (hFile=0x208) returned 0x1
	[0104.208] WriteFile (in: hFile=0x208, lpBuffer=0x27d6280*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27d6280*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0104.210] CloseHandle (hObject=0x208) returned 1
	[0104.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\tpYm1C_C.gif", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\tpYm1C_C.gif", lpFilePart=0x0) returned 0x48
	[0104.211] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\tpYm1C_C.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\tpym1c_c.gif")) returned 1
	[0104.217] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9586b10, ftCreationTime.dwHighDateTime=0x1d5d94c, ftLastAccessTime.dwLowDateTime=0xf5af85e0, ftLastAccessTime.dwHighDateTime=0x1d5dc90, ftLastWriteTime.dwLowDateTime=0xf5af85e0, ftLastWriteTime.dwHighDateTime=0x1d5dc90, nFileSizeHigh=0x0, nFileSizeLow=0x36ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="WKSj.png", cAlternateFileName="")) returned 1
	[0104.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\WKSj.png", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\WKSj.png", lpFilePart=0x0) returned 0x44
	[0104.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0104.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\WKSj.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\wksj.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.218] GetFileType (hFile=0x208) returned 0x1
	[0104.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0104.218] GetFileType (hFile=0x208) returned 0x1
	[0104.218] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x36ec
	[0104.218] ReadFile (in: hFile=0x208, lpBuffer=0x27d77d8, nNumberOfBytesToRead=0x36ec, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27d77d8*, lpNumberOfBytesRead=0x26ef24*=0x36ec, lpOverlapped=0x0) returned 1
	[0104.221] CloseHandle (hObject=0x208) returned 1
	[0104.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\WKSj.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\WKSj.png.KEKW", lpFilePart=0x0) returned 0x49
	[0104.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0104.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\WKSj.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\wksj.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.222] GetFileType (hFile=0x208) returned 0x1
	[0104.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0104.223] GetFileType (hFile=0x208) returned 0x1
	[0104.223] WriteFile (in: hFile=0x208, lpBuffer=0x27dc5bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27dc5bc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0104.226] CloseHandle (hObject=0x208) returned 1
	[0104.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\WKSj.png", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\WKSj.png", lpFilePart=0x0) returned 0x44
	[0104.227] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\WKSj.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\wksj.png")) returned 1
	[0104.231] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d899670, ftCreationTime.dwHighDateTime=0x1d5dbfe, ftLastAccessTime.dwLowDateTime=0x5d39aef0, ftLastAccessTime.dwHighDateTime=0x1d5d8fb, ftLastWriteTime.dwLowDateTime=0x5d39aef0, ftLastWriteTime.dwHighDateTime=0x1d5d8fb, nFileSizeHigh=0x0, nFileSizeLow=0xe58a, dwReserved0=0x0, dwReserved1=0x0, cFileName="yBRVF.gif", cAlternateFileName="")) returned 1
	[0104.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\yBRVF.gif", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\yBRVF.gif", lpFilePart=0x0) returned 0x45
	[0104.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0104.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\yBRVF.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\ybrvf.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.236] GetFileType (hFile=0x208) returned 0x1
	[0104.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0104.236] GetFileType (hFile=0x208) returned 0x1
	[0104.236] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xe58a
	[0104.237] ReadFile (in: hFile=0x208, lpBuffer=0x25df208, nNumberOfBytesToRead=0xe58a, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x25df208*, lpNumberOfBytesRead=0x26ef24*=0xe58a, lpOverlapped=0x0) returned 1
	[0104.241] CloseHandle (hObject=0x208) returned 1
	[0104.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\yBRVF.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\yBRVF.gif.KEKW", lpFilePart=0x0) returned 0x4a
	[0104.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0104.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\yBRVF.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\ybrvf.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.244] GetFileType (hFile=0x208) returned 0x1
	[0104.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0104.244] GetFileType (hFile=0x208) returned 0x1
	[0104.245] WriteFile (in: hFile=0x208, lpBuffer=0x25eef14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25eef14*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0104.248] CloseHandle (hObject=0x208) returned 1
	[0104.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\yBRVF.gif", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\yBRVF.gif", lpFilePart=0x0) returned 0x45
	[0104.248] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\yBRVF.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\ybrvf.gif")) returned 1
	[0104.254] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa4c990, ftCreationTime.dwHighDateTime=0x1d5e580, ftLastAccessTime.dwLowDateTime=0xa10cffb0, ftLastAccessTime.dwHighDateTime=0x1d5de19, ftLastWriteTime.dwLowDateTime=0xa10cffb0, ftLastWriteTime.dwHighDateTime=0x1d5de19, nFileSizeHigh=0x0, nFileSizeLow=0xcf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zmb8syXX3tXQxQ.png", cAlternateFileName="ZMB8SY~1.PNG")) returned 1
	[0104.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\Zmb8syXX3tXQxQ.png", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\Zmb8syXX3tXQxQ.png", lpFilePart=0x0) returned 0x4e
	[0104.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0104.255] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\Zmb8syXX3tXQxQ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\zmb8syxx3txqxq.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.255] GetFileType (hFile=0x208) returned 0x1
	[0104.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0104.255] GetFileType (hFile=0x208) returned 0x1
	[0104.256] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xcf68
	[0104.256] ReadFile (in: hFile=0x208, lpBuffer=0x25f052c, nNumberOfBytesToRead=0xcf68, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x25f052c*, lpNumberOfBytesRead=0x26ef24*=0xcf68, lpOverlapped=0x0) returned 1
	[0104.260] CloseHandle (hObject=0x208) returned 1
	[0104.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\Zmb8syXX3tXQxQ.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\Zmb8syXX3tXQxQ.png.KEKW", lpFilePart=0x0) returned 0x53
	[0104.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0104.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\Zmb8syXX3tXQxQ.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\zmb8syxx3txqxq.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.261] GetFileType (hFile=0x208) returned 0x1
	[0104.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0104.262] GetFileType (hFile=0x208) returned 0x1
	[0104.262] WriteFile (in: hFile=0x208, lpBuffer=0x25febc8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25febc8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0104.265] CloseHandle (hObject=0x208) returned 1
	[0104.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\Zmb8syXX3tXQxQ.png", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\Zmb8syXX3tXQxQ.png", lpFilePart=0x0) returned 0x4e
	[0104.266] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\Zmb8syXX3tXQxQ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\zmb8syxx3txqxq.png")) returned 1
	[0104.271] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.272] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0104.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0104.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0104.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0104.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0104.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fJWc1mtAmAsE8H FQtfy\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fjwc1mtamase8h fqtfy\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0104.273] GetFileType (hFile=0x204) returned 0x1
	[0104.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0104.273] GetFileType (hFile=0x204) returned 0x1
	[0104.274] WriteFile (in: hFile=0x204, lpBuffer=0x26012fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26012fc*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0104.277] CloseHandle (hObject=0x204) returned 1
	[0104.277] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a98a2a0, ftCreationTime.dwHighDateTime=0x1d5d98e, ftLastAccessTime.dwLowDateTime=0x71a7a8a0, ftLastAccessTime.dwHighDateTime=0x1d5e3b0, ftLastWriteTime.dwLowDateTime=0x71a7a8a0, ftLastWriteTime.dwHighDateTime=0x1d5e3b0, nFileSizeHigh=0x0, nFileSizeLow=0xd57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="hkZL9L9ylQ4CBtgJNAF.bmp", cAlternateFileName="HKZL9L~1.BMP")) returned 1
	[0104.278] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3ffb940, ftCreationTime.dwHighDateTime=0x1d5db13, ftLastAccessTime.dwLowDateTime=0xb75a72e0, ftLastAccessTime.dwHighDateTime=0x1d5d827, ftLastWriteTime.dwLowDateTime=0xb75a72e0, ftLastWriteTime.dwHighDateTime=0x1d5d827, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mh86", cAlternateFileName="")) returned 1
	[0104.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0104.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86", lpFilePart=0x0) returned 0x2b
	[0104.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\", lpFilePart=0x0) returned 0x2c
	[0104.278] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3ffb940, ftCreationTime.dwHighDateTime=0x1d5db13, ftLastAccessTime.dwLowDateTime=0xb75a72e0, ftLastAccessTime.dwHighDateTime=0x1d5d827, ftLastWriteTime.dwLowDateTime=0xb75a72e0, ftLastWriteTime.dwHighDateTime=0x1d5d827, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0104.279] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3ffb940, ftCreationTime.dwHighDateTime=0x1d5db13, ftLastAccessTime.dwLowDateTime=0xb75a72e0, ftLastAccessTime.dwHighDateTime=0x1d5d827, ftLastWriteTime.dwLowDateTime=0xb75a72e0, ftLastWriteTime.dwHighDateTime=0x1d5d827, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.280] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x326a9a10, ftCreationTime.dwHighDateTime=0x1d5e43e, ftLastAccessTime.dwLowDateTime=0x8c4cee00, ftLastAccessTime.dwHighDateTime=0x1d5e431, ftLastWriteTime.dwLowDateTime=0x8c4cee00, ftLastWriteTime.dwHighDateTime=0x1d5e431, nFileSizeHigh=0x0, nFileSizeLow=0x1492f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLk2KrmwO.png", cAlternateFileName="DLK2KR~1.PNG")) returned 1
	[0104.280] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365a9850, ftCreationTime.dwHighDateTime=0x1d5dacf, ftLastAccessTime.dwLowDateTime=0xbf78f9d0, ftLastAccessTime.dwHighDateTime=0x1d5e789, ftLastWriteTime.dwLowDateTime=0xbf78f9d0, ftLastWriteTime.dwHighDateTime=0x1d5e789, nFileSizeHigh=0x0, nFileSizeLow=0x8891, dwReserved0=0x0, dwReserved1=0x0, cFileName="O0SUPLpfbPh4kC5yLoo.png", cAlternateFileName="O0SUPL~1.PNG")) returned 1
	[0104.281] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681156a0, ftCreationTime.dwHighDateTime=0x1d5e695, ftLastAccessTime.dwLowDateTime=0xbe4d56e0, ftLastAccessTime.dwHighDateTime=0x1d5e6e0, ftLastWriteTime.dwLowDateTime=0xbe4d56e0, ftLastWriteTime.dwHighDateTime=0x1d5e6e0, nFileSizeHigh=0x0, nFileSizeLow=0xb96e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQf-VYAAU.bmp", cAlternateFileName="RQF-VY~1.BMP")) returned 1
	[0104.282] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cddfdd0, ftCreationTime.dwHighDateTime=0x1d5d860, ftLastAccessTime.dwLowDateTime=0xeb166b00, ftLastAccessTime.dwHighDateTime=0x1d5e2c4, ftLastWriteTime.dwLowDateTime=0xeb166b00, ftLastWriteTime.dwHighDateTime=0x1d5e2c4, nFileSizeHigh=0x0, nFileSizeLow=0x123ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="vRKk.bmp", cAlternateFileName="")) returned 1
	[0104.282] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cddfdd0, ftCreationTime.dwHighDateTime=0x1d5d860, ftLastAccessTime.dwLowDateTime=0xeb166b00, ftLastAccessTime.dwHighDateTime=0x1d5e2c4, ftLastWriteTime.dwLowDateTime=0xeb166b00, ftLastWriteTime.dwHighDateTime=0x1d5e2c4, nFileSizeHigh=0x0, nFileSizeLow=0x123ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="vRKk.bmp", cAlternateFileName="")) returned 0
	[0104.282] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0104.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0104.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0104.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0104.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86", lpFilePart=0x0) returned 0x2b
	[0104.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\", lpFilePart=0x0) returned 0x2c
	[0104.283] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3ffb940, ftCreationTime.dwHighDateTime=0x1d5db13, ftLastAccessTime.dwLowDateTime=0xb75a72e0, ftLastAccessTime.dwHighDateTime=0x1d5d827, ftLastWriteTime.dwLowDateTime=0xb75a72e0, ftLastWriteTime.dwHighDateTime=0x1d5d827, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0104.284] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3ffb940, ftCreationTime.dwHighDateTime=0x1d5db13, ftLastAccessTime.dwLowDateTime=0xb75a72e0, ftLastAccessTime.dwHighDateTime=0x1d5d827, ftLastWriteTime.dwLowDateTime=0xb75a72e0, ftLastWriteTime.dwHighDateTime=0x1d5d827, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.285] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x326a9a10, ftCreationTime.dwHighDateTime=0x1d5e43e, ftLastAccessTime.dwLowDateTime=0x8c4cee00, ftLastAccessTime.dwHighDateTime=0x1d5e431, ftLastWriteTime.dwLowDateTime=0x8c4cee00, ftLastWriteTime.dwHighDateTime=0x1d5e431, nFileSizeHigh=0x0, nFileSizeLow=0x1492f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLk2KrmwO.png", cAlternateFileName="DLK2KR~1.PNG")) returned 1
	[0104.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\DLk2KrmwO.png", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\DLk2KrmwO.png", lpFilePart=0x0) returned 0x39
	[0104.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0104.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\DLk2KrmwO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\dlk2krmwo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.286] GetFileType (hFile=0x208) returned 0x1
	[0104.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0104.286] GetFileType (hFile=0x208) returned 0x1
	[0104.286] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x1492f
	[0104.286] ReadFile (in: hFile=0x208, lpBuffer=0x2603ed0, nNumberOfBytesToRead=0x1492f, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2603ed0*, lpNumberOfBytesRead=0x26ef24*=0x1492f, lpOverlapped=0x0) returned 1
	[0104.296] CloseHandle (hObject=0x208) returned 1
	[0104.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\DLk2KrmwO.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\DLk2KrmwO.png.KEKW", lpFilePart=0x0) returned 0x3e
	[0104.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0104.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\DLk2KrmwO.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\dlk2krmwo.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.297] GetFileType (hFile=0x208) returned 0x1
	[0104.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0104.297] GetFileType (hFile=0x208) returned 0x1
	[0104.298] WriteFile (in: hFile=0x208, lpBuffer=0x2619edc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2619edc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0104.301] CloseHandle (hObject=0x208) returned 1
	[0104.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\DLk2KrmwO.png", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\DLk2KrmwO.png", lpFilePart=0x0) returned 0x39
	[0104.301] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\DLk2KrmwO.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\dlk2krmwo.png")) returned 1
	[0104.307] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365a9850, ftCreationTime.dwHighDateTime=0x1d5dacf, ftLastAccessTime.dwLowDateTime=0xbf78f9d0, ftLastAccessTime.dwHighDateTime=0x1d5e789, ftLastWriteTime.dwLowDateTime=0xbf78f9d0, ftLastWriteTime.dwHighDateTime=0x1d5e789, nFileSizeHigh=0x0, nFileSizeLow=0x8891, dwReserved0=0x0, dwReserved1=0x0, cFileName="O0SUPLpfbPh4kC5yLoo.png", cAlternateFileName="O0SUPL~1.PNG")) returned 1
	[0104.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\O0SUPLpfbPh4kC5yLoo.png", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\O0SUPLpfbPh4kC5yLoo.png", lpFilePart=0x0) returned 0x43
	[0104.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0104.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\O0SUPLpfbPh4kC5yLoo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\o0suplpfbph4kc5yloo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.308] GetFileType (hFile=0x208) returned 0x1
	[0104.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0104.308] GetFileType (hFile=0x208) returned 0x1
	[0104.308] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x8891
	[0104.308] ReadFile (in: hFile=0x208, lpBuffer=0x261b460, nNumberOfBytesToRead=0x8891, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x261b460*, lpNumberOfBytesRead=0x26ef24*=0x8891, lpOverlapped=0x0) returned 1
	[0104.312] CloseHandle (hObject=0x208) returned 1
	[0104.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\O0SUPLpfbPh4kC5yLoo.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\O0SUPLpfbPh4kC5yLoo.png.KEKW", lpFilePart=0x0) returned 0x48
	[0104.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0104.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\O0SUPLpfbPh4kC5yLoo.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\o0suplpfbph4kc5yloo.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.313] GetFileType (hFile=0x208) returned 0x1
	[0104.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0104.313] GetFileType (hFile=0x208) returned 0x1
	[0104.314] WriteFile (in: hFile=0x208, lpBuffer=0x262540c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x262540c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0104.317] CloseHandle (hObject=0x208) returned 1
	[0104.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\O0SUPLpfbPh4kC5yLoo.png", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\O0SUPLpfbPh4kC5yLoo.png", lpFilePart=0x0) returned 0x43
	[0104.317] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\O0SUPLpfbPh4kC5yLoo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\o0suplpfbph4kc5yloo.png")) returned 1
	[0104.323] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681156a0, ftCreationTime.dwHighDateTime=0x1d5e695, ftLastAccessTime.dwLowDateTime=0xbe4d56e0, ftLastAccessTime.dwHighDateTime=0x1d5e6e0, ftLastWriteTime.dwLowDateTime=0xbe4d56e0, ftLastWriteTime.dwHighDateTime=0x1d5e6e0, nFileSizeHigh=0x0, nFileSizeLow=0xb96e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RQf-VYAAU.bmp", cAlternateFileName="RQF-VY~1.BMP")) returned 1
	[0104.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\RQf-VYAAU.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\RQf-VYAAU.bmp", lpFilePart=0x0) returned 0x39
	[0104.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0104.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\RQf-VYAAU.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\rqf-vyaau.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.324] GetFileType (hFile=0x208) returned 0x1
	[0104.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0104.324] GetFileType (hFile=0x208) returned 0x1
	[0104.324] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xb96e
	[0104.325] ReadFile (in: hFile=0x208, lpBuffer=0x2626904, nNumberOfBytesToRead=0xb96e, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2626904*, lpNumberOfBytesRead=0x26ef24*=0xb96e, lpOverlapped=0x0) returned 1
	[0104.328] CloseHandle (hObject=0x208) returned 1
	[0104.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\RQf-VYAAU.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\RQf-VYAAU.bmp.KEKW", lpFilePart=0x0) returned 0x3e
	[0104.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0104.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\RQf-VYAAU.bmp.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\rqf-vyaau.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.330] GetFileType (hFile=0x208) returned 0x1
	[0104.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0104.330] GetFileType (hFile=0x208) returned 0x1
	[0104.330] WriteFile (in: hFile=0x208, lpBuffer=0x2633950*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2633950*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0104.333] CloseHandle (hObject=0x208) returned 1
	[0104.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\RQf-VYAAU.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\RQf-VYAAU.bmp", lpFilePart=0x0) returned 0x39
	[0104.334] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\RQf-VYAAU.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\rqf-vyaau.bmp")) returned 1
	[0104.341] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cddfdd0, ftCreationTime.dwHighDateTime=0x1d5d860, ftLastAccessTime.dwLowDateTime=0xeb166b00, ftLastAccessTime.dwHighDateTime=0x1d5e2c4, ftLastWriteTime.dwLowDateTime=0xeb166b00, ftLastWriteTime.dwHighDateTime=0x1d5e2c4, nFileSizeHigh=0x0, nFileSizeLow=0x123ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="vRKk.bmp", cAlternateFileName="")) returned 1
	[0104.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\vRKk.bmp", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\vRKk.bmp", lpFilePart=0x0) returned 0x34
	[0104.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0104.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\vRKk.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\vrkk.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.341] GetFileType (hFile=0x208) returned 0x1
	[0104.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0104.342] GetFileType (hFile=0x208) returned 0x1
	[0104.342] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x123ba
	[0104.342] ReadFile (in: hFile=0x208, lpBuffer=0x2634dc8, nNumberOfBytesToRead=0x123ba, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2634dc8*, lpNumberOfBytesRead=0x26ef24*=0x123ba, lpOverlapped=0x0) returned 1
	[0104.346] CloseHandle (hObject=0x208) returned 1
	[0104.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\vRKk.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\vRKk.bmp.KEKW", lpFilePart=0x0) returned 0x39
	[0104.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0104.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\vRKk.bmp.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\vrkk.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0104.359] GetFileType (hFile=0x208) returned 0x1
	[0104.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0104.359] GetFileType (hFile=0x208) returned 0x1
	[0104.359] WriteFile (in: hFile=0x208, lpBuffer=0x264883c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x264883c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0104.362] CloseHandle (hObject=0x208) returned 1
	[0104.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\vRKk.bmp", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\vRKk.bmp", lpFilePart=0x0) returned 0x34
	[0104.363] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\vRKk.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\vrkk.bmp")) returned 1
	[0104.370] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.370] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0104.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0104.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0104.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0104.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0104.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mh86\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mh86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0104.372] GetFileType (hFile=0x204) returned 0x1
	[0104.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0104.372] GetFileType (hFile=0x204) returned 0x1
	[0104.373] WriteFile (in: hFile=0x204, lpBuffer=0x264aefc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x264aefc*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0104.376] CloseHandle (hObject=0x204) returned 1
	[0104.376] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeacf1190, ftCreationTime.dwHighDateTime=0x1d5da9c, ftLastAccessTime.dwLowDateTime=0xd19c4fd0, ftLastAccessTime.dwHighDateTime=0x1d5e29e, ftLastWriteTime.dwLowDateTime=0xd19c4fd0, ftLastWriteTime.dwHighDateTime=0x1d5e29e, nFileSizeHigh=0x0, nFileSizeLow=0x18844, dwReserved0=0x0, dwReserved1=0x0, cFileName="OZr_PU6S.png", cAlternateFileName="")) returned 1
	[0104.377] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0254490, ftCreationTime.dwHighDateTime=0x1d5e777, ftLastAccessTime.dwLowDateTime=0x3f2163f0, ftLastAccessTime.dwHighDateTime=0x1d5e3e0, ftLastWriteTime.dwLowDateTime=0x3f2163f0, ftLastWriteTime.dwHighDateTime=0x1d5e3e0, nFileSizeHigh=0x0, nFileSizeLow=0x13d5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="qoCm.png", cAlternateFileName="")) returned 1
	[0104.377] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6b49c0, ftCreationTime.dwHighDateTime=0x1d5e5ec, ftLastAccessTime.dwLowDateTime=0x99af1f50, ftLastAccessTime.dwHighDateTime=0x1d5e03f, ftLastWriteTime.dwLowDateTime=0x99af1f50, ftLastWriteTime.dwHighDateTime=0x1d5e03f, nFileSizeHigh=0x0, nFileSizeLow=0xaa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="UFL_16HpW2_deIEVlBEl.jpg", cAlternateFileName="UFL_16~1.JPG")) returned 1
	[0104.378] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6b49c0, ftCreationTime.dwHighDateTime=0x1d5e5ec, ftLastAccessTime.dwLowDateTime=0x99af1f50, ftLastAccessTime.dwHighDateTime=0x1d5e03f, ftLastWriteTime.dwLowDateTime=0x99af1f50, ftLastWriteTime.dwHighDateTime=0x1d5e03f, nFileSizeHigh=0x0, nFileSizeLow=0xaa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="UFL_16HpW2_deIEVlBEl.jpg", cAlternateFileName="UFL_16~1.JPG")) returned 0
	[0104.378] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0104.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0104.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0104.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26
	[0104.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27
	[0104.379] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdab224a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdab224a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0104.380] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdab224a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdab224a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.381] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a5ad9b0, ftCreationTime.dwHighDateTime=0x1d5db8c, ftLastAccessTime.dwLowDateTime=0xeba7990, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xeba7990, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-UucLCm", cAlternateFileName="")) returned 1
	[0104.381] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb204320, ftCreationTime.dwHighDateTime=0x1d5dfeb, ftLastAccessTime.dwLowDateTime=0xe486ce90, ftLastAccessTime.dwHighDateTime=0x1d5e4d3, ftLastWriteTime.dwLowDateTime=0xe486ce90, ftLastWriteTime.dwHighDateTime=0x1d5e4d3, nFileSizeHigh=0x0, nFileSizeLow=0xad14, dwReserved0=0x0, dwReserved1=0x0, cFileName="CKK20aLXbvslgLua3s5d.bmp", cAlternateFileName="CKK20A~1.BMP")) returned 1
	[0104.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CKK20aLXbvslgLua3s5d.bmp", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CKK20aLXbvslgLua3s5d.bmp", lpFilePart=0x0) returned 0x3f
	[0104.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CKK20aLXbvslgLua3s5d.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ckk20alxbvslglua3s5d.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.385] GetFileType (hFile=0x204) returned 0x1
	[0104.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.385] GetFileType (hFile=0x204) returned 0x1
	[0104.386] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xad14
	[0104.386] ReadFile (in: hFile=0x204, lpBuffer=0x264d034, nNumberOfBytesToRead=0xad14, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x264d034*, lpNumberOfBytesRead=0x26efc4*=0xad14, lpOverlapped=0x0) returned 1
	[0104.390] CloseHandle (hObject=0x204) returned 1
	[0104.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CKK20aLXbvslgLua3s5d.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CKK20aLXbvslgLua3s5d.bmp.KEKW", lpFilePart=0x0) returned 0x44
	[0104.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CKK20aLXbvslgLua3s5d.bmp.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ckk20alxbvslglua3s5d.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.391] GetFileType (hFile=0x204) returned 0x1
	[0104.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.392] GetFileType (hFile=0x204) returned 0x1
	[0104.392] WriteFile (in: hFile=0x204, lpBuffer=0x2659450*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2659450*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.395] CloseHandle (hObject=0x204) returned 1
	[0104.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CKK20aLXbvslgLua3s5d.bmp", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CKK20aLXbvslgLua3s5d.bmp", lpFilePart=0x0) returned 0x3f
	[0104.395] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CKK20aLXbvslgLua3s5d.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ckk20alxbvslglua3s5d.bmp")) returned 1
	[0104.401] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bac61b0, ftCreationTime.dwHighDateTime=0x1d5e64e, ftLastAccessTime.dwLowDateTime=0x67c1bb20, ftLastAccessTime.dwHighDateTime=0x1d5e494, ftLastWriteTime.dwLowDateTime=0x67c1bb20, ftLastWriteTime.dwHighDateTime=0x1d5e494, nFileSizeHigh=0x0, nFileSizeLow=0x65fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="cQJyPrU4N.gif", cAlternateFileName="CQJYPR~1.GIF")) returned 1
	[0104.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\cQJyPrU4N.gif", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\cQJyPrU4N.gif", lpFilePart=0x0) returned 0x34
	[0104.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.402] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\cQJyPrU4N.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cqjypru4n.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.402] GetFileType (hFile=0x204) returned 0x1
	[0104.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.402] GetFileType (hFile=0x204) returned 0x1
	[0104.402] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x65fd
	[0104.403] ReadFile (in: hFile=0x204, lpBuffer=0x265a90c, nNumberOfBytesToRead=0x65fd, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x265a90c*, lpNumberOfBytesRead=0x26efc4*=0x65fd, lpOverlapped=0x0) returned 1
	[0104.406] CloseHandle (hObject=0x204) returned 1
	[0104.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\cQJyPrU4N.gif.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\cQJyPrU4N.gif.KEKW", lpFilePart=0x0) returned 0x39
	[0104.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\cQJyPrU4N.gif.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cqjypru4n.gif.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.407] GetFileType (hFile=0x204) returned 0x1
	[0104.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.408] GetFileType (hFile=0x204) returned 0x1
	[0104.408] WriteFile (in: hFile=0x204, lpBuffer=0x26625d0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26625d0*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.411] CloseHandle (hObject=0x204) returned 1
	[0104.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\cQJyPrU4N.gif", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\cQJyPrU4N.gif", lpFilePart=0x0) returned 0x34
	[0104.412] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\cQJyPrU4N.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cqjypru4n.gif")) returned 1
	[0104.417] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0104.417] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3bd6090, ftCreationTime.dwHighDateTime=0x1d5de6a, ftLastAccessTime.dwLowDateTime=0xf174f30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf174f30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fJWc1mtAmAsE8H FQtfy", cAlternateFileName="FJWC1M~1")) returned 1
	[0104.418] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a98a2a0, ftCreationTime.dwHighDateTime=0x1d5d98e, ftLastAccessTime.dwLowDateTime=0x71a7a8a0, ftLastAccessTime.dwHighDateTime=0x1d5e3b0, ftLastWriteTime.dwLowDateTime=0x71a7a8a0, ftLastWriteTime.dwHighDateTime=0x1d5e3b0, nFileSizeHigh=0x0, nFileSizeLow=0xd57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="hkZL9L9ylQ4CBtgJNAF.bmp", cAlternateFileName="HKZL9L~1.BMP")) returned 1
	[0104.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hkZL9L9ylQ4CBtgJNAF.bmp", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hkZL9L9ylQ4CBtgJNAF.bmp", lpFilePart=0x0) returned 0x3e
	[0104.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hkZL9L9ylQ4CBtgJNAF.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hkzl9l9ylq4cbtgjnaf.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.419] GetFileType (hFile=0x204) returned 0x1
	[0104.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.419] GetFileType (hFile=0x204) returned 0x1
	[0104.419] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xd57d
	[0104.419] ReadFile (in: hFile=0x204, lpBuffer=0x2663f74, nNumberOfBytesToRead=0xd57d, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x2663f74*, lpNumberOfBytesRead=0x26efc4*=0xd57d, lpOverlapped=0x0) returned 1
	[0104.423] CloseHandle (hObject=0x204) returned 1
	[0104.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hkZL9L9ylQ4CBtgJNAF.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hkZL9L9ylQ4CBtgJNAF.bmp.KEKW", lpFilePart=0x0) returned 0x43
	[0104.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hkZL9L9ylQ4CBtgJNAF.bmp.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hkzl9l9ylq4cbtgjnaf.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.434] GetFileType (hFile=0x204) returned 0x1
	[0104.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.435] GetFileType (hFile=0x204) returned 0x1
	[0104.435] WriteFile (in: hFile=0x204, lpBuffer=0x2672bf4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2672bf4*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.438] CloseHandle (hObject=0x204) returned 1
	[0104.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hkZL9L9ylQ4CBtgJNAF.bmp", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hkZL9L9ylQ4CBtgJNAF.bmp", lpFilePart=0x0) returned 0x3e
	[0104.438] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hkZL9L9ylQ4CBtgJNAF.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hkzl9l9ylq4cbtgjnaf.bmp")) returned 1
	[0104.444] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb3ffb940, ftCreationTime.dwHighDateTime=0x1d5db13, ftLastAccessTime.dwLowDateTime=0xf27f8d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf27f8d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mh86", cAlternateFileName="")) returned 1
	[0104.445] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeacf1190, ftCreationTime.dwHighDateTime=0x1d5da9c, ftLastAccessTime.dwLowDateTime=0xd19c4fd0, ftLastAccessTime.dwHighDateTime=0x1d5e29e, ftLastWriteTime.dwLowDateTime=0xd19c4fd0, ftLastWriteTime.dwHighDateTime=0x1d5e29e, nFileSizeHigh=0x0, nFileSizeLow=0x18844, dwReserved0=0x0, dwReserved1=0x0, cFileName="OZr_PU6S.png", cAlternateFileName="")) returned 1
	[0104.445] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OZr_PU6S.png", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OZr_PU6S.png", lpFilePart=0x0) returned 0x33
	[0104.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OZr_PU6S.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ozr_pu6s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.446] GetFileType (hFile=0x204) returned 0x1
	[0104.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.446] GetFileType (hFile=0x204) returned 0x1
	[0104.446] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x18844
	[0104.448] ReadFile (in: hFile=0x204, lpBuffer=0x37864d8, nNumberOfBytesToRead=0x18844, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x37864d8*, lpNumberOfBytesRead=0x26efc4*=0x18844, lpOverlapped=0x0) returned 1
	[0104.455] CloseHandle (hObject=0x204) returned 1
	[0104.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OZr_PU6S.png.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OZr_PU6S.png.KEKW", lpFilePart=0x0) returned 0x38
	[0104.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OZr_PU6S.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ozr_pu6s.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.457] GetFileType (hFile=0x204) returned 0x1
	[0104.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.457] GetFileType (hFile=0x204) returned 0x1
	[0104.458] WriteFile (in: hFile=0x204, lpBuffer=0x267581c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x267581c*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.492] CloseHandle (hObject=0x204) returned 1
	[0104.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OZr_PU6S.png", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OZr_PU6S.png", lpFilePart=0x0) returned 0x33
	[0104.492] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OZr_PU6S.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ozr_pu6s.png")) returned 1
	[0104.499] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0254490, ftCreationTime.dwHighDateTime=0x1d5e777, ftLastAccessTime.dwLowDateTime=0x3f2163f0, ftLastAccessTime.dwHighDateTime=0x1d5e3e0, ftLastWriteTime.dwLowDateTime=0x3f2163f0, ftLastWriteTime.dwHighDateTime=0x1d5e3e0, nFileSizeHigh=0x0, nFileSizeLow=0x13d5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="qoCm.png", cAlternateFileName="")) returned 1
	[0104.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qoCm.png", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qoCm.png", lpFilePart=0x0) returned 0x2f
	[0104.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qoCm.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qocm.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.501] GetFileType (hFile=0x204) returned 0x1
	[0104.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.501] GetFileType (hFile=0x204) returned 0x1
	[0104.501] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x13d5e
	[0104.501] ReadFile (in: hFile=0x204, lpBuffer=0x2676c44, nNumberOfBytesToRead=0x13d5e, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x2676c44*, lpNumberOfBytesRead=0x26efc4*=0x13d5e, lpOverlapped=0x0) returned 1
	[0104.506] CloseHandle (hObject=0x204) returned 1
	[0104.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qoCm.png.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qoCm.png.KEKW", lpFilePart=0x0) returned 0x34
	[0104.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qoCm.png.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qocm.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.509] GetFileType (hFile=0x204) returned 0x1
	[0104.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.510] GetFileType (hFile=0x204) returned 0x1
	[0104.510] WriteFile (in: hFile=0x204, lpBuffer=0x268c04c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x268c04c*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.513] CloseHandle (hObject=0x204) returned 1
	[0104.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qoCm.png", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qoCm.png", lpFilePart=0x0) returned 0x2f
	[0104.514] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qoCm.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qocm.png")) returned 1
	[0104.520] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6b49c0, ftCreationTime.dwHighDateTime=0x1d5e5ec, ftLastAccessTime.dwLowDateTime=0x99af1f50, ftLastAccessTime.dwHighDateTime=0x1d5e03f, ftLastWriteTime.dwLowDateTime=0x99af1f50, ftLastWriteTime.dwHighDateTime=0x1d5e03f, nFileSizeHigh=0x0, nFileSizeLow=0xaa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="UFL_16HpW2_deIEVlBEl.jpg", cAlternateFileName="UFL_16~1.JPG")) returned 1
	[0104.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UFL_16HpW2_deIEVlBEl.jpg", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UFL_16HpW2_deIEVlBEl.jpg", lpFilePart=0x0) returned 0x3f
	[0104.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UFL_16HpW2_deIEVlBEl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ufl_16hpw2_deievlbel.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.521] GetFileType (hFile=0x204) returned 0x1
	[0104.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.521] GetFileType (hFile=0x204) returned 0x1
	[0104.521] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xaa60
	[0104.522] ReadFile (in: hFile=0x204, lpBuffer=0x268d594, nNumberOfBytesToRead=0xaa60, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x268d594*, lpNumberOfBytesRead=0x26efc4*=0xaa60, lpOverlapped=0x0) returned 1
	[0104.525] CloseHandle (hObject=0x204) returned 1
	[0104.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UFL_16HpW2_deIEVlBEl.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UFL_16HpW2_deIEVlBEl.jpg.KEKW", lpFilePart=0x0) returned 0x44
	[0104.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UFL_16HpW2_deIEVlBEl.jpg.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ufl_16hpw2_deievlbel.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.527] GetFileType (hFile=0x204) returned 0x1
	[0104.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.527] GetFileType (hFile=0x204) returned 0x1
	[0104.527] WriteFile (in: hFile=0x204, lpBuffer=0x26996fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26996fc*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.531] CloseHandle (hObject=0x204) returned 1
	[0104.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UFL_16HpW2_deIEVlBEl.jpg", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UFL_16HpW2_deIEVlBEl.jpg", lpFilePart=0x0) returned 0x3f
	[0104.531] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UFL_16HpW2_deIEVlBEl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ufl_16hpw2_deievlbel.jpg")) returned 1
	[0104.537] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.537] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0104.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0104.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0104.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x32
	[0104.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0104.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0104.539] GetFileType (hFile=0x200) returned 0x1
	[0104.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0104.539] GetFileType (hFile=0x200) returned 0x1
	[0104.540] WriteFile (in: hFile=0x200, lpBuffer=0x269bdc0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x269bdc0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0104.546] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1
	[0104.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood", lpFilePart=0x0) returned 0x27
	[0104.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\", lpFilePart=0x0) returned 0x28
	[0104.547] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0104.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0104.551] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0104.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent", lpFilePart=0x0) returned 0x24
	[0104.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\", lpFilePart=0x0) returned 0x25
	[0104.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0104.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0104.562] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1
	[0104.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", lpFilePart=0x0) returned 0x29
	[0104.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", lpFilePart=0x0) returned 0x2a
	[0104.563] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0104.564] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.564] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0104.565] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0104.565] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0104.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0104.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0104.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", lpFilePart=0x0) returned 0x29
	[0104.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", lpFilePart=0x0) returned 0x2a
	[0104.566] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0104.567] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.567] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0104.567] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.568] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0104.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0104.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0104.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0104.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0104.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0104.573] GetFileType (hFile=0x200) returned 0x1
	[0104.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0104.574] GetFileType (hFile=0x200) returned 0x1
	[0104.574] WriteFile (in: hFile=0x200, lpBuffer=0x26a0af8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x26a0af8*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0104.577] CloseHandle (hObject=0x200) returned 1
	[0104.578] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1
	[0104.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", lpFilePart=0x0) returned 0x26
	[0104.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpFilePart=0x0) returned 0x27
	[0104.578] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0104.579] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.580] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0104.580] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1
	[0104.581] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1
	[0104.582] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0
	[0104.582] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0104.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0104.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0104.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", lpFilePart=0x0) returned 0x26
	[0104.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpFilePart=0x0) returned 0x27
	[0104.583] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0104.584] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.584] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0104.585] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1
	[0104.587] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1
	[0104.587] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.588] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0104.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0104.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0104.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Decrypt.txt", lpFilePart=0x0) returned 0x32
	[0104.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0104.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0104.589] GetFileType (hFile=0x200) returned 0x1
	[0104.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0104.590] GetFileType (hFile=0x200) returned 0x1
	[0104.590] WriteFile (in: hFile=0x200, lpBuffer=0x26a4f64*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x26a4f64*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0104.593] CloseHandle (hObject=0x200) returned 1
	[0104.593] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0104.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo", lpFilePart=0x0) returned 0x24
	[0104.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\", lpFilePart=0x0) returned 0x25
	[0104.594] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0104.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0104.598] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0104.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu", lpFilePart=0x0) returned 0x28
	[0104.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\", lpFilePart=0x0) returned 0x29
	[0104.599] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0104.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0104.604] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0104.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates", lpFilePart=0x0) returned 0x27
	[0104.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\", lpFilePart=0x0) returned 0x28
	[0104.605] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0104.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0104.609] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdaa63dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa63dc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0104.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24
	[0104.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpFilePart=0x0) returned 0x25
	[0104.610] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdaa63dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa63dc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0104.610] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdaa63dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa63dc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.611] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcda0abf0, ftCreationTime.dwHighDateTime=0x1d5dc6e, ftLastAccessTime.dwLowDateTime=0xee0a0470, ftLastAccessTime.dwHighDateTime=0x1d5e143, ftLastWriteTime.dwLowDateTime=0xee0a0470, ftLastWriteTime.dwHighDateTime=0x1d5e143, nFileSizeHigh=0x0, nFileSizeLow=0x16d5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="-O O 1zWVogn.swf", cAlternateFileName="-OO1ZW~1.SWF")) returned 1
	[0104.612] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39aeefc0, ftCreationTime.dwHighDateTime=0x1d5d998, ftLastAccessTime.dwLowDateTime=0xda6a410, ftLastAccessTime.dwHighDateTime=0x1d5e7fb, ftLastWriteTime.dwLowDateTime=0xda6a410, ftLastWriteTime.dwHighDateTime=0x1d5e7fb, nFileSizeHigh=0x0, nFileSizeLow=0x30db, dwReserved0=0x0, dwReserved1=0x0, cFileName="0GJPN.flv", cAlternateFileName="")) returned 1
	[0104.612] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9844d20, ftCreationTime.dwHighDateTime=0x1d5d9ae, ftLastAccessTime.dwLowDateTime=0x8134d0e0, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x8134d0e0, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x10091, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Y4ss7NtmNX.swf", cAlternateFileName="1Y4SS7~1.SWF")) returned 1
	[0104.613] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x566589b0, ftCreationTime.dwHighDateTime=0x1d5e6e2, ftLastAccessTime.dwLowDateTime=0xbd76a660, ftLastAccessTime.dwHighDateTime=0x1d5e3f5, ftLastWriteTime.dwLowDateTime=0xbd76a660, ftLastWriteTime.dwHighDateTime=0x1d5e3f5, nFileSizeHigh=0x0, nFileSizeLow=0xccb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="6KtNyQ61p.avi", cAlternateFileName="6KTNYQ~1.AVI")) returned 1
	[0104.614] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67d844e0, ftCreationTime.dwHighDateTime=0x1d5e169, ftLastAccessTime.dwLowDateTime=0x4f4cfa10, ftLastAccessTime.dwHighDateTime=0x1d5d7cd, ftLastWriteTime.dwLowDateTime=0x4f4cfa10, ftLastWriteTime.dwHighDateTime=0x1d5d7cd, nFileSizeHigh=0x0, nFileSizeLow=0x8743, dwReserved0=0x0, dwReserved1=0x0, cFileName="6z0nNXnW.flv", cAlternateFileName="")) returned 1
	[0104.614] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb2ff0, ftCreationTime.dwHighDateTime=0x1d5e674, ftLastAccessTime.dwLowDateTime=0xe324e210, ftLastAccessTime.dwHighDateTime=0x1d5d8f5, ftLastWriteTime.dwLowDateTime=0xe324e210, ftLastWriteTime.dwHighDateTime=0x1d5d8f5, nFileSizeHigh=0x0, nFileSizeLow=0x10995, dwReserved0=0x0, dwReserved1=0x0, cFileName="6_GPHIcKrmLgtOgG0UC5.avi", cAlternateFileName="6_GPHI~1.AVI")) returned 1
	[0104.615] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd64d020, ftCreationTime.dwHighDateTime=0x1d5dc00, ftLastAccessTime.dwLowDateTime=0x58c80bb0, ftLastAccessTime.dwHighDateTime=0x1d5d8f5, ftLastWriteTime.dwLowDateTime=0x58c80bb0, ftLastWriteTime.dwHighDateTime=0x1d5d8f5, nFileSizeHigh=0x0, nFileSizeLow=0x8b55, dwReserved0=0x0, dwReserved1=0x0, cFileName="AT5BZgfjDTw5u.swf", cAlternateFileName="AT5BZG~1.SWF")) returned 1
	[0104.615] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fb009d0, ftCreationTime.dwHighDateTime=0x1d5dace, ftLastAccessTime.dwLowDateTime=0x47350d60, ftLastAccessTime.dwHighDateTime=0x1d5de65, ftLastWriteTime.dwLowDateTime=0x47350d60, ftLastWriteTime.dwHighDateTime=0x1d5de65, nFileSizeHigh=0x0, nFileSizeLow=0x4e34, dwReserved0=0x0, dwReserved1=0x0, cFileName="bA9c_Fmibk4JHEFbH.swf", cAlternateFileName="BA9C_F~1.SWF")) returned 1
	[0104.616] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5816fc60, ftCreationTime.dwHighDateTime=0x1d5e5f4, ftLastAccessTime.dwLowDateTime=0xcf659600, ftLastAccessTime.dwHighDateTime=0x1d5def6, ftLastWriteTime.dwLowDateTime=0xcf659600, ftLastWriteTime.dwHighDateTime=0x1d5def6, nFileSizeHigh=0x0, nFileSizeLow=0xd324, dwReserved0=0x0, dwReserved1=0x0, cFileName="cBHS6PSekjE2oEe.mp4", cAlternateFileName="CBHS6P~1.MP4")) returned 1
	[0104.616] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c711d60, ftCreationTime.dwHighDateTime=0x1d5e10e, ftLastAccessTime.dwLowDateTime=0x13f8bdb0, ftLastAccessTime.dwHighDateTime=0x1d5e66d, ftLastWriteTime.dwLowDateTime=0x13f8bdb0, ftLastWriteTime.dwHighDateTime=0x1d5e66d, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdnV4kPFNd2c.flv", cAlternateFileName="CDNV4K~1.FLV")) returned 1
	[0104.617] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0104.618] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11c1e40, ftCreationTime.dwHighDateTime=0x1d5e40f, ftLastAccessTime.dwLowDateTime=0x98baa350, ftLastAccessTime.dwHighDateTime=0x1d5e407, ftLastWriteTime.dwLowDateTime=0x98baa350, ftLastWriteTime.dwHighDateTime=0x1d5e407, nFileSizeHigh=0x0, nFileSizeLow=0xb534, dwReserved0=0x0, dwReserved1=0x0, cFileName="FQSRfJx70egdo.mkv", cAlternateFileName="FQSRFJ~1.MKV")) returned 1
	[0104.618] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x732f7420, ftCreationTime.dwHighDateTime=0x1d5e1ce, ftLastAccessTime.dwLowDateTime=0xc6cf1110, ftLastAccessTime.dwHighDateTime=0x1d5d875, ftLastWriteTime.dwLowDateTime=0xc6cf1110, ftLastWriteTime.dwHighDateTime=0x1d5d875, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="H0FMA3-ZiWq.swf", cAlternateFileName="H0FMA3~1.SWF")) returned 1
	[0104.619] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99fdfb0, ftCreationTime.dwHighDateTime=0x1d5e4dd, ftLastAccessTime.dwLowDateTime=0x4ca87890, ftLastAccessTime.dwHighDateTime=0x1d5de10, ftLastWriteTime.dwLowDateTime=0x4ca87890, ftLastWriteTime.dwHighDateTime=0x1d5de10, nFileSizeHigh=0x0, nFileSizeLow=0x892d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Iama-f.mp4", cAlternateFileName="")) returned 1
	[0104.619] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87c06a00, ftCreationTime.dwHighDateTime=0x1d5deec, ftLastAccessTime.dwLowDateTime=0x69617bc0, ftLastAccessTime.dwHighDateTime=0x1d5d9fc, ftLastWriteTime.dwLowDateTime=0x69617bc0, ftLastWriteTime.dwHighDateTime=0x1d5d9fc, nFileSizeHigh=0x0, nFileSizeLow=0xae71, dwReserved0=0x0, dwReserved1=0x0, cFileName="JFdel.mkv", cAlternateFileName="")) returned 1
	[0104.620] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd309f0, ftCreationTime.dwHighDateTime=0x1d5dfa5, ftLastAccessTime.dwLowDateTime=0x84eedb40, ftLastAccessTime.dwHighDateTime=0x1d5e351, ftLastWriteTime.dwLowDateTime=0x84eedb40, ftLastWriteTime.dwHighDateTime=0x1d5e351, nFileSizeHigh=0x0, nFileSizeLow=0xb7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kCgE8.avi", cAlternateFileName="")) returned 1
	[0104.620] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae7e62f0, ftCreationTime.dwHighDateTime=0x1d5e11c, ftLastAccessTime.dwLowDateTime=0xb22ccc60, ftLastAccessTime.dwHighDateTime=0x1d5e537, ftLastWriteTime.dwLowDateTime=0xb22ccc60, ftLastWriteTime.dwHighDateTime=0x1d5e537, nFileSizeHigh=0x0, nFileSizeLow=0xd1aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="kQkmMgUV.avi", cAlternateFileName="")) returned 1
	[0104.621] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fa23a80, ftCreationTime.dwHighDateTime=0x1d5e5b9, ftLastAccessTime.dwLowDateTime=0x7d23680, ftLastAccessTime.dwHighDateTime=0x1d5e5c6, ftLastWriteTime.dwLowDateTime=0x7d23680, ftLastWriteTime.dwHighDateTime=0x1d5e5c6, nFileSizeHigh=0x0, nFileSizeLow=0xf0d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="lUk_FImwRQDs69.mkv", cAlternateFileName="LUK_FI~1.MKV")) returned 1
	[0104.622] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c00d3e0, ftCreationTime.dwHighDateTime=0x1d5d8ed, ftLastAccessTime.dwLowDateTime=0xa61b50c0, ftLastAccessTime.dwHighDateTime=0x1d5e575, ftLastWriteTime.dwLowDateTime=0xa61b50c0, ftLastWriteTime.dwHighDateTime=0x1d5e575, nFileSizeHigh=0x0, nFileSizeLow=0x9c87, dwReserved0=0x0, dwReserved1=0x0, cFileName="mI0Ln7dyeRRDS X.swf", cAlternateFileName="MI0LN7~1.SWF")) returned 1
	[0104.622] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6f5ab0, ftCreationTime.dwHighDateTime=0x1d5e443, ftLastAccessTime.dwLowDateTime=0x9ee1e590, ftLastAccessTime.dwHighDateTime=0x1d5e23b, ftLastWriteTime.dwLowDateTime=0x9ee1e590, ftLastWriteTime.dwHighDateTime=0x1d5e23b, nFileSizeHigh=0x0, nFileSizeLow=0x5e03, dwReserved0=0x0, dwReserved1=0x0, cFileName="NJuX-r8.swf", cAlternateFileName="")) returned 1
	[0104.623] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc26f980, ftCreationTime.dwHighDateTime=0x1d5de92, ftLastAccessTime.dwLowDateTime=0x64982c20, ftLastAccessTime.dwHighDateTime=0x1d5de97, ftLastWriteTime.dwLowDateTime=0x64982c20, ftLastWriteTime.dwHighDateTime=0x1d5de97, nFileSizeHigh=0x0, nFileSizeLow=0x9fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORcela0_Hj.mkv", cAlternateFileName="ORCELA~1.MKV")) returned 1
	[0104.623] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89333110, ftCreationTime.dwHighDateTime=0x1d5d7df, ftLastAccessTime.dwLowDateTime=0x9737c590, ftLastAccessTime.dwHighDateTime=0x1d5e393, ftLastWriteTime.dwLowDateTime=0x9737c590, ftLastWriteTime.dwHighDateTime=0x1d5e393, nFileSizeHigh=0x0, nFileSizeLow=0xe15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="pzZ6Gkc0r.mp4", cAlternateFileName="PZZ6GK~1.MP4")) returned 1
	[0104.624] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e3ced0, ftCreationTime.dwHighDateTime=0x1d5e311, ftLastAccessTime.dwLowDateTime=0x92c550d0, ftLastAccessTime.dwHighDateTime=0x1d5dcaf, ftLastWriteTime.dwLowDateTime=0x92c550d0, ftLastWriteTime.dwHighDateTime=0x1d5dcaf, nFileSizeHigh=0x0, nFileSizeLow=0x18a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="qGQUmgkwXp46izd31hJn.mkv", cAlternateFileName="QGQUMG~1.MKV")) returned 1
	[0104.625] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e765660, ftCreationTime.dwHighDateTime=0x1d5db0c, ftLastAccessTime.dwLowDateTime=0x77c6d660, ftLastAccessTime.dwHighDateTime=0x1d5e41a, ftLastWriteTime.dwLowDateTime=0x77c6d660, ftLastWriteTime.dwHighDateTime=0x1d5e41a, nFileSizeHigh=0x0, nFileSizeLow=0x18397, dwReserved0=0x0, dwReserved1=0x0, cFileName="qT7rZtiHuleR.flv", cAlternateFileName="QT7RZT~1.FLV")) returned 1
	[0104.625] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f261370, ftCreationTime.dwHighDateTime=0x1d5db84, ftLastAccessTime.dwLowDateTime=0xc4935010, ftLastAccessTime.dwHighDateTime=0x1d5e756, ftLastWriteTime.dwLowDateTime=0xc4935010, ftLastWriteTime.dwHighDateTime=0x1d5e756, nFileSizeHigh=0x0, nFileSizeLow=0x1337f, dwReserved0=0x0, dwReserved1=0x0, cFileName="qy4dfknTHpQkkWMoN.avi", cAlternateFileName="QY4DFK~1.AVI")) returned 1
	[0104.625] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2a65c80, ftCreationTime.dwHighDateTime=0x1d5dfa8, ftLastAccessTime.dwLowDateTime=0x7484f60, ftLastAccessTime.dwHighDateTime=0x1d5d978, ftLastWriteTime.dwLowDateTime=0x7484f60, ftLastWriteTime.dwHighDateTime=0x1d5d978, nFileSizeHigh=0x0, nFileSizeLow=0x165b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIY_bByk3AqSt_uGIPej.avi", cAlternateFileName="RIY_BB~1.AVI")) returned 1
	[0104.626] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda69510, ftCreationTime.dwHighDateTime=0x1d5e125, ftLastAccessTime.dwLowDateTime=0x1f375700, ftLastAccessTime.dwHighDateTime=0x1d5dbbd, ftLastWriteTime.dwLowDateTime=0x1f375700, ftLastWriteTime.dwHighDateTime=0x1d5dbbd, nFileSizeHigh=0x0, nFileSizeLow=0x12505, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sgbe.mkv", cAlternateFileName="")) returned 1
	[0104.627] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c55150, ftCreationTime.dwHighDateTime=0x1d5d953, ftLastAccessTime.dwLowDateTime=0x74a0f610, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x74a0f610, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x50ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="syMq1a3.swf", cAlternateFileName="")) returned 1
	[0104.627] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dbc71b0, ftCreationTime.dwHighDateTime=0x1d5db0b, ftLastAccessTime.dwLowDateTime=0x80047090, ftLastAccessTime.dwHighDateTime=0x1d5e6a3, ftLastWriteTime.dwLowDateTime=0x80047090, ftLastWriteTime.dwHighDateTime=0x1d5e6a3, nFileSizeHigh=0x0, nFileSizeLow=0xfc75, dwReserved0=0x0, dwReserved1=0x0, cFileName="v8UgBFLWiLajpjSd7VV.mkv", cAlternateFileName="V8UGBF~1.MKV")) returned 1
	[0104.628] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5baa0, ftCreationTime.dwHighDateTime=0x1d5df9e, ftLastAccessTime.dwLowDateTime=0xed9efa40, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0xed9efa40, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0xd0f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="vpnU iLAoi_D.mp4", cAlternateFileName="VPNUIL~1.MP4")) returned 1
	[0104.628] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4224040, ftCreationTime.dwHighDateTime=0x1d5dce6, ftLastAccessTime.dwLowDateTime=0x78080270, ftLastAccessTime.dwHighDateTime=0x1d5e6a9, ftLastWriteTime.dwLowDateTime=0x78080270, ftLastWriteTime.dwHighDateTime=0x1d5e6a9, nFileSizeHigh=0x0, nFileSizeLow=0x87ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="vrZdAkjZcyLf2SH4m.swf", cAlternateFileName="VRZDAK~1.SWF")) returned 1
	[0104.629] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x608aed80, ftCreationTime.dwHighDateTime=0x1d5dd74, ftLastAccessTime.dwLowDateTime=0x9f0235e0, ftLastAccessTime.dwHighDateTime=0x1d5e1da, ftLastWriteTime.dwLowDateTime=0x9f0235e0, ftLastWriteTime.dwHighDateTime=0x1d5e1da, nFileSizeHigh=0x0, nFileSizeLow=0x6107, dwReserved0=0x0, dwReserved1=0x0, cFileName="wWJpy8YigkqG2kS.mp4", cAlternateFileName="WWJPY8~1.MP4")) returned 1
	[0104.630] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd39a5580, ftCreationTime.dwHighDateTime=0x1d5d7e4, ftLastAccessTime.dwLowDateTime=0x55e8fbb0, ftLastAccessTime.dwHighDateTime=0x1d5e4ea, ftLastWriteTime.dwLowDateTime=0x55e8fbb0, ftLastWriteTime.dwHighDateTime=0x1d5e4ea, nFileSizeHigh=0x0, nFileSizeLow=0xca0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="XJxyezyLbOpsuYa.mkv", cAlternateFileName="XJXYEZ~1.MKV")) returned 1
	[0104.630] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2294f380, ftCreationTime.dwHighDateTime=0x1d5e68a, ftLastAccessTime.dwLowDateTime=0x94f64140, ftLastAccessTime.dwHighDateTime=0x1d5db54, ftLastWriteTime.dwLowDateTime=0x94f64140, ftLastWriteTime.dwHighDateTime=0x1d5db54, nFileSizeHigh=0x0, nFileSizeLow=0xdea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="XNnfFuhF.mp4", cAlternateFileName="")) returned 1
	[0104.631] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef12d10, ftCreationTime.dwHighDateTime=0x1d5dc35, ftLastAccessTime.dwLowDateTime=0x6095c5f0, ftLastAccessTime.dwHighDateTime=0x1d5e4a6, ftLastWriteTime.dwLowDateTime=0x6095c5f0, ftLastWriteTime.dwHighDateTime=0x1d5e4a6, nFileSizeHigh=0x0, nFileSizeLow=0xd91d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zxkmfk.flv", cAlternateFileName="")) returned 1
	[0104.631] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed434f40, ftCreationTime.dwHighDateTime=0x1d5d812, ftLastAccessTime.dwLowDateTime=0xec51a340, ftLastAccessTime.dwHighDateTime=0x1d5e3fa, ftLastWriteTime.dwLowDateTime=0xec51a340, ftLastWriteTime.dwHighDateTime=0x1d5e3fa, nFileSizeHigh=0x0, nFileSizeLow=0x13a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="_2upRs39Y05.mkv", cAlternateFileName="_2UPRS~1.MKV")) returned 1
	[0104.633] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed434f40, ftCreationTime.dwHighDateTime=0x1d5d812, ftLastAccessTime.dwLowDateTime=0xec51a340, ftLastAccessTime.dwHighDateTime=0x1d5e3fa, ftLastWriteTime.dwLowDateTime=0xec51a340, ftLastWriteTime.dwHighDateTime=0x1d5e3fa, nFileSizeHigh=0x0, nFileSizeLow=0x13a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="_2upRs39Y05.mkv", cAlternateFileName="_2UPRS~1.MKV")) returned 0
	[0104.633] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0104.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0104.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0104.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24
	[0104.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpFilePart=0x0) returned 0x25
	[0104.634] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdaa63dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa63dc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0104.635] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdaa63dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdaa63dc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.636] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcda0abf0, ftCreationTime.dwHighDateTime=0x1d5dc6e, ftLastAccessTime.dwLowDateTime=0xee0a0470, ftLastAccessTime.dwHighDateTime=0x1d5e143, ftLastWriteTime.dwLowDateTime=0xee0a0470, ftLastWriteTime.dwHighDateTime=0x1d5e143, nFileSizeHigh=0x0, nFileSizeLow=0x16d5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="-O O 1zWVogn.swf", cAlternateFileName="-OO1ZW~1.SWF")) returned 1
	[0104.636] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39aeefc0, ftCreationTime.dwHighDateTime=0x1d5d998, ftLastAccessTime.dwLowDateTime=0xda6a410, ftLastAccessTime.dwHighDateTime=0x1d5e7fb, ftLastWriteTime.dwLowDateTime=0xda6a410, ftLastWriteTime.dwHighDateTime=0x1d5e7fb, nFileSizeHigh=0x0, nFileSizeLow=0x30db, dwReserved0=0x0, dwReserved1=0x0, cFileName="0GJPN.flv", cAlternateFileName="")) returned 1
	[0104.637] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9844d20, ftCreationTime.dwHighDateTime=0x1d5d9ae, ftLastAccessTime.dwLowDateTime=0x8134d0e0, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x8134d0e0, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x10091, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Y4ss7NtmNX.swf", cAlternateFileName="1Y4SS7~1.SWF")) returned 1
	[0104.637] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x566589b0, ftCreationTime.dwHighDateTime=0x1d5e6e2, ftLastAccessTime.dwLowDateTime=0xbd76a660, ftLastAccessTime.dwHighDateTime=0x1d5e3f5, ftLastWriteTime.dwLowDateTime=0xbd76a660, ftLastWriteTime.dwHighDateTime=0x1d5e3f5, nFileSizeHigh=0x0, nFileSizeLow=0xccb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="6KtNyQ61p.avi", cAlternateFileName="6KTNYQ~1.AVI")) returned 1
	[0104.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6KtNyQ61p.avi", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6KtNyQ61p.avi", lpFilePart=0x0) returned 0x32
	[0104.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.638] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6KtNyQ61p.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ktnyq61p.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.638] GetFileType (hFile=0x204) returned 0x1
	[0104.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.638] GetFileType (hFile=0x204) returned 0x1
	[0104.639] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xccb2
	[0104.639] ReadFile (in: hFile=0x204, lpBuffer=0x26ac6fc, nNumberOfBytesToRead=0xccb2, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x26ac6fc*, lpNumberOfBytesRead=0x26efc4*=0xccb2, lpOverlapped=0x0) returned 1
	[0104.642] CloseHandle (hObject=0x204) returned 1
	[0104.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6KtNyQ61p.avi.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6KtNyQ61p.avi.KEKW", lpFilePart=0x0) returned 0x37
	[0104.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6KtNyQ61p.avi.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ktnyq61p.avi.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.644] GetFileType (hFile=0x204) returned 0x1
	[0104.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.644] GetFileType (hFile=0x204) returned 0x1
	[0104.645] WriteFile (in: hFile=0x204, lpBuffer=0x26baa6c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26baa6c*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.651] CloseHandle (hObject=0x204) returned 1
	[0104.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6KtNyQ61p.avi", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6KtNyQ61p.avi", lpFilePart=0x0) returned 0x32
	[0104.651] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6KtNyQ61p.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6ktnyq61p.avi")) returned 1
	[0104.656] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67d844e0, ftCreationTime.dwHighDateTime=0x1d5e169, ftLastAccessTime.dwLowDateTime=0x4f4cfa10, ftLastAccessTime.dwHighDateTime=0x1d5d7cd, ftLastWriteTime.dwLowDateTime=0x4f4cfa10, ftLastWriteTime.dwHighDateTime=0x1d5d7cd, nFileSizeHigh=0x0, nFileSizeLow=0x8743, dwReserved0=0x0, dwReserved1=0x0, cFileName="6z0nNXnW.flv", cAlternateFileName="")) returned 1
	[0104.656] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb2ff0, ftCreationTime.dwHighDateTime=0x1d5e674, ftLastAccessTime.dwLowDateTime=0xe324e210, ftLastAccessTime.dwHighDateTime=0x1d5d8f5, ftLastWriteTime.dwLowDateTime=0xe324e210, ftLastWriteTime.dwHighDateTime=0x1d5d8f5, nFileSizeHigh=0x0, nFileSizeLow=0x10995, dwReserved0=0x0, dwReserved1=0x0, cFileName="6_GPHIcKrmLgtOgG0UC5.avi", cAlternateFileName="6_GPHI~1.AVI")) returned 1
	[0104.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6_GPHIcKrmLgtOgG0UC5.avi", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6_GPHIcKrmLgtOgG0UC5.avi", lpFilePart=0x0) returned 0x3d
	[0104.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6_GPHIcKrmLgtOgG0UC5.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6_gphickrmlgtogg0uc5.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.657] GetFileType (hFile=0x204) returned 0x1
	[0104.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.658] GetFileType (hFile=0x204) returned 0x1
	[0104.658] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x10995
	[0104.658] ReadFile (in: hFile=0x204, lpBuffer=0x26bc280, nNumberOfBytesToRead=0x10995, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x26bc280*, lpNumberOfBytesRead=0x26efc4*=0x10995, lpOverlapped=0x0) returned 1
	[0104.662] CloseHandle (hObject=0x204) returned 1
	[0104.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6_GPHIcKrmLgtOgG0UC5.avi.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6_GPHIcKrmLgtOgG0UC5.avi.KEKW", lpFilePart=0x0) returned 0x42
	[0104.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6_GPHIcKrmLgtOgG0UC5.avi.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6_gphickrmlgtogg0uc5.avi.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.663] GetFileType (hFile=0x204) returned 0x1
	[0104.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.664] GetFileType (hFile=0x204) returned 0x1
	[0104.664] WriteFile (in: hFile=0x204, lpBuffer=0x26ce318*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26ce318*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.667] CloseHandle (hObject=0x204) returned 1
	[0104.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6_GPHIcKrmLgtOgG0UC5.avi", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6_GPHIcKrmLgtOgG0UC5.avi", lpFilePart=0x0) returned 0x3d
	[0104.668] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\6_GPHIcKrmLgtOgG0UC5.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\6_gphickrmlgtogg0uc5.avi")) returned 1
	[0104.674] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd64d020, ftCreationTime.dwHighDateTime=0x1d5dc00, ftLastAccessTime.dwLowDateTime=0x58c80bb0, ftLastAccessTime.dwHighDateTime=0x1d5d8f5, ftLastWriteTime.dwLowDateTime=0x58c80bb0, ftLastWriteTime.dwHighDateTime=0x1d5d8f5, nFileSizeHigh=0x0, nFileSizeLow=0x8b55, dwReserved0=0x0, dwReserved1=0x0, cFileName="AT5BZgfjDTw5u.swf", cAlternateFileName="AT5BZG~1.SWF")) returned 1
	[0104.675] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fb009d0, ftCreationTime.dwHighDateTime=0x1d5dace, ftLastAccessTime.dwLowDateTime=0x47350d60, ftLastAccessTime.dwHighDateTime=0x1d5de65, ftLastWriteTime.dwLowDateTime=0x47350d60, ftLastWriteTime.dwHighDateTime=0x1d5de65, nFileSizeHigh=0x0, nFileSizeLow=0x4e34, dwReserved0=0x0, dwReserved1=0x0, cFileName="bA9c_Fmibk4JHEFbH.swf", cAlternateFileName="BA9C_F~1.SWF")) returned 1
	[0104.676] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5816fc60, ftCreationTime.dwHighDateTime=0x1d5e5f4, ftLastAccessTime.dwLowDateTime=0xcf659600, ftLastAccessTime.dwHighDateTime=0x1d5def6, ftLastWriteTime.dwLowDateTime=0xcf659600, ftLastWriteTime.dwHighDateTime=0x1d5def6, nFileSizeHigh=0x0, nFileSizeLow=0xd324, dwReserved0=0x0, dwReserved1=0x0, cFileName="cBHS6PSekjE2oEe.mp4", cAlternateFileName="CBHS6P~1.MP4")) returned 1
	[0104.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\cBHS6PSekjE2oEe.mp4", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\cBHS6PSekjE2oEe.mp4", lpFilePart=0x0) returned 0x38
	[0104.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\cBHS6PSekjE2oEe.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cbhs6psekje2oee.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.677] GetFileType (hFile=0x204) returned 0x1
	[0104.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.678] GetFileType (hFile=0x204) returned 0x1
	[0104.678] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xd324
	[0104.678] ReadFile (in: hFile=0x204, lpBuffer=0x26cfed0, nNumberOfBytesToRead=0xd324, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x26cfed0*, lpNumberOfBytesRead=0x26efc4*=0xd324, lpOverlapped=0x0) returned 1
	[0104.684] CloseHandle (hObject=0x204) returned 1
	[0104.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\cBHS6PSekjE2oEe.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\cBHS6PSekjE2oEe.mp4.KEKW", lpFilePart=0x0) returned 0x3d
	[0104.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\cBHS6PSekjE2oEe.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cbhs6psekje2oee.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.686] GetFileType (hFile=0x204) returned 0x1
	[0104.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.686] GetFileType (hFile=0x204) returned 0x1
	[0104.687] WriteFile (in: hFile=0x204, lpBuffer=0x26de8d4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26de8d4*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.691] CloseHandle (hObject=0x204) returned 1
	[0104.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\cBHS6PSekjE2oEe.mp4", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\cBHS6PSekjE2oEe.mp4", lpFilePart=0x0) returned 0x38
	[0104.692] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\cBHS6PSekjE2oEe.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cbhs6psekje2oee.mp4")) returned 1
	[0104.697] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c711d60, ftCreationTime.dwHighDateTime=0x1d5e10e, ftLastAccessTime.dwLowDateTime=0x13f8bdb0, ftLastAccessTime.dwHighDateTime=0x1d5e66d, ftLastWriteTime.dwLowDateTime=0x13f8bdb0, ftLastWriteTime.dwHighDateTime=0x1d5e66d, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x0, dwReserved1=0x0, cFileName="cdnV4kPFNd2c.flv", cAlternateFileName="CDNV4K~1.FLV")) returned 1
	[0104.697] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0104.698] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11c1e40, ftCreationTime.dwHighDateTime=0x1d5e40f, ftLastAccessTime.dwLowDateTime=0x98baa350, ftLastAccessTime.dwHighDateTime=0x1d5e407, ftLastWriteTime.dwLowDateTime=0x98baa350, ftLastWriteTime.dwHighDateTime=0x1d5e407, nFileSizeHigh=0x0, nFileSizeLow=0xb534, dwReserved0=0x0, dwReserved1=0x0, cFileName="FQSRfJx70egdo.mkv", cAlternateFileName="FQSRFJ~1.MKV")) returned 1
	[0104.698] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x732f7420, ftCreationTime.dwHighDateTime=0x1d5e1ce, ftLastAccessTime.dwLowDateTime=0xc6cf1110, ftLastAccessTime.dwHighDateTime=0x1d5d875, ftLastWriteTime.dwLowDateTime=0xc6cf1110, ftLastWriteTime.dwHighDateTime=0x1d5d875, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="H0FMA3-ZiWq.swf", cAlternateFileName="H0FMA3~1.SWF")) returned 1
	[0104.698] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99fdfb0, ftCreationTime.dwHighDateTime=0x1d5e4dd, ftLastAccessTime.dwLowDateTime=0x4ca87890, ftLastAccessTime.dwHighDateTime=0x1d5de10, ftLastWriteTime.dwLowDateTime=0x4ca87890, ftLastWriteTime.dwHighDateTime=0x1d5de10, nFileSizeHigh=0x0, nFileSizeLow=0x892d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Iama-f.mp4", cAlternateFileName="")) returned 1
	[0104.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Iama-f.mp4", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Iama-f.mp4", lpFilePart=0x0) returned 0x2f
	[0104.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Iama-f.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\iama-f.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.699] GetFileType (hFile=0x204) returned 0x1
	[0104.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.700] GetFileType (hFile=0x204) returned 0x1
	[0104.700] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x892d
	[0104.700] ReadFile (in: hFile=0x204, lpBuffer=0x26e0988, nNumberOfBytesToRead=0x892d, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x26e0988*, lpNumberOfBytesRead=0x26efc4*=0x892d, lpOverlapped=0x0) returned 1
	[0104.703] CloseHandle (hObject=0x204) returned 1
	[0104.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Iama-f.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Iama-f.mp4.KEKW", lpFilePart=0x0) returned 0x34
	[0104.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Iama-f.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\iama-f.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.705] GetFileType (hFile=0x204) returned 0x1
	[0104.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.705] GetFileType (hFile=0x204) returned 0x1
	[0104.706] WriteFile (in: hFile=0x204, lpBuffer=0x26ea964*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26ea964*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.708] CloseHandle (hObject=0x204) returned 1
	[0104.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Iama-f.mp4", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Iama-f.mp4", lpFilePart=0x0) returned 0x2f
	[0104.709] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Iama-f.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\iama-f.mp4")) returned 1
	[0104.713] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87c06a00, ftCreationTime.dwHighDateTime=0x1d5deec, ftLastAccessTime.dwLowDateTime=0x69617bc0, ftLastAccessTime.dwHighDateTime=0x1d5d9fc, ftLastWriteTime.dwLowDateTime=0x69617bc0, ftLastWriteTime.dwHighDateTime=0x1d5d9fc, nFileSizeHigh=0x0, nFileSizeLow=0xae71, dwReserved0=0x0, dwReserved1=0x0, cFileName="JFdel.mkv", cAlternateFileName="")) returned 1
	[0104.713] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd309f0, ftCreationTime.dwHighDateTime=0x1d5dfa5, ftLastAccessTime.dwLowDateTime=0x84eedb40, ftLastAccessTime.dwHighDateTime=0x1d5e351, ftLastWriteTime.dwLowDateTime=0x84eedb40, ftLastWriteTime.dwHighDateTime=0x1d5e351, nFileSizeHigh=0x0, nFileSizeLow=0xb7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kCgE8.avi", cAlternateFileName="")) returned 1
	[0104.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kCgE8.avi", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kCgE8.avi", lpFilePart=0x0) returned 0x2e
	[0104.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kCgE8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\kcge8.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.714] GetFileType (hFile=0x204) returned 0x1
	[0104.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.714] GetFileType (hFile=0x204) returned 0x1
	[0104.715] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xb7e0
	[0104.715] ReadFile (in: hFile=0x204, lpBuffer=0x26ec03c, nNumberOfBytesToRead=0xb7e0, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x26ec03c*, lpNumberOfBytesRead=0x26efc4*=0xb7e0, lpOverlapped=0x0) returned 1
	[0104.719] CloseHandle (hObject=0x204) returned 1
	[0104.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kCgE8.avi.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kCgE8.avi.KEKW", lpFilePart=0x0) returned 0x33
	[0104.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kCgE8.avi.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\kcge8.avi.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.720] GetFileType (hFile=0x204) returned 0x1
	[0104.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.720] GetFileType (hFile=0x204) returned 0x1
	[0104.721] WriteFile (in: hFile=0x204, lpBuffer=0x26f8ec0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x26f8ec0*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.724] CloseHandle (hObject=0x204) returned 1
	[0104.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kCgE8.avi", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kCgE8.avi", lpFilePart=0x0) returned 0x2e
	[0104.724] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kCgE8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\kcge8.avi")) returned 1
	[0104.729] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae7e62f0, ftCreationTime.dwHighDateTime=0x1d5e11c, ftLastAccessTime.dwLowDateTime=0xb22ccc60, ftLastAccessTime.dwHighDateTime=0x1d5e537, ftLastWriteTime.dwLowDateTime=0xb22ccc60, ftLastWriteTime.dwHighDateTime=0x1d5e537, nFileSizeHigh=0x0, nFileSizeLow=0xd1aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="kQkmMgUV.avi", cAlternateFileName="")) returned 1
	[0104.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kQkmMgUV.avi", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kQkmMgUV.avi", lpFilePart=0x0) returned 0x31
	[0104.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kQkmMgUV.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\kqkmmguv.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.730] GetFileType (hFile=0x204) returned 0x1
	[0104.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.730] GetFileType (hFile=0x204) returned 0x1
	[0104.730] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xd1aa
	[0104.730] ReadFile (in: hFile=0x204, lpBuffer=0x26fa308, nNumberOfBytesToRead=0xd1aa, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x26fa308*, lpNumberOfBytesRead=0x26efc4*=0xd1aa, lpOverlapped=0x0) returned 1
	[0104.734] CloseHandle (hObject=0x204) returned 1
	[0104.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kQkmMgUV.avi.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kQkmMgUV.avi.KEKW", lpFilePart=0x0) returned 0x36
	[0104.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kQkmMgUV.avi.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\kqkmmguv.avi.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.740] GetFileType (hFile=0x204) returned 0x1
	[0104.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.740] GetFileType (hFile=0x204) returned 0x1
	[0104.741] WriteFile (in: hFile=0x204, lpBuffer=0x2708b6c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2708b6c*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.744] CloseHandle (hObject=0x204) returned 1
	[0104.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kQkmMgUV.avi", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kQkmMgUV.avi", lpFilePart=0x0) returned 0x31
	[0104.744] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\kQkmMgUV.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\kqkmmguv.avi")) returned 1
	[0104.751] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fa23a80, ftCreationTime.dwHighDateTime=0x1d5e5b9, ftLastAccessTime.dwLowDateTime=0x7d23680, ftLastAccessTime.dwHighDateTime=0x1d5e5c6, ftLastWriteTime.dwLowDateTime=0x7d23680, ftLastWriteTime.dwHighDateTime=0x1d5e5c6, nFileSizeHigh=0x0, nFileSizeLow=0xf0d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="lUk_FImwRQDs69.mkv", cAlternateFileName="LUK_FI~1.MKV")) returned 1
	[0104.751] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c00d3e0, ftCreationTime.dwHighDateTime=0x1d5d8ed, ftLastAccessTime.dwLowDateTime=0xa61b50c0, ftLastAccessTime.dwHighDateTime=0x1d5e575, ftLastWriteTime.dwLowDateTime=0xa61b50c0, ftLastWriteTime.dwHighDateTime=0x1d5e575, nFileSizeHigh=0x0, nFileSizeLow=0x9c87, dwReserved0=0x0, dwReserved1=0x0, cFileName="mI0Ln7dyeRRDS X.swf", cAlternateFileName="MI0LN7~1.SWF")) returned 1
	[0104.753] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6f5ab0, ftCreationTime.dwHighDateTime=0x1d5e443, ftLastAccessTime.dwLowDateTime=0x9ee1e590, ftLastAccessTime.dwHighDateTime=0x1d5e23b, ftLastWriteTime.dwLowDateTime=0x9ee1e590, ftLastWriteTime.dwHighDateTime=0x1d5e23b, nFileSizeHigh=0x0, nFileSizeLow=0x5e03, dwReserved0=0x0, dwReserved1=0x0, cFileName="NJuX-r8.swf", cAlternateFileName="")) returned 1
	[0104.753] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc26f980, ftCreationTime.dwHighDateTime=0x1d5de92, ftLastAccessTime.dwLowDateTime=0x64982c20, ftLastAccessTime.dwHighDateTime=0x1d5de97, ftLastWriteTime.dwLowDateTime=0x64982c20, ftLastWriteTime.dwHighDateTime=0x1d5de97, nFileSizeHigh=0x0, nFileSizeLow=0x9fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORcela0_Hj.mkv", cAlternateFileName="ORCELA~1.MKV")) returned 1
	[0104.754] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89333110, ftCreationTime.dwHighDateTime=0x1d5d7df, ftLastAccessTime.dwLowDateTime=0x9737c590, ftLastAccessTime.dwHighDateTime=0x1d5e393, ftLastWriteTime.dwLowDateTime=0x9737c590, ftLastWriteTime.dwHighDateTime=0x1d5e393, nFileSizeHigh=0x0, nFileSizeLow=0xe15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="pzZ6Gkc0r.mp4", cAlternateFileName="PZZ6GK~1.MP4")) returned 1
	[0104.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\pzZ6Gkc0r.mp4", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\pzZ6Gkc0r.mp4", lpFilePart=0x0) returned 0x32
	[0104.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\pzZ6Gkc0r.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pzz6gkc0r.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.755] GetFileType (hFile=0x204) returned 0x1
	[0104.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.756] GetFileType (hFile=0x204) returned 0x1
	[0104.756] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xe15d
	[0104.756] ReadFile (in: hFile=0x204, lpBuffer=0x270ac8c, nNumberOfBytesToRead=0xe15d, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x270ac8c*, lpNumberOfBytesRead=0x26efc4*=0xe15d, lpOverlapped=0x0) returned 1
	[0104.762] CloseHandle (hObject=0x204) returned 1
	[0104.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\pzZ6Gkc0r.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\pzZ6Gkc0r.mp4.KEKW", lpFilePart=0x0) returned 0x37
	[0104.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\pzZ6Gkc0r.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pzz6gkc0r.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.764] GetFileType (hFile=0x204) returned 0x1
	[0104.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.765] GetFileType (hFile=0x204) returned 0x1
	[0104.765] WriteFile (in: hFile=0x204, lpBuffer=0x271a4a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x271a4a8*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.768] CloseHandle (hObject=0x204) returned 1
	[0104.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\pzZ6Gkc0r.mp4", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\pzZ6Gkc0r.mp4", lpFilePart=0x0) returned 0x32
	[0104.768] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\pzZ6Gkc0r.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pzz6gkc0r.mp4")) returned 1
	[0104.773] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92e3ced0, ftCreationTime.dwHighDateTime=0x1d5e311, ftLastAccessTime.dwLowDateTime=0x92c550d0, ftLastAccessTime.dwHighDateTime=0x1d5dcaf, ftLastWriteTime.dwLowDateTime=0x92c550d0, ftLastWriteTime.dwHighDateTime=0x1d5dcaf, nFileSizeHigh=0x0, nFileSizeLow=0x18a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="qGQUmgkwXp46izd31hJn.mkv", cAlternateFileName="QGQUMG~1.MKV")) returned 1
	[0104.773] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e765660, ftCreationTime.dwHighDateTime=0x1d5db0c, ftLastAccessTime.dwLowDateTime=0x77c6d660, ftLastAccessTime.dwHighDateTime=0x1d5e41a, ftLastWriteTime.dwLowDateTime=0x77c6d660, ftLastWriteTime.dwHighDateTime=0x1d5e41a, nFileSizeHigh=0x0, nFileSizeLow=0x18397, dwReserved0=0x0, dwReserved1=0x0, cFileName="qT7rZtiHuleR.flv", cAlternateFileName="QT7RZT~1.FLV")) returned 1
	[0104.774] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f261370, ftCreationTime.dwHighDateTime=0x1d5db84, ftLastAccessTime.dwLowDateTime=0xc4935010, ftLastAccessTime.dwHighDateTime=0x1d5e756, ftLastWriteTime.dwLowDateTime=0xc4935010, ftLastWriteTime.dwHighDateTime=0x1d5e756, nFileSizeHigh=0x0, nFileSizeLow=0x1337f, dwReserved0=0x0, dwReserved1=0x0, cFileName="qy4dfknTHpQkkWMoN.avi", cAlternateFileName="QY4DFK~1.AVI")) returned 1
	[0104.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qy4dfknTHpQkkWMoN.avi", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qy4dfknTHpQkkWMoN.avi", lpFilePart=0x0) returned 0x3a
	[0104.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qy4dfknTHpQkkWMoN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qy4dfknthpqkkwmon.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.775] GetFileType (hFile=0x204) returned 0x1
	[0104.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.775] GetFileType (hFile=0x204) returned 0x1
	[0104.775] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x1337f
	[0104.776] ReadFile (in: hFile=0x204, lpBuffer=0x271c07c, nNumberOfBytesToRead=0x1337f, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x271c07c*, lpNumberOfBytesRead=0x26efc4*=0x1337f, lpOverlapped=0x0) returned 1
	[0104.779] CloseHandle (hObject=0x204) returned 1
	[0104.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qy4dfknTHpQkkWMoN.avi.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qy4dfknTHpQkkWMoN.avi.KEKW", lpFilePart=0x0) returned 0x3f
	[0104.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qy4dfknTHpQkkWMoN.avi.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qy4dfknthpqkkwmon.avi.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.781] GetFileType (hFile=0x204) returned 0x1
	[0104.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.781] GetFileType (hFile=0x204) returned 0x1
	[0104.782] WriteFile (in: hFile=0x204, lpBuffer=0x2730ae8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2730ae8*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.785] CloseHandle (hObject=0x204) returned 1
	[0104.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qy4dfknTHpQkkWMoN.avi", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qy4dfknTHpQkkWMoN.avi", lpFilePart=0x0) returned 0x3a
	[0104.785] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\qy4dfknTHpQkkWMoN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qy4dfknthpqkkwmon.avi")) returned 1
	[0104.795] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2a65c80, ftCreationTime.dwHighDateTime=0x1d5dfa8, ftLastAccessTime.dwLowDateTime=0x7484f60, ftLastAccessTime.dwHighDateTime=0x1d5d978, ftLastWriteTime.dwLowDateTime=0x7484f60, ftLastWriteTime.dwHighDateTime=0x1d5d978, nFileSizeHigh=0x0, nFileSizeLow=0x165b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIY_bByk3AqSt_uGIPej.avi", cAlternateFileName="RIY_BB~1.AVI")) returned 1
	[0104.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RIY_bByk3AqSt_uGIPej.avi", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RIY_bByk3AqSt_uGIPej.avi", lpFilePart=0x0) returned 0x3d
	[0104.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RIY_bByk3AqSt_uGIPej.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\riy_bbyk3aqst_ugipej.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.796] GetFileType (hFile=0x204) returned 0x1
	[0104.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.796] GetFileType (hFile=0x204) returned 0x1
	[0104.796] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x165b9
	[0104.797] ReadFile (in: hFile=0x204, lpBuffer=0x379ed38, nNumberOfBytesToRead=0x165b9, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x379ed38*, lpNumberOfBytesRead=0x26efc4*=0x165b9, lpOverlapped=0x0) returned 1
	[0104.804] CloseHandle (hObject=0x204) returned 1
	[0104.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RIY_bByk3AqSt_uGIPej.avi.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RIY_bByk3AqSt_uGIPej.avi.KEKW", lpFilePart=0x0) returned 0x42
	[0104.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RIY_bByk3AqSt_uGIPej.avi.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\riy_bbyk3aqst_ugipej.avi.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.806] GetFileType (hFile=0x204) returned 0x1
	[0104.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.806] GetFileType (hFile=0x204) returned 0x1
	[0104.806] WriteFile (in: hFile=0x204, lpBuffer=0x2733724*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2733724*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.809] CloseHandle (hObject=0x204) returned 1
	[0104.810] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RIY_bByk3AqSt_uGIPej.avi", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RIY_bByk3AqSt_uGIPej.avi", lpFilePart=0x0) returned 0x3d
	[0104.810] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RIY_bByk3AqSt_uGIPej.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\riy_bbyk3aqst_ugipej.avi")) returned 1
	[0104.815] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda69510, ftCreationTime.dwHighDateTime=0x1d5e125, ftLastAccessTime.dwLowDateTime=0x1f375700, ftLastAccessTime.dwHighDateTime=0x1d5dbbd, ftLastWriteTime.dwLowDateTime=0x1f375700, ftLastWriteTime.dwHighDateTime=0x1d5dbbd, nFileSizeHigh=0x0, nFileSizeLow=0x12505, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sgbe.mkv", cAlternateFileName="")) returned 1
	[0104.815] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c55150, ftCreationTime.dwHighDateTime=0x1d5d953, ftLastAccessTime.dwLowDateTime=0x74a0f610, ftLastAccessTime.dwHighDateTime=0x1d5de0b, ftLastWriteTime.dwLowDateTime=0x74a0f610, ftLastWriteTime.dwHighDateTime=0x1d5de0b, nFileSizeHigh=0x0, nFileSizeLow=0x50ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="syMq1a3.swf", cAlternateFileName="")) returned 1
	[0104.815] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dbc71b0, ftCreationTime.dwHighDateTime=0x1d5db0b, ftLastAccessTime.dwLowDateTime=0x80047090, ftLastAccessTime.dwHighDateTime=0x1d5e6a3, ftLastWriteTime.dwLowDateTime=0x80047090, ftLastWriteTime.dwHighDateTime=0x1d5e6a3, nFileSizeHigh=0x0, nFileSizeLow=0xfc75, dwReserved0=0x0, dwReserved1=0x0, cFileName="v8UgBFLWiLajpjSd7VV.mkv", cAlternateFileName="V8UGBF~1.MKV")) returned 1
	[0104.816] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5baa0, ftCreationTime.dwHighDateTime=0x1d5df9e, ftLastAccessTime.dwLowDateTime=0xed9efa40, ftLastAccessTime.dwHighDateTime=0x1d5d806, ftLastWriteTime.dwLowDateTime=0xed9efa40, ftLastWriteTime.dwHighDateTime=0x1d5d806, nFileSizeHigh=0x0, nFileSizeLow=0xd0f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="vpnU iLAoi_D.mp4", cAlternateFileName="VPNUIL~1.MP4")) returned 1
	[0104.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\vpnU iLAoi_D.mp4", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\vpnU iLAoi_D.mp4", lpFilePart=0x0) returned 0x35
	[0104.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\vpnU iLAoi_D.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vpnu ilaoi_d.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.817] GetFileType (hFile=0x204) returned 0x1
	[0104.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.817] GetFileType (hFile=0x204) returned 0x1
	[0104.817] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xd0f1
	[0104.818] ReadFile (in: hFile=0x204, lpBuffer=0x27354fc, nNumberOfBytesToRead=0xd0f1, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x27354fc*, lpNumberOfBytesRead=0x26efc4*=0xd0f1, lpOverlapped=0x0) returned 1
	[0104.825] CloseHandle (hObject=0x204) returned 1
	[0104.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\vpnU iLAoi_D.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\vpnU iLAoi_D.mp4.KEKW", lpFilePart=0x0) returned 0x3a
	[0104.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\vpnU iLAoi_D.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vpnu ilaoi_d.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.826] GetFileType (hFile=0x204) returned 0x1
	[0104.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.826] GetFileType (hFile=0x204) returned 0x1
	[0104.827] WriteFile (in: hFile=0x204, lpBuffer=0x2743cc0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2743cc0*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.830] CloseHandle (hObject=0x204) returned 1
	[0104.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\vpnU iLAoi_D.mp4", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\vpnU iLAoi_D.mp4", lpFilePart=0x0) returned 0x35
	[0104.830] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\vpnU iLAoi_D.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\vpnu ilaoi_d.mp4")) returned 1
	[0104.834] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4224040, ftCreationTime.dwHighDateTime=0x1d5dce6, ftLastAccessTime.dwLowDateTime=0x78080270, ftLastAccessTime.dwHighDateTime=0x1d5e6a9, ftLastWriteTime.dwLowDateTime=0x78080270, ftLastWriteTime.dwHighDateTime=0x1d5e6a9, nFileSizeHigh=0x0, nFileSizeLow=0x87ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="vrZdAkjZcyLf2SH4m.swf", cAlternateFileName="VRZDAK~1.SWF")) returned 1
	[0104.834] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x608aed80, ftCreationTime.dwHighDateTime=0x1d5dd74, ftLastAccessTime.dwLowDateTime=0x9f0235e0, ftLastAccessTime.dwHighDateTime=0x1d5e1da, ftLastWriteTime.dwLowDateTime=0x9f0235e0, ftLastWriteTime.dwHighDateTime=0x1d5e1da, nFileSizeHigh=0x0, nFileSizeLow=0x6107, dwReserved0=0x0, dwReserved1=0x0, cFileName="wWJpy8YigkqG2kS.mp4", cAlternateFileName="WWJPY8~1.MP4")) returned 1
	[0104.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wWJpy8YigkqG2kS.mp4", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wWJpy8YigkqG2kS.mp4", lpFilePart=0x0) returned 0x38
	[0104.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wWJpy8YigkqG2kS.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\wwjpy8yigkqg2ks.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.837] GetFileType (hFile=0x204) returned 0x1
	[0104.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.837] GetFileType (hFile=0x204) returned 0x1
	[0104.837] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0x6107
	[0104.837] ReadFile (in: hFile=0x204, lpBuffer=0x2745524, nNumberOfBytesToRead=0x6107, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x2745524*, lpNumberOfBytesRead=0x26efc4*=0x6107, lpOverlapped=0x0) returned 1
	[0104.840] CloseHandle (hObject=0x204) returned 1
	[0104.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wWJpy8YigkqG2kS.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wWJpy8YigkqG2kS.mp4.KEKW", lpFilePart=0x0) returned 0x3d
	[0104.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wWJpy8YigkqG2kS.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\wwjpy8yigkqg2ks.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.842] GetFileType (hFile=0x204) returned 0x1
	[0104.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.842] GetFileType (hFile=0x204) returned 0x1
	[0104.842] WriteFile (in: hFile=0x204, lpBuffer=0x274cd0c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x274cd0c*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.845] CloseHandle (hObject=0x204) returned 1
	[0104.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wWJpy8YigkqG2kS.mp4", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wWJpy8YigkqG2kS.mp4", lpFilePart=0x0) returned 0x38
	[0104.846] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\wWJpy8YigkqG2kS.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\wwjpy8yigkqg2ks.mp4")) returned 1
	[0104.850] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd39a5580, ftCreationTime.dwHighDateTime=0x1d5d7e4, ftLastAccessTime.dwLowDateTime=0x55e8fbb0, ftLastAccessTime.dwHighDateTime=0x1d5e4ea, ftLastWriteTime.dwLowDateTime=0x55e8fbb0, ftLastWriteTime.dwHighDateTime=0x1d5e4ea, nFileSizeHigh=0x0, nFileSizeLow=0xca0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="XJxyezyLbOpsuYa.mkv", cAlternateFileName="XJXYEZ~1.MKV")) returned 1
	[0104.852] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2294f380, ftCreationTime.dwHighDateTime=0x1d5e68a, ftLastAccessTime.dwLowDateTime=0x94f64140, ftLastAccessTime.dwHighDateTime=0x1d5db54, ftLastWriteTime.dwLowDateTime=0x94f64140, ftLastWriteTime.dwHighDateTime=0x1d5db54, nFileSizeHigh=0x0, nFileSizeLow=0xdea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="XNnfFuhF.mp4", cAlternateFileName="")) returned 1
	[0104.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XNnfFuhF.mp4", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XNnfFuhF.mp4", lpFilePart=0x0) returned 0x31
	[0104.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0104.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XNnfFuhF.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\xnnffuhf.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.853] GetFileType (hFile=0x204) returned 0x1
	[0104.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0104.853] GetFileType (hFile=0x204) returned 0x1
	[0104.853] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xdea6
	[0104.853] ReadFile (in: hFile=0x204, lpBuffer=0x274e4c4, nNumberOfBytesToRead=0xdea6, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x274e4c4*, lpNumberOfBytesRead=0x26efc4*=0xdea6, lpOverlapped=0x0) returned 1
	[0104.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XNnfFuhF.mp4.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XNnfFuhF.mp4.KEKW", lpFilePart=0x0) returned 0x36
	[0104.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0104.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XNnfFuhF.mp4.KEKW" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\xnnffuhf.mp4.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0104.860] GetFileType (hFile=0x204) returned 0x1
	[0104.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0104.861] GetFileType (hFile=0x204) returned 0x1
	[0104.861] WriteFile (in: hFile=0x204, lpBuffer=0x275da24*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x275da24*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0104.865] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XNnfFuhF.mp4", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XNnfFuhF.mp4", lpFilePart=0x0) returned 0x31
	[0104.865] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XNnfFuhF.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\xnnffuhf.mp4")) returned 1
	[0104.875] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef12d10, ftCreationTime.dwHighDateTime=0x1d5dc35, ftLastAccessTime.dwLowDateTime=0x6095c5f0, ftLastAccessTime.dwHighDateTime=0x1d5e4a6, ftLastWriteTime.dwLowDateTime=0x6095c5f0, ftLastWriteTime.dwHighDateTime=0x1d5e4a6, nFileSizeHigh=0x0, nFileSizeLow=0xd91d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zxkmfk.flv", cAlternateFileName="")) returned 1
	[0104.875] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed434f40, ftCreationTime.dwHighDateTime=0x1d5d812, ftLastAccessTime.dwLowDateTime=0xec51a340, ftLastAccessTime.dwHighDateTime=0x1d5e3fa, ftLastWriteTime.dwLowDateTime=0xec51a340, ftLastWriteTime.dwHighDateTime=0x1d5e3fa, nFileSizeHigh=0x0, nFileSizeLow=0x13a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="_2upRs39Y05.mkv", cAlternateFileName="_2UPRS~1.MKV")) returned 1
	[0104.876] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.876] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0104.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0104.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0104.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0104.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0104.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0104.878] GetFileType (hFile=0x200) returned 0x1
	[0104.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0104.878] GetFileType (hFile=0x200) returned 0x1
	[0104.878] WriteFile (in: hFile=0x200, lpBuffer=0x27606b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27606b4*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0104.885] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.885] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0104.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0104.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0104.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0104.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d
	[0104.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpFilePart=0x0) returned 0x1e
	[0104.886] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0104.887] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.887] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbf2be70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xbf2be70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0104.888] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0104.888] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbf51fd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xbf51fd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1
	[0104.889] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0104.889] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc70e750, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xc70e750, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0104.890] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda3f8b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xda3f8b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0104.890] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xda65a10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xda65a10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0104.891] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdfe6cf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xdfe6cf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0104.892] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe00ce50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xe00ce50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0104.892] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1
	[0104.893] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe6266b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xe6266b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0104.893] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1
	[0104.894] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1
	[0104.894] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8f3afd80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8f3afd80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1
	[0104.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", nBufferLength=0x105, lpBuffer=0x26eabc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT", lpFilePart=0x0) returned 0x28
	[0104.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb0) returned 1
	[0104.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0104.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dde8) returned 1
	[0104.900] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x8f389c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1
	[0104.900] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1
	[0104.901] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1
	[0104.901] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1
	[0104.902] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1
	[0104.902] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1
	[0104.903] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf3fc690, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf3fc690, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0104.905] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1
	[0104.907] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0104.907] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf448950, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf448950, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1
	[0104.908] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf494c10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf494c10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1
	[0104.908] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0104.909] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0104.909] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0104.910] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7424d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf7424d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0104.911] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7424d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf7424d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0
	[0104.911] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0104.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0104.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0104.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Decrypt.txt", lpFilePart=0x0) returned 0x29
	[0104.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0104.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0104.914] GetFileType (hFile=0x1fc) returned 0x1
	[0104.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0104.914] GetFileType (hFile=0x1fc) returned 0x1
	[0104.914] WriteFile (in: hFile=0x1fc, lpBuffer=0x2766bec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x2766bec*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0104.918] CloseHandle (hObject=0x1fc) returned 1
	[0104.918] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1
	[0104.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0104.919] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12
	[0104.919] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\", lpFilePart=0x0) returned 0x13
	[0104.919] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf7bbd130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7bbd130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0104.920] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf7bbd130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7bbd130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.920] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39d5010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39d5010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0104.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0104.921] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe", lpFilePart=0x0) returned 0x18
	[0104.921] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\", lpFilePart=0x0) returned 0x19
	[0104.922] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39d5010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39d5010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0104.923] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39d5010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39d5010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.924] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3988d50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3988d50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0104.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0104.924] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x20
	[0104.924] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x21
	[0104.925] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3988d50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3988d50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0104.925] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3988d50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3988d50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.926] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0104.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0104.926] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x25
	[0104.927] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x26
	[0104.927] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0104.927] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.928] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3962bf0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0104.930] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 1
	[0104.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0104.931] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2f
	[0104.931] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x30
	[0104.931] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0104.932] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.932] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3962bf0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0104.933] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf393ca90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf393ca90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1
	[0104.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0104.933] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x38
	[0104.934] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x39
	[0104.934] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf393ca90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf393ca90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0104.935] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf393ca90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf393ca90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.935] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf393ca90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf393ca90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0104.936] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 1
	[0104.936] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 0
	[0104.937] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0104.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0104.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0104.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0104.938] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x38
	[0104.938] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x39
	[0104.938] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf393ca90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf393ca90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0104.939] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf393ca90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf393ca90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.939] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf393ca90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf393ca90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0104.940] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0104.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0104.940] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0104.940] GetFileType (hFile=0x228) returned 0x1
	[0104.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0104.941] GetFileType (hFile=0x228) returned 0x1
	[0104.941] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0104.941] ReadFile (in: hFile=0x228, lpBuffer=0x276bf34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x276bf34*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0104.944] CloseHandle (hObject=0x228) returned 1
	[0104.945] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x49
	[0104.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0104.945] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0104.946] GetFileType (hFile=0x228) returned 0x1
	[0104.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0104.946] GetFileType (hFile=0x228) returned 0x1
	[0104.947] WriteFile (in: hFile=0x228, lpBuffer=0x276e634*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x276e634*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0104.950] CloseHandle (hObject=0x228) returned 1
	[0104.950] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0104.950] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\decrypt.txt")) returned 1
	[0104.974] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 1
	[0104.974] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.974] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0104.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0104.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0104.975] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0104.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0104.978] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0104.979] GetFileType (hFile=0x224) returned 0x1
	[0104.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0104.979] GetFileType (hFile=0x224) returned 0x1
	[0104.979] WriteFile (in: hFile=0x224, lpBuffer=0x2771198*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2771198*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0104.983] CloseHandle (hObject=0x224) returned 1
	[0104.983] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0104.983] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0104.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0104.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0104.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0104.984] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2f
	[0104.984] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x30
	[0104.984] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0104.985] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0104.986] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3962bf0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0104.986] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0104.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0104.986] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0104.987] GetFileType (hFile=0x224) returned 0x1
	[0104.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0104.988] GetFileType (hFile=0x224) returned 0x1
	[0104.988] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0104.988] ReadFile (in: hFile=0x224, lpBuffer=0x2772eb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2772eb0*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0104.991] CloseHandle (hObject=0x224) returned 1
	[0104.991] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x40
	[0104.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0104.992] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0104.993] GetFileType (hFile=0x224) returned 0x1
	[0104.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0104.993] GetFileType (hFile=0x224) returned 0x1
	[0104.993] WriteFile (in: hFile=0x224, lpBuffer=0x2775590*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2775590*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0104.996] CloseHandle (hObject=0x224) returned 1
	[0104.996] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0104.997] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\decrypt.txt")) returned 1
	[0105.000] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf84ce70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf84ce70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1
	[0105.001] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf84ce70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf84ce70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0
	[0105.001] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.002] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0105.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0105.002] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0105.003] GetFileType (hFile=0x220) returned 0x1
	[0105.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0105.003] GetFileType (hFile=0x220) returned 0x1
	[0105.003] WriteFile (in: hFile=0x220, lpBuffer=0x2777dc0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2777dc0*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.007] CloseHandle (hObject=0x220) returned 1
	[0105.007] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.008] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.008] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x25
	[0105.009] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x26
	[0105.009] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.009] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.010] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3962bf0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3962bf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3962bf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.010] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0105.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0105.011] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.011] GetFileType (hFile=0x220) returned 0x1
	[0105.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0105.011] GetFileType (hFile=0x220) returned 0x1
	[0105.011] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0105.012] ReadFile (in: hFile=0x220, lpBuffer=0x277995c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x277995c*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0105.015] CloseHandle (hObject=0x220) returned 1
	[0105.015] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x36
	[0105.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0105.015] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.016] GetFileType (hFile=0x220) returned 0x1
	[0105.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0105.017] GetFileType (hFile=0x220) returned 0x1
	[0105.017] WriteFile (in: hFile=0x220, lpBuffer=0x277c014*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x277c014*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0105.020] CloseHandle (hObject=0x220) returned 1
	[0105.021] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0105.021] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\decrypt.txt")) returned 1
	[0105.029] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf872fd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf872fd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 1
	[0105.030] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf872fd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf872fd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 0
	[0105.030] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.031] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0105.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.031] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0105.032] GetFileType (hFile=0x208) returned 0x1
	[0105.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0105.032] GetFileType (hFile=0x208) returned 0x1
	[0105.032] WriteFile (in: hFile=0x208, lpBuffer=0x277e820*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x277e820*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0105.035] CloseHandle (hObject=0x208) returned 1
	[0105.036] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3988d50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3988d50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3988d50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.036] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3988d50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3988d50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3988d50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0105.037] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0105.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0105.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0105.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0105.037] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x20
	[0105.037] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x21
	[0105.038] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3988d50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3988d50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0105.038] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf3988d50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3988d50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.039] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf8bf290, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf8bf290, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0105.039] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3988d50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3988d50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3988d50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.040] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0105.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0105.040] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0105.040] GetFileType (hFile=0x208) returned 0x1
	[0105.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0105.040] GetFileType (hFile=0x208) returned 0x1
	[0105.040] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0105.041] ReadFile (in: hFile=0x208, lpBuffer=0x2780508, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2780508*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0105.043] CloseHandle (hObject=0x208) returned 1
	[0105.044] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x31
	[0105.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0105.044] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\adobe\\acrobat\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0105.045] GetFileType (hFile=0x208) returned 0x1
	[0105.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0105.045] GetFileType (hFile=0x208) returned 0x1
	[0105.045] WriteFile (in: hFile=0x208, lpBuffer=0x2782ba8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2782ba8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0105.048] CloseHandle (hObject=0x208) returned 1
	[0105.048] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0105.049] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\decrypt.txt")) returned 1
	[0105.052] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.053] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0105.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0105.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0105.053] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0105.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.066] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\acrobat\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0105.066] GetFileType (hFile=0x204) returned 0x1
	[0105.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0105.067] GetFileType (hFile=0x204) returned 0x1
	[0105.067] WriteFile (in: hFile=0x204, lpBuffer=0x2785230*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2785230*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0105.070] CloseHandle (hObject=0x204) returned 1
	[0105.071] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1
	[0105.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0105.071] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM", lpFilePart=0x0) returned 0x1c
	[0105.071] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x1d
	[0105.072] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0105.072] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.073] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf39aeeb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39d5010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.073] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1
	[0105.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.074] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x2a
	[0105.074] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", lpFilePart=0x0) returned 0x2b
	[0105.074] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.075] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.076] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 1
	[0105.076] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 1
	[0105.077] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 1
	[0105.077] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf39aeeb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.078] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf39aeeb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0105.078] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.079] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x2a
	[0105.079] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", lpFilePart=0x0) returned 0x2b
	[0105.079] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.080] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.080] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 1
	[0105.081] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 1
	[0105.081] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 1
	[0105.082] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf39aeeb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.082] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0105.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0105.082] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.083] GetFileType (hFile=0x220) returned 0x1
	[0105.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0105.083] GetFileType (hFile=0x220) returned 0x1
	[0105.083] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0105.083] ReadFile (in: hFile=0x220, lpBuffer=0x2789110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2789110*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0105.088] CloseHandle (hObject=0x220) returned 1
	[0105.088] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3b
	[0105.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0105.088] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.089] GetFileType (hFile=0x220) returned 0x1
	[0105.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0105.089] GetFileType (hFile=0x220) returned 0x1
	[0105.090] WriteFile (in: hFile=0x220, lpBuffer=0x278b7d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x278b7d8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0105.093] CloseHandle (hObject=0x220) returned 1
	[0105.093] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0105.093] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\decrypt.txt")) returned 1
	[0105.097] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.098] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.098] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0105.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.098] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0105.099] GetFileType (hFile=0x208) returned 0x1
	[0105.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0105.099] GetFileType (hFile=0x208) returned 0x1
	[0105.100] WriteFile (in: hFile=0x208, lpBuffer=0x278de9c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x278de9c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0105.107] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.108] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0105.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0105.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0105.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0105.108] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM", lpFilePart=0x0) returned 0x1c
	[0105.108] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x1d
	[0105.109] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0105.109] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39aeeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.110] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf39aeeb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf39aeeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39d5010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.110] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0105.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0105.110] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0105.111] GetFileType (hFile=0x208) returned 0x1
	[0105.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0105.111] GetFileType (hFile=0x208) returned 0x1
	[0105.111] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0105.111] ReadFile (in: hFile=0x208, lpBuffer=0x278f8e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x278f8e4*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0105.114] CloseHandle (hObject=0x208) returned 1
	[0105.114] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x2d
	[0105.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0105.115] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\adobe\\arm\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0105.115] GetFileType (hFile=0x208) returned 0x1
	[0105.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0105.116] GetFileType (hFile=0x208) returned 0x1
	[0105.116] WriteFile (in: hFile=0x208, lpBuffer=0x2791f74*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2791f74*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0105.119] CloseHandle (hObject=0x208) returned 1
	[0105.120] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0105.120] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\decrypt.txt")) returned 1
	[0105.123] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf957810, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf957810, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1
	[0105.123] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf957810, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf957810, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 0
	[0105.124] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0105.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0105.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0105.124] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0105.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.125] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\arm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0105.125] GetFileType (hFile=0x204) returned 0x1
	[0105.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0105.125] GetFileType (hFile=0x204) returned 0x1
	[0105.126] WriteFile (in: hFile=0x204, lpBuffer=0x2794758*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2794758*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0105.128] CloseHandle (hObject=0x204) returned 1
	[0105.129] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf39d5010, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf39d5010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39d5010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.129] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf39d5010, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf39d5010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39d5010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0105.130] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0105.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0105.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0105.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0105.130] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe", lpFilePart=0x0) returned 0x18
	[0105.130] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\", lpFilePart=0x0) returned 0x19
	[0105.131] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39d5010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39d5010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0105.134] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf39d5010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39d5010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.134] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf90b550, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf90b550, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0105.135] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf9a3ad0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf9a3ad0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1
	[0105.135] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf39d5010, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf39d5010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf39d5010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.136] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0105.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0105.136] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0105.136] GetFileType (hFile=0x204) returned 0x1
	[0105.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0105.136] GetFileType (hFile=0x204) returned 0x1
	[0105.137] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xa5
	[0105.137] ReadFile (in: hFile=0x204, lpBuffer=0x279639c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x279639c*, lpNumberOfBytesRead=0x26efc4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.140] CloseHandle (hObject=0x204) returned 1
	[0105.140] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x29
	[0105.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0105.140] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\adobe\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0105.141] GetFileType (hFile=0x204) returned 0x1
	[0105.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0105.141] GetFileType (hFile=0x204) returned 0x1
	[0105.141] WriteFile (in: hFile=0x204, lpBuffer=0x2798a1c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2798a1c*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0105.144] CloseHandle (hObject=0x204) returned 1
	[0105.145] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0105.145] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\decrypt.txt")) returned 1
	[0105.148] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.148] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0105.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0105.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0105.149] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0105.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.149] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Decrypt.txt" (normalized: "c:\\users\\all users\\adobe\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0105.150] GetFileType (hFile=0x200) returned 0x1
	[0105.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0105.150] GetFileType (hFile=0x200) returned 0x1
	[0105.150] WriteFile (in: hFile=0x200, lpBuffer=0x279b074*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x279b074*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.153] CloseHandle (hObject=0x200) returned 1
	[0105.153] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0105.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0105.154] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data", lpFilePart=0x0) returned 0x23
	[0105.154] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\", lpFilePart=0x0) returned 0x24
	[0105.154] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0105.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0105.158] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7bbd130, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7bbd130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7bbd130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.159] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0105.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0105.160] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop", lpFilePart=0x0) returned 0x1a
	[0105.160] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop\\", lpFilePart=0x0) returned 0x1b
	[0105.160] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0105.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0105.164] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0105.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0105.165] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents", lpFilePart=0x0) returned 0x1c
	[0105.165] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents\\", lpFilePart=0x0) returned 0x1d
	[0105.165] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0105.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0105.169] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0105.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0105.169] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites", lpFilePart=0x0) returned 0x1c
	[0105.169] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites\\", lpFilePart=0x0) returned 0x1d
	[0105.169] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Favorites\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0105.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0105.174] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6d9ae90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d9ae90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0105.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0105.174] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c
	[0105.174] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\", lpFilePart=0x0) returned 0x1d
	[0105.175] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6d9ae90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d9ae90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0105.175] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6d9ae90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d9ae90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.176] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3ab9850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ab9850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1
	[0105.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0105.176] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x27
	[0105.176] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x28
	[0105.177] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3ab9850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ab9850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0105.177] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3ab9850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ab9850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.179] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a936f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a936f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1
	[0105.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.180] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2e
	[0105.180] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2f
	[0105.180] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a936f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a936f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.181] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a936f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a936f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.181] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1
	[0105.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.182] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x32
	[0105.182] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x33
	[0105.182] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.183] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.183] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3a6d590, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a936f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.184] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0105.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.184] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x38
	[0105.185] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x39
	[0105.185] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0105.185] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.186] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3a6d590, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.187] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 1
	[0105.187] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 1
	[0105.188] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 1
	[0105.188] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 1
	[0105.189] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 1
	[0105.189] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 1
	[0105.190] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 1
	[0105.190] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 0
	[0105.191] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0105.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0105.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0105.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.191] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x38
	[0105.192] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x39
	[0105.192] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0105.193] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.193] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3a6d590, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.195] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0105.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0105.195] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0105.195] GetFileType (hFile=0x228) returned 0x1
	[0105.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0105.196] GetFileType (hFile=0x228) returned 0x1
	[0105.196] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0105.196] ReadFile (in: hFile=0x228, lpBuffer=0x27a2e8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x27a2e8c*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0105.198] CloseHandle (hObject=0x228) returned 1
	[0105.199] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x49
	[0105.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0105.199] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0105.200] GetFileType (hFile=0x228) returned 0x1
	[0105.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0105.200] GetFileType (hFile=0x228) returned 0x1
	[0105.201] WriteFile (in: hFile=0x228, lpBuffer=0x27a558c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x27a558c*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0105.203] CloseHandle (hObject=0x228) returned 1
	[0105.204] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0105.204] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\decrypt.txt")) returned 1
	[0105.207] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 1
	[0105.207] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 1
	[0105.208] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 1
	[0105.208] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 1
	[0105.209] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 1
	[0105.209] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 1
	[0105.210] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 1
	[0105.210] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.211] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0105.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0105.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0105.211] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0105.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0105.211] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0105.212] GetFileType (hFile=0x224) returned 0x1
	[0105.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0105.212] GetFileType (hFile=0x224) returned 0x1
	[0105.213] WriteFile (in: hFile=0x224, lpBuffer=0x27a9b78*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27a9b78*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0105.216] CloseHandle (hObject=0x224) returned 1
	[0105.216] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.217] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.217] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x32
	[0105.217] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x33
	[0105.217] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.218] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a6d590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.219] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3a6d590, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3a6d590, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a936f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.219] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0105.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.219] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.219] GetFileType (hFile=0x224) returned 0x1
	[0105.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.220] GetFileType (hFile=0x224) returned 0x1
	[0105.220] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0105.220] ReadFile (in: hFile=0x224, lpBuffer=0x27ab914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27ab914*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.223] CloseHandle (hObject=0x224) returned 1
	[0105.223] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x43
	[0105.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.223] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.224] GetFileType (hFile=0x224) returned 0x1
	[0105.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0105.224] GetFileType (hFile=0x224) returned 0x1
	[0105.225] WriteFile (in: hFile=0x224, lpBuffer=0x27adffc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27adffc*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0105.229] CloseHandle (hObject=0x224) returned 1
	[0105.230] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0105.230] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\decrypt.txt")) returned 1
	[0105.233] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfa88310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfa88310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0105.234] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xfa88310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfa88310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0105.234] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.234] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0105.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0105.235] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0105.235] GetFileType (hFile=0x220) returned 0x1
	[0105.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0105.235] GetFileType (hFile=0x220) returned 0x1
	[0105.236] WriteFile (in: hFile=0x220, lpBuffer=0x27b0834*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27b0834*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.239] CloseHandle (hObject=0x220) returned 1
	[0105.239] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3a936f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3a936f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a936f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.240] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3a936f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3a936f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a936f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0105.240] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2e
	[0105.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2f
	[0105.241] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a936f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a936f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.241] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3a936f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a936f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.242] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xfaae470, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfaae470, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1
	[0105.243] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3a936f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3a936f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3a936f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.243] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0105.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0105.243] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.243] GetFileType (hFile=0x220) returned 0x1
	[0105.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0105.244] GetFileType (hFile=0x220) returned 0x1
	[0105.244] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0105.244] ReadFile (in: hFile=0x220, lpBuffer=0x27b279c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27b279c*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0105.247] CloseHandle (hObject=0x220) returned 1
	[0105.247] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3f
	[0105.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0105.247] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.248] GetFileType (hFile=0x220) returned 0x1
	[0105.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0105.248] GetFileType (hFile=0x220) returned 0x1
	[0105.249] WriteFile (in: hFile=0x220, lpBuffer=0x27b4e74*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27b4e74*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0105.251] CloseHandle (hObject=0x220) returned 1
	[0105.252] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0105.252] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\decrypt.txt")) returned 1
	[0105.255] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.255] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.256] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0105.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.258] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0105.259] GetFileType (hFile=0x208) returned 0x1
	[0105.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0105.259] GetFileType (hFile=0x208) returned 0x1
	[0105.259] WriteFile (in: hFile=0x208, lpBuffer=0x27b7550*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27b7550*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0105.262] CloseHandle (hObject=0x208) returned 1
	[0105.262] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3ab9850, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3ab9850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ab9850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.263] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3ab9850, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3ab9850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ab9850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0105.263] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0105.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0105.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0105.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0105.264] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x27
	[0105.264] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x28
	[0105.264] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3ab9850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ab9850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0105.265] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xf3ab9850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ab9850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.265] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xfafa730, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfafa730, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1
	[0105.266] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3ab9850, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3ab9850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ab9850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.266] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0105.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0105.266] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0105.267] GetFileType (hFile=0x208) returned 0x1
	[0105.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0105.267] GetFileType (hFile=0x208) returned 0x1
	[0105.267] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0105.267] ReadFile (in: hFile=0x208, lpBuffer=0x27b9374, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27b9374*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0105.270] CloseHandle (hObject=0x208) returned 1
	[0105.270] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x38
	[0105.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0105.271] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\assistance\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0105.271] GetFileType (hFile=0x208) returned 0x1
	[0105.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0105.272] GetFileType (hFile=0x208) returned 0x1
	[0105.278] WriteFile (in: hFile=0x208, lpBuffer=0x27bba34*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27bba34*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0105.281] CloseHandle (hObject=0x208) returned 1
	[0105.281] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0105.281] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\decrypt.txt")) returned 1
	[0105.284] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.285] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0105.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0105.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0105.285] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0105.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.286] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\assistance\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0105.286] GetFileType (hFile=0x204) returned 0x1
	[0105.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0105.287] GetFileType (hFile=0x204) returned 0x1
	[0105.287] WriteFile (in: hFile=0x204, lpBuffer=0x27be0e0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27be0e0*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0105.290] CloseHandle (hObject=0x204) returned 1
	[0105.291] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0105.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0105.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23
	[0105.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x24
	[0105.291] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0105.292] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.293] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3b77f30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b9e090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.293] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1
	[0105.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.294] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x27
	[0105.294] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x28
	[0105.294] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.295] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.295] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3adf9b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b05b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.296] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0105.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.296] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33
	[0105.296] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x34
	[0105.297] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.297] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.298] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3adf9b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.298] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3adf9b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0105.299] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.299] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33
	[0105.299] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x34
	[0105.300] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.300] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.301] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3adf9b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.301] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0105.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.302] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.302] GetFileType (hFile=0x224) returned 0x1
	[0105.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.302] GetFileType (hFile=0x224) returned 0x1
	[0105.302] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0105.302] ReadFile (in: hFile=0x224, lpBuffer=0x27c1b94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27c1b94*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.306] CloseHandle (hObject=0x224) returned 1
	[0105.306] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x44
	[0105.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.306] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.307] GetFileType (hFile=0x224) returned 0x1
	[0105.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0105.307] GetFileType (hFile=0x224) returned 0x1
	[0105.308] WriteFile (in: hFile=0x224, lpBuffer=0x27c4284*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27c4284*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0105.311] CloseHandle (hObject=0x224) returned 1
	[0105.311] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0105.311] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\decrypt.txt")) returned 1
	[0105.314] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.315] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.315] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0105.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0105.315] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0105.316] GetFileType (hFile=0x220) returned 0x1
	[0105.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0105.316] GetFileType (hFile=0x220) returned 0x1
	[0105.317] WriteFile (in: hFile=0x220, lpBuffer=0x27c6978*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27c6978*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.324] CloseHandle (hObject=0x220) returned 1
	[0105.325] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.325] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.326] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x27
	[0105.326] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x28
	[0105.326] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.326] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3adf9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.327] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3adf9b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3adf9b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b05b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.327] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0105.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0105.327] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.328] GetFileType (hFile=0x220) returned 0x1
	[0105.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0105.328] GetFileType (hFile=0x220) returned 0x1
	[0105.328] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0105.328] ReadFile (in: hFile=0x220, lpBuffer=0x27c8550, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27c8550*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0105.331] CloseHandle (hObject=0x220) returned 1
	[0105.331] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x38
	[0105.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0105.331] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.332] GetFileType (hFile=0x220) returned 0x1
	[0105.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0105.332] GetFileType (hFile=0x220) returned 0x1
	[0105.333] WriteFile (in: hFile=0x220, lpBuffer=0x27cac10*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27cac10*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0105.339] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0105.339] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\decrypt.txt")) returned 1
	[0105.342] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfb6cb50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfb6cb50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0105.343] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfb6cb50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfb6cb50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0
	[0105.343] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.343] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0105.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.344] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0105.344] GetFileType (hFile=0x208) returned 0x1
	[0105.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0105.345] GetFileType (hFile=0x208) returned 0x1
	[0105.345] WriteFile (in: hFile=0x208, lpBuffer=0x27cd440*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27cd440*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0105.348] CloseHandle (hObject=0x208) returned 1
	[0105.348] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b05b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b05b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1
	[0105.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.348] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x28
	[0105.349] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x29
	[0105.349] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b05b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b05b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.362] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b05b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b05b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.363] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b05b10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b05b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b05b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.363] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b05b10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b05b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b05b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0105.364] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.364] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x28
	[0105.364] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x29
	[0105.364] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b05b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b05b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.366] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b05b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b05b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.366] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b05b10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b05b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b05b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.367] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0105.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0105.367] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.367] GetFileType (hFile=0x220) returned 0x1
	[0105.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0105.367] GetFileType (hFile=0x220) returned 0x1
	[0105.368] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0105.368] ReadFile (in: hFile=0x220, lpBuffer=0x27cf9e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27cf9e4*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0105.371] CloseHandle (hObject=0x220) returned 1
	[0105.371] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x39
	[0105.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0105.371] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.372] GetFileType (hFile=0x220) returned 0x1
	[0105.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0105.373] GetFileType (hFile=0x220) returned 0x1
	[0105.373] WriteFile (in: hFile=0x220, lpBuffer=0x27d20a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27d20a4*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0105.376] CloseHandle (hObject=0x220) returned 1
	[0105.376] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0105.376] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\decrypt.txt")) returned 1
	[0105.380] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.380] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.380] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0105.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.381] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0105.384] GetFileType (hFile=0x208) returned 0x1
	[0105.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0105.384] GetFileType (hFile=0x208) returned 0x1
	[0105.384] WriteFile (in: hFile=0x208, lpBuffer=0x27d475c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27d475c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0105.387] CloseHandle (hObject=0x208) returned 1
	[0105.388] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0105.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.388] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x27
	[0105.388] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x28
	[0105.388] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.389] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.390] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3b77f30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.390] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b2bc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b2bc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0105.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.391] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x33
	[0105.391] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x34
	[0105.391] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b2bc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b2bc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.392] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b2bc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b2bc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.392] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b2bc70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b2bc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b2bc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.393] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b2bc70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b2bc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b2bc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0105.393] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.394] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x33
	[0105.394] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x34
	[0105.394] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b2bc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b2bc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.395] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b2bc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b2bc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.395] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b2bc70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b2bc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b2bc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.396] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0105.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.396] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.397] GetFileType (hFile=0x224) returned 0x1
	[0105.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.397] GetFileType (hFile=0x224) returned 0x1
	[0105.397] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0105.397] ReadFile (in: hFile=0x224, lpBuffer=0x27d7958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27d7958*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.400] CloseHandle (hObject=0x224) returned 1
	[0105.400] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x44
	[0105.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.401] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.401] GetFileType (hFile=0x224) returned 0x1
	[0105.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0105.402] GetFileType (hFile=0x224) returned 0x1
	[0105.402] WriteFile (in: hFile=0x224, lpBuffer=0x27da048*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27da048*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0105.405] CloseHandle (hObject=0x224) returned 1
	[0105.405] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0105.405] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\decrypt.txt")) returned 1
	[0105.408] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.409] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.409] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0105.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0105.409] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0105.410] GetFileType (hFile=0x220) returned 0x1
	[0105.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0105.410] GetFileType (hFile=0x220) returned 0x1
	[0105.410] WriteFile (in: hFile=0x220, lpBuffer=0x27dc73c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27dc73c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.414] CloseHandle (hObject=0x220) returned 1
	[0105.414] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf3b51dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b51dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0105.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.414] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x30
	[0105.415] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x31
	[0105.415] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf3b51dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b51dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.416] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf3b51dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b51dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.416] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1
	[0105.417] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 1
	[0105.417] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3b51dd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b51dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b51dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.418] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3b51dd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b51dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b51dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0105.418] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.419] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x30
	[0105.419] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x31
	[0105.419] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf3b51dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b51dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.420] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf3b51dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b51dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.436] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1
	[0105.436] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 1
	[0105.437] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3b51dd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b51dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b51dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.437] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0105.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.437] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.438] GetFileType (hFile=0x224) returned 0x1
	[0105.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.438] GetFileType (hFile=0x224) returned 0x1
	[0105.438] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0105.438] ReadFile (in: hFile=0x224, lpBuffer=0x25e0940, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x25e0940*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.441] CloseHandle (hObject=0x224) returned 1
	[0105.441] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x41
	[0105.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.442] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.443] GetFileType (hFile=0x224) returned 0x1
	[0105.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0105.443] GetFileType (hFile=0x224) returned 0x1
	[0105.445] WriteFile (in: hFile=0x224, lpBuffer=0x25e309c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x25e309c*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0105.448] CloseHandle (hObject=0x224) returned 1
	[0105.448] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0105.448] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\decrypt.txt")) returned 1
	[0105.451] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.452] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.452] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0105.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0105.452] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0105.484] GetFileType (hFile=0x220) returned 0x1
	[0105.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0105.485] GetFileType (hFile=0x220) returned 0x1
	[0105.485] WriteFile (in: hFile=0x220, lpBuffer=0x25e5784*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25e5784*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.489] CloseHandle (hObject=0x220) returned 1
	[0105.489] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.489] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.495] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x27
	[0105.495] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x28
	[0105.495] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.496] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.497] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3b77f30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.497] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0105.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0105.498] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.498] GetFileType (hFile=0x220) returned 0x1
	[0105.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0105.498] GetFileType (hFile=0x220) returned 0x1
	[0105.498] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0105.498] ReadFile (in: hFile=0x220, lpBuffer=0x25e735c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x25e735c*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0105.501] CloseHandle (hObject=0x220) returned 1
	[0105.501] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x38
	[0105.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0105.502] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.503] GetFileType (hFile=0x220) returned 0x1
	[0105.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0105.503] GetFileType (hFile=0x220) returned 0x1
	[0105.503] WriteFile (in: hFile=0x220, lpBuffer=0x25e9a1c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x25e9a1c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0105.510] CloseHandle (hObject=0x220) returned 1
	[0105.510] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0105.510] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\decrypt.txt")) returned 1
	[0105.513] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc51390, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfc51390, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1
	[0105.514] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfcc37b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfcc37b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0105.515] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfcc37b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfcc37b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0
	[0105.515] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.516] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0105.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.516] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0105.517] GetFileType (hFile=0x208) returned 0x1
	[0105.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0105.517] GetFileType (hFile=0x208) returned 0x1
	[0105.517] WriteFile (in: hFile=0x208, lpBuffer=0x25ec33c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x25ec33c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0105.521] CloseHandle (hObject=0x208) returned 1
	[0105.521] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.521] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0105.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0105.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0105.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0105.522] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23
	[0105.522] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x24
	[0105.523] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0105.523] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b77f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.524] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3b77f30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3b77f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3b9e090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.524] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0105.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0105.525] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0105.525] GetFileType (hFile=0x208) returned 0x1
	[0105.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0105.525] GetFileType (hFile=0x208) returned 0x1
	[0105.525] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0105.525] ReadFile (in: hFile=0x208, lpBuffer=0x25ede7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x25ede7c*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0105.528] CloseHandle (hObject=0x208) returned 1
	[0105.528] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x34
	[0105.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0105.529] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\crypto\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0105.530] GetFileType (hFile=0x208) returned 0x1
	[0105.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0105.530] GetFileType (hFile=0x208) returned 0x1
	[0105.530] WriteFile (in: hFile=0x208, lpBuffer=0x25f052c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25f052c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0105.533] CloseHandle (hObject=0x208) returned 1
	[0105.534] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0105.534] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\decrypt.txt")) returned 1
	[0105.584] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfbb8e10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfbb8e10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1
	[0105.585] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc2b230, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfc2b230, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1
	[0105.585] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd5bd30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfd5bd30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0105.586] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd5bd30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfd5bd30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0
	[0105.586] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0105.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0105.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0105.587] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0105.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.587] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0105.588] GetFileType (hFile=0x204) returned 0x1
	[0105.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0105.588] GetFileType (hFile=0x204) returned 0x1
	[0105.588] WriteFile (in: hFile=0x204, lpBuffer=0x25f2e80*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x25f2e80*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0105.591] CloseHandle (hObject=0x204) returned 1
	[0105.592] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6d9ae90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6d9ae90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6de7150, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.592] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ee3ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ee3ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1
	[0105.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0105.593] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x29
	[0105.593] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x2a
	[0105.593] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ee3ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ee3ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0105.594] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ee3ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ee3ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.594] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3ee3ed0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3ee3ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f0a030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.595] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3dd9530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dd9530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1
	[0105.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.595] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x30
	[0105.595] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x31
	[0105.595] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3dd9530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dd9530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.596] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3dd9530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dd9530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.596] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3dd9530, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3dd9530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dd9530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.597] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3d1ae50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d1ae50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1
	[0105.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.598] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x57
	[0105.598] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x58
	[0105.598] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3d1ae50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d1ae50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.599] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3d1ae50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d1ae50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.600] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0105.600] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bea350, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3bea350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3c104b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png.KEKW", cAlternateFileName="BACKGR~1.KEK")) returned 1
	[0105.601] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0105.602] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d1ae50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3d1ae50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d40fb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.602] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1
	[0105.603] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c36610, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3c36610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3c36610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png.KEKW", cAlternateFileName="DEVICE~1.KEK")) returned 1
	[0105.603] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1
	[0105.604] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ca8a30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3ca8a30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3cceb90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png.KEKW", cAlternateFileName="OVERLA~1.KEK")) returned 1
	[0105.604] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1
	[0105.605] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf4cf0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3cf4cf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d1ae50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png.KEKW", cAlternateFileName="SUPERB~1.KEK")) returned 1
	[0105.605] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf4cf0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3cf4cf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d1ae50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png.KEKW", cAlternateFileName="SUPERB~1.KEK")) returned 0
	[0105.606] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.606] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x57
	[0105.607] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x58
	[0105.607] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3d1ae50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d1ae50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.607] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3d1ae50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d1ae50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.608] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0105.608] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x66
	[0105.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.608] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.609] GetFileType (hFile=0x224) returned 0x1
	[0105.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.609] GetFileType (hFile=0x224) returned 0x1
	[0105.609] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x1fad1
	[0105.610] ReadFile (in: hFile=0x224, lpBuffer=0x37b5310, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x37b5310*, lpNumberOfBytesRead=0x26ede4*=0x1fad1, lpOverlapped=0x0) returned 1
	[0105.619] CloseHandle (hObject=0x224) returned 1
	[0105.620] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.KEKW", lpFilePart=0x0) returned 0x6b
	[0105.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.620] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0105.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dba0) returned 1
	[0105.629] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bea350, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3bea350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3c104b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png.KEKW", cAlternateFileName="BACKGR~1.KEK")) returned 1
	[0105.629] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0105.630] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d1ae50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3d1ae50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d40fb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.630] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0105.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.631] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.631] GetFileType (hFile=0x224) returned 0x1
	[0105.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.631] GetFileType (hFile=0x224) returned 0x1
	[0105.632] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0105.632] ReadFile (in: hFile=0x224, lpBuffer=0x25fa138, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x25fa138*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.635] CloseHandle (hObject=0x224) returned 1
	[0105.635] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x68
	[0105.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.635] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.636] GetFileType (hFile=0x224) returned 0x1
	[0105.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0105.637] GetFileType (hFile=0x224) returned 0x1
	[0105.637] WriteFile (in: hFile=0x224, lpBuffer=0x25fc8b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x25fc8b8*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0105.640] CloseHandle (hObject=0x224) returned 1
	[0105.640] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0105.641] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\decrypt.txt")) returned 1
	[0105.647] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1
	[0105.647] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFilePart=0x0) returned 0x62
	[0105.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.647] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.648] GetFileType (hFile=0x224) returned 0x1
	[0105.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.648] GetFileType (hFile=0x224) returned 0x1
	[0105.648] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xadc8
	[0105.648] ReadFile (in: hFile=0x224, lpBuffer=0x25fdfb4, nNumberOfBytesToRead=0xadc8, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x25fdfb4*, lpNumberOfBytesRead=0x26ede4*=0xadc8, lpOverlapped=0x0) returned 1
	[0105.652] CloseHandle (hObject=0x224) returned 1
	[0105.652] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.KEKW", lpFilePart=0x0) returned 0x67
	[0105.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.653] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0105.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dba0) returned 1
	[0105.656] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c36610, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3c36610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3c36610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png.KEKW", cAlternateFileName="DEVICE~1.KEK")) returned 1
	[0105.656] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1
	[0105.657] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFilePart=0x0) returned 0x63
	[0105.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.657] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.657] GetFileType (hFile=0x224) returned 0x1
	[0105.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.658] GetFileType (hFile=0x224) returned 0x1
	[0105.658] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x70c1
	[0105.658] ReadFile (in: hFile=0x224, lpBuffer=0x2609f94, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2609f94*, lpNumberOfBytesRead=0x26ede4*=0x70c1, lpOverlapped=0x0) returned 1
	[0105.663] CloseHandle (hObject=0x224) returned 1
	[0105.663] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.KEKW", lpFilePart=0x0) returned 0x68
	[0105.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.663] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0105.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dba0) returned 1
	[0105.667] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ca8a30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3ca8a30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3cceb90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png.KEKW", cAlternateFileName="OVERLA~1.KEK")) returned 1
	[0105.667] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1
	[0105.668] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFilePart=0x0) returned 0x64
	[0105.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.668] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.668] GetFileType (hFile=0x224) returned 0x1
	[0105.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.668] GetFileType (hFile=0x224) returned 0x1
	[0105.669] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x99d3
	[0105.669] ReadFile (in: hFile=0x224, lpBuffer=0x26122a8, nNumberOfBytesToRead=0x99d3, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26122a8*, lpNumberOfBytesRead=0x26ede4*=0x99d3, lpOverlapped=0x0) returned 1
	[0105.672] CloseHandle (hObject=0x224) returned 1
	[0105.672] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.KEKW", lpFilePart=0x0) returned 0x69
	[0105.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.673] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0105.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dba0) returned 1
	[0105.677] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf4cf0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3cf4cf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d1ae50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png.KEKW", cAlternateFileName="SUPERB~1.KEK")) returned 1
	[0105.677] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.677] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.678] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0105.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0105.678] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0105.679] GetFileType (hFile=0x220) returned 0x1
	[0105.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0105.679] GetFileType (hFile=0x220) returned 0x1
	[0105.680] WriteFile (in: hFile=0x220, lpBuffer=0x261df88*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x261df88*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.683] CloseHandle (hObject=0x220) returned 1
	[0105.683] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3db33d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3db33d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1
	[0105.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.684] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x57
	[0105.684] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x58
	[0105.684] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3db33d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3db33d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.685] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3db33d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3db33d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.686] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0105.686] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d67110, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3d67110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d67110, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png.KEKW", cAlternateFileName="BACKGR~1.KEK")) returned 1
	[0105.687] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0105.687] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3db33d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3db33d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3db33d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.688] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1
	[0105.688] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d8d270, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3d8d270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3db33d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png.KEKW", cAlternateFileName="WATERM~1.KEK")) returned 1
	[0105.689] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d8d270, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3d8d270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3db33d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png.KEKW", cAlternateFileName="WATERM~1.KEK")) returned 0
	[0105.689] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.690] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x57
	[0105.690] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x58
	[0105.690] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3db33d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3db33d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.691] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3db33d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3db33d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.692] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0105.692] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x66
	[0105.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.692] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.693] GetFileType (hFile=0x224) returned 0x1
	[0105.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.693] GetFileType (hFile=0x224) returned 0x1
	[0105.693] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x1fad1
	[0105.696] ReadFile (in: hFile=0x224, lpBuffer=0x37d4e00, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x37d4e00*, lpNumberOfBytesRead=0x26ede4*=0x1fad1, lpOverlapped=0x0) returned 1
	[0105.704] CloseHandle (hObject=0x224) returned 1
	[0105.705] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.KEKW", lpFilePart=0x0) returned 0x6b
	[0105.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.705] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0105.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dba0) returned 1
	[0105.709] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d67110, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3d67110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3d67110, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png.KEKW", cAlternateFileName="BACKGR~1.KEK")) returned 1
	[0105.709] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1
	[0105.710] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3db33d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3db33d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3db33d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.710] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0105.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.710] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.711] GetFileType (hFile=0x224) returned 0x1
	[0105.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.711] GetFileType (hFile=0x224) returned 0x1
	[0105.711] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0105.711] ReadFile (in: hFile=0x224, lpBuffer=0x2623494, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2623494*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.714] CloseHandle (hObject=0x224) returned 1
	[0105.714] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x68
	[0105.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.715] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.716] GetFileType (hFile=0x224) returned 0x1
	[0105.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0105.716] GetFileType (hFile=0x224) returned 0x1
	[0105.716] WriteFile (in: hFile=0x224, lpBuffer=0x2625c14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2625c14*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0105.719] CloseHandle (hObject=0x224) returned 1
	[0105.719] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0105.719] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\decrypt.txt")) returned 1
	[0105.722] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1
	[0105.723] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFilePart=0x0) returned 0x65
	[0105.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.723] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.723] GetFileType (hFile=0x224) returned 0x1
	[0105.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.724] GetFileType (hFile=0x224) returned 0x1
	[0105.725] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x70c1
	[0105.725] ReadFile (in: hFile=0x224, lpBuffer=0x2627334, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2627334*, lpNumberOfBytesRead=0x26ede4*=0x70c1, lpOverlapped=0x0) returned 1
	[0105.728] CloseHandle (hObject=0x224) returned 1
	[0105.728] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.KEKW", lpFilePart=0x0) returned 0x6a
	[0105.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.729] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0105.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dba0) returned 1
	[0105.732] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d8d270, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3d8d270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3db33d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png.KEKW", cAlternateFileName="WATERM~1.KEK")) returned 1
	[0105.733] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.733] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.734] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0105.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0105.734] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0105.735] GetFileType (hFile=0x220) returned 0x1
	[0105.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0105.735] GetFileType (hFile=0x220) returned 0x1
	[0105.735] WriteFile (in: hFile=0x220, lpBuffer=0x2630720*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2630720*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.738] CloseHandle (hObject=0x220) returned 1
	[0105.739] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.739] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.745] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x30
	[0105.745] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x31
	[0105.746] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3dd9530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dd9530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.746] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3dd9530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dd9530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.747] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3dd9530, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3dd9530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dd9530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.748] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0105.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0105.749] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.749] GetFileType (hFile=0x220) returned 0x1
	[0105.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0105.749] GetFileType (hFile=0x220) returned 0x1
	[0105.750] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0105.750] ReadFile (in: hFile=0x220, lpBuffer=0x2632460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2632460*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0105.752] CloseHandle (hObject=0x220) returned 1
	[0105.753] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x41
	[0105.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0105.753] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0105.762] GetFileType (hFile=0x220) returned 0x1
	[0105.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0105.762] GetFileType (hFile=0x220) returned 0x1
	[0105.763] WriteFile (in: hFile=0x220, lpBuffer=0x2634b40*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2634b40*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0105.765] CloseHandle (hObject=0x220) returned 1
	[0105.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0105.766] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\decrypt.txt")) returned 1
	[0105.770] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfefec50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfefec50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1
	[0105.773] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff71070, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xff71070, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1
	[0105.773] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff71070, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xff71070, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0
	[0105.774] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0105.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0105.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0105.774] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0105.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.775] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0105.775] GetFileType (hFile=0x208) returned 0x1
	[0105.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0105.775] GetFileType (hFile=0x208) returned 0x1
	[0105.776] WriteFile (in: hFile=0x208, lpBuffer=0x26376b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26376b4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0105.779] CloseHandle (hObject=0x208) returned 1
	[0105.779] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1
	[0105.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0105.780] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2e
	[0105.780] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2f
	[0105.780] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0105.780] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.781] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3ebdd70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ee3ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.781] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3e257f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e257f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1
	[0105.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.782] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x55
	[0105.782] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x56
	[0105.782] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3e257f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e257f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.783] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3e257f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e257f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.783] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e257f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3e257f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e4b950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.784] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3dff690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dff690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0105.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.784] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpFilePart=0x0) returned 0x5b
	[0105.785] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", lpFilePart=0x0) returned 0x5c
	[0105.785] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3dff690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dff690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0105.785] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3dff690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dff690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.786] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3dff690, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3dff690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e257f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.788] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0105.789] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0
	[0105.789] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0105.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0105.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0105.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.790] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US", lpFilePart=0x0) returned 0x5b
	[0105.790] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\", lpFilePart=0x0) returned 0x5c
	[0105.790] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3dff690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dff690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0105.791] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3dff690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3dff690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.791] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3dff690, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3dff690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e257f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.792] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0105.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0105.792] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0105.792] GetFileType (hFile=0x228) returned 0x1
	[0105.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0105.793] GetFileType (hFile=0x228) returned 0x1
	[0105.793] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0105.793] ReadFile (in: hFile=0x228, lpBuffer=0x263c684, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x263c684*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0105.796] CloseHandle (hObject=0x228) returned 1
	[0105.796] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6c
	[0105.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0105.796] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0105.797] GetFileType (hFile=0x228) returned 0x1
	[0105.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0105.797] GetFileType (hFile=0x228) returned 0x1
	[0105.797] WriteFile (in: hFile=0x228, lpBuffer=0x263ee14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x263ee14*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0105.800] CloseHandle (hObject=0x228) returned 1
	[0105.801] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0105.801] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\decrypt.txt")) returned 1
	[0105.804] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0105.805] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.805] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0105.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0105.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0105.805] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0105.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0105.806] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0105.806] GetFileType (hFile=0x224) returned 0x1
	[0105.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0105.807] GetFileType (hFile=0x224) returned 0x1
	[0105.807] WriteFile (in: hFile=0x224, lpBuffer=0x2641b00*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2641b00*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0105.810] CloseHandle (hObject=0x224) returned 1
	[0105.810] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0105.811] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1
	[0105.811] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1
	[0105.812] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0105.812] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1
	[0105.813] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1
	[0105.813] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1
	[0105.814] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0105.814] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1
	[0105.815] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0
	[0105.815] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.816] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x55
	[0105.816] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x56
	[0105.816] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3e257f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e257f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.817] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3e257f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e257f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.818] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e257f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3e257f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e4b950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.818] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0105.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0105.819] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.819] GetFileType (hFile=0x224) returned 0x1
	[0105.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0105.819] GetFileType (hFile=0x224) returned 0x1
	[0105.819] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0105.819] ReadFile (in: hFile=0x224, lpBuffer=0x2644e60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2644e60*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.822] CloseHandle (hObject=0x224) returned 1
	[0105.823] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x66
	[0105.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0105.823] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0105.824] GetFileType (hFile=0x224) returned 0x1
	[0105.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0105.824] GetFileType (hFile=0x224) returned 0x1
	[0105.824] WriteFile (in: hFile=0x224, lpBuffer=0x26475d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26475d8*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0105.827] CloseHandle (hObject=0x224) returned 1
	[0105.827] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0105.827] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\decrypt.txt")) returned 1
	[0105.831] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1002f750, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1002f750, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0105.831] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0105.832] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1
	[0105.832] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1
	[0105.832] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0105.833] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1
	[0105.834] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1
	[0105.835] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1
	[0105.835] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0105.835] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1
	[0105.836] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.836] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.837] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0105.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0105.837] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0105.838] GetFileType (hFile=0x220) returned 0x1
	[0105.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0105.838] GetFileType (hFile=0x220) returned 0x1
	[0105.838] WriteFile (in: hFile=0x220, lpBuffer=0x264c9ac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x264c9ac*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0105.841] CloseHandle (hObject=0x220) returned 1
	[0105.842] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1
	[0105.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x55
	[0105.843] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x56
	[0105.843] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.844] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.844] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ebdd70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.845] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3e97c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e97c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0105.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.845] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpFilePart=0x0) returned 0x5b
	[0105.845] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", lpFilePart=0x0) returned 0x5c
	[0105.846] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3e97c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e97c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0105.846] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3e97c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e97c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.847] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e97c10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3e97c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e97c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.847] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0105.848] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0
	[0105.848] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0105.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0105.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0105.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0105.850] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US", lpFilePart=0x0) returned 0x5b
	[0105.850] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\", lpFilePart=0x0) returned 0x5c
	[0105.850] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3e97c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e97c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0105.851] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf3e97c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e97c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.852] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e97c10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3e97c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3e97c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0105.852] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0105.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0105.852] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0105.852] GetFileType (hFile=0x228) returned 0x1
	[0105.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0105.853] GetFileType (hFile=0x228) returned 0x1
	[0105.853] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0105.853] ReadFile (in: hFile=0x228, lpBuffer=0x2650f40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2650f40*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0105.856] CloseHandle (hObject=0x228) returned 1
	[0105.856] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6c
	[0105.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0105.856] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0105.857] GetFileType (hFile=0x228) returned 0x1
	[0105.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0105.857] GetFileType (hFile=0x228) returned 0x1
	[0105.858] WriteFile (in: hFile=0x228, lpBuffer=0x26536d0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26536d0*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0105.861] CloseHandle (hObject=0x228) returned 1
	[0105.861] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0105.862] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\decrypt.txt")) returned 1
	[0105.867] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1
	[0105.867] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0105.868] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0105.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0105.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0105.868] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0105.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0105.868] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0105.869] GetFileType (hFile=0x224) returned 0x1
	[0105.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0105.869] GetFileType (hFile=0x224) returned 0x1
	[0105.869] WriteFile (in: hFile=0x224, lpBuffer=0x26563bc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26563bc*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0105.872] CloseHandle (hObject=0x224) returned 1
	[0105.873] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0105.873] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1
	[0105.874] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1
	[0105.874] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1
	[0105.875] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1
	[0105.875] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1
	[0105.876] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1
	[0105.877] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0105.877] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0
	[0105.877] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0105.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0105.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0105.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0105.878] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x55
	[0105.878] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x56
	[0105.878] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0105.879] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0105.880] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ebdd70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.004] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0106.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0106.005] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0106.005] GetFileType (hFile=0x224) returned 0x1
	[0106.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0106.005] GetFileType (hFile=0x224) returned 0x1
	[0106.005] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0106.005] ReadFile (in: hFile=0x224, lpBuffer=0x26595d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26595d8*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0106.008] CloseHandle (hObject=0x224) returned 1
	[0106.008] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x66
	[0106.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0106.009] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0106.010] GetFileType (hFile=0x224) returned 0x1
	[0106.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0106.010] GetFileType (hFile=0x224) returned 0x1
	[0106.010] WriteFile (in: hFile=0x224, lpBuffer=0x265bd50*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x265bd50*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0106.013] CloseHandle (hObject=0x224) returned 1
	[0106.014] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0106.014] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\decrypt.txt")) returned 1
	[0106.017] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x100c7cd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x100c7cd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0106.018] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1
	[0106.018] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1
	[0106.019] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1
	[0106.019] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1
	[0106.020] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1
	[0106.020] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1
	[0106.020] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1
	[0106.021] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1
	[0106.021] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.022] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0106.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0106.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0106.022] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0106.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0106.022] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0106.023] GetFileType (hFile=0x220) returned 0x1
	[0106.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0106.023] GetFileType (hFile=0x220) returned 0x1
	[0106.023] WriteFile (in: hFile=0x220, lpBuffer=0x2660d98*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2660d98*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0106.030] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.030] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.031] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2e
	[0106.031] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2f
	[0106.031] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.032] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ebdd70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.032] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3ebdd70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3ebdd70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ee3ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.033] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0106.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0106.033] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.033] GetFileType (hFile=0x220) returned 0x1
	[0106.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0106.033] GetFileType (hFile=0x220) returned 0x1
	[0106.033] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0106.034] ReadFile (in: hFile=0x220, lpBuffer=0x2662a8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2662a8c*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0106.144] CloseHandle (hObject=0x220) returned 1
	[0106.144] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3f
	[0106.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0106.145] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.153] GetFileType (hFile=0x220) returned 0x1
	[0106.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0106.153] GetFileType (hFile=0x220) returned 0x1
	[0106.154] WriteFile (in: hFile=0x220, lpBuffer=0x2665164*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2665164*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0106.156] CloseHandle (hObject=0x220) returned 1
	[0106.157] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0106.157] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\decrypt.txt")) returned 1
	[0106.160] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1007ba10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1007ba10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1
	[0106.161] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10244a90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10244a90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1
	[0106.162] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10244a90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10244a90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0
	[0106.162] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.163] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0106.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0106.163] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0106.164] GetFileType (hFile=0x208) returned 0x1
	[0106.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0106.164] GetFileType (hFile=0x208) returned 0x1
	[0106.164] WriteFile (in: hFile=0x208, lpBuffer=0x2667cbc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2667cbc*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0106.167] CloseHandle (hObject=0x208) returned 1
	[0106.167] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.167] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.168] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x29
	[0106.168] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x2a
	[0106.168] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ee3ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ee3ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.169] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3ee3ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3ee3ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.169] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3ee3ed0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3ee3ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f0a030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.170] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0106.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0106.170] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.170] GetFileType (hFile=0x208) returned 0x1
	[0106.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0106.171] GetFileType (hFile=0x208) returned 0x1
	[0106.171] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0106.171] ReadFile (in: hFile=0x208, lpBuffer=0x26698e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26698e0*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0106.174] CloseHandle (hObject=0x208) returned 1
	[0106.174] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3a
	[0106.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0106.174] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\device stage\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.175] GetFileType (hFile=0x208) returned 0x1
	[0106.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0106.175] GetFileType (hFile=0x208) returned 0x1
	[0106.176] WriteFile (in: hFile=0x208, lpBuffer=0x266bfa8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x266bfa8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0106.179] CloseHandle (hObject=0x208) returned 1
	[0106.179] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0106.179] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\decrypt.txt")) returned 1
	[0106.182] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xffe3490, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xffe3490, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1
	[0106.183] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1039b6f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1039b6f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1
	[0106.183] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1039b6f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1039b6f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0
	[0106.184] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.184] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0106.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.184] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0106.185] GetFileType (hFile=0x204) returned 0x1
	[0106.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0106.185] GetFileType (hFile=0x204) returned 0x1
	[0106.185] WriteFile (in: hFile=0x204, lpBuffer=0x266e88c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x266e88c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0106.188] CloseHandle (hObject=0x204) returned 1
	[0106.189] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f0a030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f0a030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1
	[0106.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.189] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x27
	[0106.189] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x28
	[0106.190] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f0a030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f0a030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.190] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f0a030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f0a030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.191] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3f0a030, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f0a030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f0a030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.192] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3f0a030, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f0a030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f0a030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0106.194] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.195] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x27
	[0106.195] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x28
	[0106.195] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f0a030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f0a030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.196] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f0a030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f0a030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.196] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3f0a030, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f0a030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f0a030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.197] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0106.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0106.197] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.197] GetFileType (hFile=0x208) returned 0x1
	[0106.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0106.198] GetFileType (hFile=0x208) returned 0x1
	[0106.198] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0106.198] ReadFile (in: hFile=0x208, lpBuffer=0x2670df0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2670df0*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0106.201] CloseHandle (hObject=0x208) returned 1
	[0106.201] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x38
	[0106.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0106.201] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.202] GetFileType (hFile=0x208) returned 0x1
	[0106.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0106.202] GetFileType (hFile=0x208) returned 0x1
	[0106.203] WriteFile (in: hFile=0x208, lpBuffer=0x26734b0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26734b0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0106.205] CloseHandle (hObject=0x208) returned 1
	[0106.206] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0106.206] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\decrypt.txt")) returned 1
	[0106.209] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.210] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.210] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0106.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.210] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0106.211] GetFileType (hFile=0x204) returned 0x1
	[0106.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0106.211] GetFileType (hFile=0x204) returned 0x1
	[0106.212] WriteFile (in: hFile=0x204, lpBuffer=0x2675b5c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2675b5c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0106.215] CloseHandle (hObject=0x204) returned 1
	[0106.215] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f562f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f562f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1
	[0106.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.216] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM", lpFilePart=0x0) returned 0x20
	[0106.216] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x21
	[0106.216] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f562f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f562f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.217] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f562f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f562f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.217] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3f562f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f562f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f562f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.218] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f30190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f30190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1
	[0106.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x27
	[0106.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x28
	[0106.219] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f30190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f30190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.219] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f30190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f30190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.220] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3f30190, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f30190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f30190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.220] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3f30190, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f30190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f30190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0106.221] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.221] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x27
	[0106.221] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x28
	[0106.222] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f30190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f30190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.222] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f30190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f30190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.223] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3f30190, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f30190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f30190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.223] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0106.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0106.225] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.225] GetFileType (hFile=0x220) returned 0x1
	[0106.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0106.225] GetFileType (hFile=0x220) returned 0x1
	[0106.226] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0106.226] ReadFile (in: hFile=0x220, lpBuffer=0x26788f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26788f4*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0106.229] CloseHandle (hObject=0x220) returned 1
	[0106.229] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x38
	[0106.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0106.229] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.230] GetFileType (hFile=0x220) returned 0x1
	[0106.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0106.230] GetFileType (hFile=0x220) returned 0x1
	[0106.231] WriteFile (in: hFile=0x220, lpBuffer=0x267afb4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x267afb4*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0106.234] CloseHandle (hObject=0x220) returned 1
	[0106.234] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0106.234] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\decrypt.txt")) returned 1
	[0106.238] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.238] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.240] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0106.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0106.240] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0106.241] GetFileType (hFile=0x208) returned 0x1
	[0106.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0106.241] GetFileType (hFile=0x208) returned 0x1
	[0106.242] WriteFile (in: hFile=0x208, lpBuffer=0x267d660*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x267d660*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0106.244] CloseHandle (hObject=0x208) returned 1
	[0106.245] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.245] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.246] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM", lpFilePart=0x0) returned 0x20
	[0106.246] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x21
	[0106.246] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f562f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f562f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.247] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3f562f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f562f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.247] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3f562f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f562f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f562f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.248] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0106.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0106.248] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\drm\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.248] GetFileType (hFile=0x208) returned 0x1
	[0106.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0106.249] GetFileType (hFile=0x208) returned 0x1
	[0106.249] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0106.249] ReadFile (in: hFile=0x208, lpBuffer=0x267f140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x267f140*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0106.252] CloseHandle (hObject=0x208) returned 1
	[0106.252] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x31
	[0106.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0106.253] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\drm\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.265] GetFileType (hFile=0x208) returned 0x1
	[0106.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0106.265] GetFileType (hFile=0x208) returned 0x1
	[0106.265] WriteFile (in: hFile=0x208, lpBuffer=0x26817e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26817e0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0106.268] CloseHandle (hObject=0x208) returned 1
	[0106.268] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0106.269] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\drm\\decrypt.txt")) returned 1
	[0106.272] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10459dd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10459dd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1
	[0106.273] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10459dd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10459dd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0
	[0106.273] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.274] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0106.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.274] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\drm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0106.275] GetFileType (hFile=0x204) returned 0x1
	[0106.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0106.275] GetFileType (hFile=0x204) returned 0x1
	[0106.276] WriteFile (in: hFile=0x204, lpBuffer=0x2683f6c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2683f6c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0106.279] CloseHandle (hObject=0x204) returned 1
	[0106.279] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1
	[0106.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.280] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome", lpFilePart=0x0) returned 0x22
	[0106.280] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x23
	[0106.280] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.281] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.281] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3f7c450, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.282] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1
	[0106.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.282] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x27
	[0106.283] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x28
	[0106.283] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.284] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.284] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3f7c450, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.285] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3f7c450, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0106.285] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.288] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x27
	[0106.288] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x28
	[0106.288] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.289] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.290] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3f7c450, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.290] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0106.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0106.291] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.291] GetFileType (hFile=0x220) returned 0x1
	[0106.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0106.291] GetFileType (hFile=0x220) returned 0x1
	[0106.292] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0106.292] ReadFile (in: hFile=0x220, lpBuffer=0x2686d48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2686d48*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0106.295] CloseHandle (hObject=0x220) returned 1
	[0106.295] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x38
	[0106.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0106.295] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.296] GetFileType (hFile=0x220) returned 0x1
	[0106.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0106.296] GetFileType (hFile=0x220) returned 0x1
	[0106.297] WriteFile (in: hFile=0x220, lpBuffer=0x2689408*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2689408*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0106.300] CloseHandle (hObject=0x220) returned 1
	[0106.300] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0106.300] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\decrypt.txt")) returned 1
	[0106.304] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.304] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.305] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0106.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0106.305] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0106.306] GetFileType (hFile=0x208) returned 0x1
	[0106.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0106.306] GetFileType (hFile=0x208) returned 0x1
	[0106.306] WriteFile (in: hFile=0x208, lpBuffer=0x268bab4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x268bab4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0106.309] CloseHandle (hObject=0x208) returned 1
	[0106.310] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.310] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.311] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome", lpFilePart=0x0) returned 0x22
	[0106.311] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x23
	[0106.311] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.312] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.312] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3f7c450, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3f7c450, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3f7c450, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.313] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0106.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0106.313] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\ehome\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.314] GetFileType (hFile=0x208) returned 0x1
	[0106.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0106.314] GetFileType (hFile=0x208) returned 0x1
	[0106.314] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0106.314] ReadFile (in: hFile=0x208, lpBuffer=0x268d5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x268d5e0*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0106.317] CloseHandle (hObject=0x208) returned 1
	[0106.317] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x33
	[0106.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0106.318] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\ehome\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.318] GetFileType (hFile=0x208) returned 0x1
	[0106.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0106.319] GetFileType (hFile=0x208) returned 0x1
	[0106.319] WriteFile (in: hFile=0x208, lpBuffer=0x268fc88*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x268fc88*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0106.322] CloseHandle (hObject=0x208) returned 1
	[0106.322] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0106.323] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\ehome\\decrypt.txt")) returned 1
	[0106.326] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x104f2350, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x104f2350, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1
	[0106.326] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x104f2350, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x104f2350, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0
	[0106.327] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.327] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0106.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.328] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\ehome\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0106.328] GetFileType (hFile=0x204) returned 0x1
	[0106.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0106.328] GetFileType (hFile=0x204) returned 0x1
	[0106.329] WriteFile (in: hFile=0x204, lpBuffer=0x2692418*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2692418*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0106.340] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0106.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.341] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x29
	[0106.341] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x2a
	[0106.341] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.342] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.342] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3fc8710, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fee870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.343] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1
	[0106.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.343] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2f
	[0106.344] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x30
	[0106.344] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.344] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.345] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fa25b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fa25b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1
	[0106.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.345] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x48
	[0106.345] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x49
	[0106.346] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fa25b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fa25b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0106.346] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fa25b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fa25b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.347] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3fa25b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3fa25b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fa25b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.348] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3fa25b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3fa25b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fa25b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0106.352] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0106.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0106.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0106.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.352] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x48
	[0106.353] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x49
	[0106.353] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fa25b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fa25b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0106.353] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fa25b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fa25b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.354] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3fa25b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3fa25b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fa25b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.354] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0106.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0106.355] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0106.355] GetFileType (hFile=0x224) returned 0x1
	[0106.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0106.355] GetFileType (hFile=0x224) returned 0x1
	[0106.355] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0106.356] ReadFile (in: hFile=0x224, lpBuffer=0x26965c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26965c0*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0106.359] CloseHandle (hObject=0x224) returned 1
	[0106.359] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x59
	[0106.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0106.359] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0106.360] GetFileType (hFile=0x224) returned 0x1
	[0106.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0106.360] GetFileType (hFile=0x224) returned 0x1
	[0106.361] WriteFile (in: hFile=0x224, lpBuffer=0x2698d00*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2698d00*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0106.363] CloseHandle (hObject=0x224) returned 1
	[0106.364] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0106.364] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\decrypt.txt")) returned 1
	[0106.368] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.368] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0106.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0106.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0106.369] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0106.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0106.369] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0106.369] GetFileType (hFile=0x220) returned 0x1
	[0106.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0106.370] GetFileType (hFile=0x220) returned 0x1
	[0106.370] WriteFile (in: hFile=0x220, lpBuffer=0x269b478*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x269b478*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0106.373] CloseHandle (hObject=0x220) returned 1
	[0106.373] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3fc8710, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.374] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3fc8710, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0106.374] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.375] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2f
	[0106.375] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x30
	[0106.375] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.376] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.377] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x1058a8d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1058a8d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1
	[0106.377] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3fc8710, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.378] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0106.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0106.378] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.378] GetFileType (hFile=0x220) returned 0x1
	[0106.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0106.379] GetFileType (hFile=0x220) returned 0x1
	[0106.379] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0106.379] ReadFile (in: hFile=0x220, lpBuffer=0x269d498, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x269d498*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0106.383] CloseHandle (hObject=0x220) returned 1
	[0106.383] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x40
	[0106.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0106.384] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.384] GetFileType (hFile=0x220) returned 0x1
	[0106.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0106.385] GetFileType (hFile=0x220) returned 0x1
	[0106.385] WriteFile (in: hFile=0x220, lpBuffer=0x269fb78*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x269fb78*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0106.388] CloseHandle (hObject=0x220) returned 1
	[0106.389] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0106.389] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\decrypt.txt")) returned 1
	[0106.400] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.401] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.401] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0106.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0106.402] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0106.402] GetFileType (hFile=0x208) returned 0x1
	[0106.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0106.403] GetFileType (hFile=0x208) returned 0x1
	[0106.403] WriteFile (in: hFile=0x208, lpBuffer=0x26a2254*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26a2254*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0106.406] CloseHandle (hObject=0x208) returned 1
	[0106.407] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.407] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.408] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x29
	[0106.408] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x2a
	[0106.408] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.409] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fc8710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.410] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3fc8710, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3fc8710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fee870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.410] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0106.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0106.411] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.411] GetFileType (hFile=0x208) returned 0x1
	[0106.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0106.412] GetFileType (hFile=0x208) returned 0x1
	[0106.412] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0106.412] ReadFile (in: hFile=0x208, lpBuffer=0x26a3e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26a3e78*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0106.415] CloseHandle (hObject=0x208) returned 1
	[0106.415] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3a
	[0106.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0106.416] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.416] GetFileType (hFile=0x208) returned 0x1
	[0106.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0106.417] GetFileType (hFile=0x208) returned 0x1
	[0106.417] WriteFile (in: hFile=0x208, lpBuffer=0x26a6540*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26a6540*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0106.420] CloseHandle (hObject=0x208) returned 1
	[0106.420] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0106.421] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\decrypt.txt")) returned 1
	[0106.424] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x105d6b90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x105d6b90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1
	[0106.425] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x105d6b90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x105d6b90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0
	[0106.425] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.428] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0106.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.429] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0106.430] GetFileType (hFile=0x204) returned 0x1
	[0106.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0106.430] GetFileType (hFile=0x204) returned 0x1
	[0106.430] WriteFile (in: hFile=0x204, lpBuffer=0x26a8d14*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26a8d14*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0106.433] CloseHandle (hObject=0x204) returned 1
	[0106.434] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3fee870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fee870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1
	[0106.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.434] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x28
	[0106.434] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x29
	[0106.435] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3fee870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fee870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.435] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3fee870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fee870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.436] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3fee870, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3fee870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fee870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.437] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1
	[0106.437] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1
	[0106.438] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0
	[0106.438] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.439] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x28
	[0106.439] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x29
	[0106.439] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3fee870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fee870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.440] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3fee870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fee870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.440] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3fee870, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf3fee870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3fee870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.441] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0106.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0106.441] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.441] GetFileType (hFile=0x208) returned 0x1
	[0106.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0106.442] GetFileType (hFile=0x208) returned 0x1
	[0106.442] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0106.442] ReadFile (in: hFile=0x208, lpBuffer=0x26ab574, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26ab574*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0106.445] CloseHandle (hObject=0x208) returned 1
	[0106.445] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x39
	[0106.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0106.446] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.527] GetFileType (hFile=0x208) returned 0x1
	[0106.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0106.527] GetFileType (hFile=0x208) returned 0x1
	[0106.528] WriteFile (in: hFile=0x208, lpBuffer=0x26adc34*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26adc34*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0106.531] CloseHandle (hObject=0x208) returned 1
	[0106.531] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0106.531] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\decrypt.txt")) returned 1
	[0106.535] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1
	[0106.536] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1
	[0106.536] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.536] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.537] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0106.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.537] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0106.538] GetFileType (hFile=0x204) returned 0x1
	[0106.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0106.538] GetFileType (hFile=0x204) returned 0x1
	[0106.538] WriteFile (in: hFile=0x204, lpBuffer=0x26b093c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26b093c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0106.542] CloseHandle (hObject=0x204) returned 1
	[0106.543] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf40149d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40149d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0106.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.543] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x29
	[0106.544] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x2a
	[0106.544] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf40149d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40149d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.544] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf40149d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40149d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.545] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf40149d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf40149d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40149d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.546] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf40149d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf40149d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40149d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0106.546] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.547] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x29
	[0106.547] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x2a
	[0106.547] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf40149d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40149d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.548] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf40149d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40149d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.548] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf40149d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf40149d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40149d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.549] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0106.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0106.550] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\media player\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.550] GetFileType (hFile=0x208) returned 0x1
	[0106.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0106.550] GetFileType (hFile=0x208) returned 0x1
	[0106.550] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0106.550] ReadFile (in: hFile=0x208, lpBuffer=0x26b2f34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26b2f34*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0106.554] CloseHandle (hObject=0x208) returned 1
	[0106.554] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3a
	[0106.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0106.554] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\media player\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.555] GetFileType (hFile=0x208) returned 0x1
	[0106.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0106.555] GetFileType (hFile=0x208) returned 0x1
	[0106.556] WriteFile (in: hFile=0x208, lpBuffer=0x26b55fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26b55fc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0106.559] CloseHandle (hObject=0x208) returned 1
	[0106.560] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0106.560] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\media player\\decrypt.txt")) returned 1
	[0106.563] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.564] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.564] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0106.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.565] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\media player\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0106.565] GetFileType (hFile=0x204) returned 0x1
	[0106.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0106.566] GetFileType (hFile=0x204) returned 0x1
	[0106.566] WriteFile (in: hFile=0x204, lpBuffer=0x26b7cb4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26b7cb4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0106.574] CloseHandle (hObject=0x204) returned 1
	[0106.575] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf403ab30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf403ab30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1
	[0106.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.575] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF", lpFilePart=0x0) returned 0x1f
	[0106.575] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x20
	[0106.576] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf403ab30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf403ab30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.576] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf403ab30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf403ab30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.577] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1
	[0106.577] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf403ab30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf403ab30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf403ab30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.578] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1
	[0106.578] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 0
	[0106.579] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.579] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF", lpFilePart=0x0) returned 0x1f
	[0106.579] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x20
	[0106.580] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf403ab30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf403ab30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.580] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf403ab30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf403ab30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.581] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1
	[0106.581] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf403ab30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf403ab30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf403ab30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.582] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0106.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0106.586] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\mf\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.586] GetFileType (hFile=0x208) returned 0x1
	[0106.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0106.586] GetFileType (hFile=0x208) returned 0x1
	[0106.586] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0106.587] ReadFile (in: hFile=0x208, lpBuffer=0x26ba440, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26ba440*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0106.589] CloseHandle (hObject=0x208) returned 1
	[0106.590] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x30
	[0106.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0106.590] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\mf\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.591] GetFileType (hFile=0x208) returned 0x1
	[0106.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0106.591] GetFileType (hFile=0x208) returned 0x1
	[0106.591] WriteFile (in: hFile=0x208, lpBuffer=0x26bcae0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26bcae0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0106.594] CloseHandle (hObject=0x208) returned 1
	[0106.595] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0106.595] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\mf\\decrypt.txt")) returned 1
	[0106.598] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1
	[0106.599] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.599] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.599] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0106.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.600] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\mf\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0106.600] GetFileType (hFile=0x204) returned 0x1
	[0106.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0106.601] GetFileType (hFile=0x204) returned 0x1
	[0106.601] WriteFile (in: hFile=0x204, lpBuffer=0x26bf3f8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26bf3f8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0106.604] CloseHandle (hObject=0x204) returned 1
	[0106.604] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1
	[0106.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.605] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x21
	[0106.605] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x22
	[0106.605] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.606] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.607] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1
	[0106.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.607] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x25
	[0106.608] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x26
	[0106.608] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.608] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.609] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4060c90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.610] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4060c90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0106.610] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.615] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x25
	[0106.615] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x26
	[0106.615] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.616] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.617] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4060c90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.617] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0106.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0106.617] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.618] GetFileType (hFile=0x220) returned 0x1
	[0106.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0106.618] GetFileType (hFile=0x220) returned 0x1
	[0106.618] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0106.618] ReadFile (in: hFile=0x220, lpBuffer=0x26c2014, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26c2014*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0106.622] CloseHandle (hObject=0x220) returned 1
	[0106.622] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x36
	[0106.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0106.622] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.623] GetFileType (hFile=0x220) returned 0x1
	[0106.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0106.623] GetFileType (hFile=0x220) returned 0x1
	[0106.624] WriteFile (in: hFile=0x220, lpBuffer=0x26c46cc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26c46cc*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0106.630] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0106.630] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\decrypt.txt")) returned 1
	[0106.633] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.634] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.634] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0106.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0106.635] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0106.635] GetFileType (hFile=0x208) returned 0x1
	[0106.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0106.635] GetFileType (hFile=0x208) returned 0x1
	[0106.636] WriteFile (in: hFile=0x208, lpBuffer=0x26c6d6c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26c6d6c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0106.639] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4060c90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4086df0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.640] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4060c90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4086df0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0106.640] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.641] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x21
	[0106.641] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x22
	[0106.641] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.641] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4060c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.642] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10812030, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10812030, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1
	[0106.643] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4060c90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4060c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4086df0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.643] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0106.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0106.643] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\msdn\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.643] GetFileType (hFile=0x208) returned 0x1
	[0106.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0106.644] GetFileType (hFile=0x208) returned 0x1
	[0106.644] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0106.644] ReadFile (in: hFile=0x208, lpBuffer=0x26c8a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26c8a64*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0106.648] CloseHandle (hObject=0x208) returned 1
	[0106.648] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x32
	[0106.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0106.648] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\msdn\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.649] GetFileType (hFile=0x208) returned 0x1
	[0106.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0106.649] GetFileType (hFile=0x208) returned 0x1
	[0106.649] WriteFile (in: hFile=0x208, lpBuffer=0x26cb10c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26cb10c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0106.653] CloseHandle (hObject=0x208) returned 1
	[0106.653] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0106.653] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\msdn\\decrypt.txt")) returned 1
	[0106.656] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.657] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.657] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0106.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.657] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\msdn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0106.658] GetFileType (hFile=0x204) returned 0x1
	[0106.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0106.658] GetFileType (hFile=0x204) returned 0x1
	[0106.659] WriteFile (in: hFile=0x204, lpBuffer=0x26cd794*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26cd794*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0106.664] CloseHandle (hObject=0x204) returned 1
	[0106.665] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1
	[0106.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.665] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x29
	[0106.666] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x2a
	[0106.666] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.667] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.667] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1
	[0106.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.668] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x39
	[0106.668] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x3a
	[0106.668] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.669] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.670] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf40acf50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.670] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf40acf50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0106.671] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.671] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x39
	[0106.671] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x3a
	[0106.672] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.672] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.673] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf40acf50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.673] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0106.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0106.674] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.674] GetFileType (hFile=0x220) returned 0x1
	[0106.674] GetFileType (hFile=0x220) returned 0x1
	[0106.674] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0106.675] ReadFile (in: hFile=0x220, lpBuffer=0x26d0a98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26d0a98*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0106.678] CloseHandle (hObject=0x220) returned 1
	[0106.678] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x4a
	[0106.678] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.680] GetFileType (hFile=0x220) returned 0x1
	[0106.680] GetFileType (hFile=0x220) returned 0x1
	[0106.680] WriteFile (in: hFile=0x220, lpBuffer=0x26d31a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26d31a0*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0106.684] CloseHandle (hObject=0x220) returned 1
	[0106.684] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0106.684] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\decrypt.txt")) returned 1
	[0106.688] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.688] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.688] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0106.688] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0106.689] GetFileType (hFile=0x208) returned 0x1
	[0106.689] GetFileType (hFile=0x208) returned 0x1
	[0106.689] WriteFile (in: hFile=0x208, lpBuffer=0x26d58b8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26d58b8*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0106.693] CloseHandle (hObject=0x208) returned 1
	[0106.693] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf40acf50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40d30b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.693] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf40acf50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40d30b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0106.694] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.694] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x29
	[0106.695] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x2a
	[0106.695] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.695] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40acf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.696] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x10884450, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10884450, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1
	[0106.697] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf40acf50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf40acf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40d30b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.697] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0106.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0106.697] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\netframework\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.698] GetFileType (hFile=0x208) returned 0x1
	[0106.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0106.698] GetFileType (hFile=0x208) returned 0x1
	[0106.698] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0106.698] ReadFile (in: hFile=0x208, lpBuffer=0x26d7788, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26d7788*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0106.701] CloseHandle (hObject=0x208) returned 1
	[0106.701] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3a
	[0106.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0106.701] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\netframework\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.702] GetFileType (hFile=0x208) returned 0x1
	[0106.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0106.702] GetFileType (hFile=0x208) returned 0x1
	[0106.703] WriteFile (in: hFile=0x208, lpBuffer=0x26d9e50*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26d9e50*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0106.706] CloseHandle (hObject=0x208) returned 1
	[0106.706] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0106.706] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\netframework\\decrypt.txt")) returned 1
	[0106.711] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.712] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.712] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0106.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.712] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\netframework\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0106.713] GetFileType (hFile=0x204) returned 0x1
	[0106.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0106.713] GetFileType (hFile=0x204) returned 0x1
	[0106.714] WriteFile (in: hFile=0x204, lpBuffer=0x26dc508*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26dc508*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0106.717] CloseHandle (hObject=0x204) returned 1
	[0106.717] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1
	[0106.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.718] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network", lpFilePart=0x0) returned 0x24
	[0106.718] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x25
	[0106.718] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.719] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.720] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf40d30b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40d30b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1
	[0106.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.720] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x30
	[0106.720] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x31
	[0106.721] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf40d30b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40d30b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.721] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf40d30b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40d30b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.722] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf40d30b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf40d30b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40f9210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.722] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf40d30b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf40d30b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40f9210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0106.723] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.724] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x30
	[0106.724] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x31
	[0106.724] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf40d30b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40d30b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.725] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf40d30b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40d30b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.725] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf40d30b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf40d30b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf40f9210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.726] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0106.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0106.726] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.726] GetFileType (hFile=0x220) returned 0x1
	[0106.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0106.727] GetFileType (hFile=0x220) returned 0x1
	[0106.727] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0106.727] ReadFile (in: hFile=0x220, lpBuffer=0x26df4ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26df4ec*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0106.730] CloseHandle (hObject=0x220) returned 1
	[0106.731] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x41
	[0106.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0106.731] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.732] GetFileType (hFile=0x220) returned 0x1
	[0106.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0106.732] GetFileType (hFile=0x220) returned 0x1
	[0106.732] WriteFile (in: hFile=0x220, lpBuffer=0x26e1bcc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26e1bcc*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0106.736] CloseHandle (hObject=0x220) returned 1
	[0106.736] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0106.736] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\decrypt.txt")) returned 1
	[0106.740] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.740] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.741] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0106.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0106.741] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0106.742] GetFileType (hFile=0x208) returned 0x1
	[0106.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0106.742] GetFileType (hFile=0x208) returned 0x1
	[0106.742] WriteFile (in: hFile=0x208, lpBuffer=0x26e42b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26e42b4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0106.745] CloseHandle (hObject=0x208) returned 1
	[0106.745] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4c21930, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c47a90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.746] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1
	[0106.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.746] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2f
	[0106.746] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x30
	[0106.747] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.747] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.749] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c21930, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.750] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf44651b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf44651b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf448b310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr0.dat.KEKW", cAlternateFileName="QMGR0D~1.KEK")) returned 1
	[0106.750] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4baf510, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4baf510, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4bd5670, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat.KEKW", cAlternateFileName="QMGR1D~1.KEK")) returned 1
	[0106.751] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4baf510, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4baf510, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4bd5670, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat.KEKW", cAlternateFileName="QMGR1D~1.KEK")) returned 0
	[0106.751] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.752] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2f
	[0106.752] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x30
	[0106.752] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.753] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.771] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c21930, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.771] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0106.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0106.772] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.772] GetFileType (hFile=0x220) returned 0x1
	[0106.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0106.773] GetFileType (hFile=0x220) returned 0x1
	[0106.773] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0106.773] ReadFile (in: hFile=0x220, lpBuffer=0x26e6ea0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26e6ea0*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0106.776] CloseHandle (hObject=0x220) returned 1
	[0106.776] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x40
	[0106.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0106.776] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0106.815] GetFileType (hFile=0x220) returned 0x1
	[0106.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0106.816] GetFileType (hFile=0x220) returned 0x1
	[0106.817] WriteFile (in: hFile=0x220, lpBuffer=0x26e9580*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26e9580*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0106.820] CloseHandle (hObject=0x220) returned 1
	[0106.820] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0106.820] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\decrypt.txt")) returned 1
	[0106.824] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf44651b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf44651b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf448b310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr0.dat.KEKW", cAlternateFileName="QMGR0D~1.KEK")) returned 1
	[0106.824] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4baf510, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4baf510, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4bd5670, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat.KEKW", cAlternateFileName="QMGR1D~1.KEK")) returned 1
	[0106.824] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.825] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.825] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0106.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0106.825] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0106.826] GetFileType (hFile=0x208) returned 0x1
	[0106.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0106.826] GetFileType (hFile=0x208) returned 0x1
	[0106.826] WriteFile (in: hFile=0x208, lpBuffer=0x26ec3a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26ec3a4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0106.830] CloseHandle (hObject=0x208) returned 1
	[0106.830] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.830] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.831] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network", lpFilePart=0x0) returned 0x24
	[0106.831] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x25
	[0106.831] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.836] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c21930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.836] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1091c9d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1091c9d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1
	[0106.837] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4c21930, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4c21930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4c47a90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.837] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0106.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0106.838] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.838] GetFileType (hFile=0x208) returned 0x1
	[0106.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0106.838] GetFileType (hFile=0x208) returned 0x1
	[0106.838] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0106.838] ReadFile (in: hFile=0x208, lpBuffer=0x26ee054, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26ee054*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0106.841] CloseHandle (hObject=0x208) returned 1
	[0106.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x35
	[0106.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0106.842] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\network\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0106.850] GetFileType (hFile=0x208) returned 0x1
	[0106.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0106.851] GetFileType (hFile=0x208) returned 0x1
	[0106.851] WriteFile (in: hFile=0x208, lpBuffer=0x26f0704*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26f0704*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0106.854] CloseHandle (hObject=0x208) returned 1
	[0106.854] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0106.854] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\decrypt.txt")) returned 1
	[0106.857] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x109db0b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x109db0b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1
	[0106.858] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x109db0b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x109db0b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0
	[0106.858] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0106.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0106.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0106.859] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0106.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.859] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0106.860] GetFileType (hFile=0x204) returned 0x1
	[0106.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0106.860] GetFileType (hFile=0x204) returned 0x1
	[0106.860] WriteFile (in: hFile=0x204, lpBuffer=0x26f2f18*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26f2f18*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0106.864] CloseHandle (hObject=0x204) returned 1
	[0106.865] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4dc4850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4dc4850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1
	[0106.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0106.865] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x23
	[0106.865] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x24
	[0106.866] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4dc4850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4dc4850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0106.866] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4dc4850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4dc4850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.867] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1
	[0106.868] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4dc4850, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4dc4850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4dea9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.868] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1
	[0106.869] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1
	[0106.870] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySite.ico", cAlternateFileName="")) returned 1
	[0106.870] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1
	[0106.871] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1
	[0106.871] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1
	[0106.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.872] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2e
	[0106.872] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2f
	[0106.872] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.873] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.873] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4ce0010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4ce0010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1
	[0106.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.874] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x33
	[0106.874] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x34
	[0106.874] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4ce0010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4ce0010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0106.875] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4ce0010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4ce0010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.876] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4ce0010, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4ce0010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d06170, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.876] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1
	[0106.877] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1
	[0106.877] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1
	[0106.878] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1
	[0106.880] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1
	[0106.880] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1
	[0106.881] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1
	[0106.881] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1
	[0106.882] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1
	[0106.882] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1
	[0106.883] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1
	[0106.884] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1
	[0106.884] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1
	[0106.885] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1
	[0106.885] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1
	[0106.886] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1
	[0106.886] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1
	[0106.887] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1
	[0106.888] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1
	[0106.889] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1
	[0106.889] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1
	[0106.890] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1
	[0106.890] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1
	[0106.891] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1
	[0106.891] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1
	[0106.892] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1
	[0106.893] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1
	[0106.893] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0
	[0106.894] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0106.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0106.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0106.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.899] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x33
	[0106.899] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x34
	[0106.899] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4ce0010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4ce0010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0106.900] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4ce0010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4ce0010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.900] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4ce0010, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4ce0010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d06170, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.901] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0106.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0106.901] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0106.901] GetFileType (hFile=0x224) returned 0x1
	[0106.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0106.902] GetFileType (hFile=0x224) returned 0x1
	[0106.902] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0106.902] ReadFile (in: hFile=0x224, lpBuffer=0x26f9f68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26f9f68*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0106.905] CloseHandle (hObject=0x224) returned 1
	[0106.905] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x44
	[0106.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0106.905] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0106.906] GetFileType (hFile=0x224) returned 0x1
	[0106.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0106.907] GetFileType (hFile=0x224) returned 0x1
	[0106.907] WriteFile (in: hFile=0x224, lpBuffer=0x26fc658*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26fc658*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0106.910] CloseHandle (hObject=0x224) returned 1
	[0106.911] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0106.911] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\decrypt.txt")) returned 1
	[0106.914] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1
	[0106.914] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1
	[0106.915] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1
	[0106.915] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1
	[0106.916] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1
	[0106.916] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1
	[0106.917] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1
	[0106.917] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1
	[0106.918] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1
	[0106.918] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1
	[0106.919] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1
	[0106.919] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1
	[0106.920] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1
	[0106.920] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1
	[0106.921] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1
	[0106.922] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1
	[0106.922] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1
	[0106.923] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1
	[0106.923] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1
	[0106.924] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1
	[0106.924] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1
	[0106.924] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1
	[0106.925] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1
	[0106.926] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1
	[0106.926] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1
	[0106.926] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1
	[0106.927] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1
	[0106.927] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.927] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0106.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0106.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0106.928] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0106.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0106.928] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0106.929] GetFileType (hFile=0x220) returned 0x1
	[0106.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0106.929] GetFileType (hFile=0x220) returned 0x1
	[0106.929] WriteFile (in: hFile=0x220, lpBuffer=0x2705ac4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2705ac4*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0106.933] CloseHandle (hObject=0x220) returned 1
	[0106.933] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1
	[0106.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.934] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x33
	[0106.934] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x34
	[0106.934] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0106.935] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.936] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4d9e6f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.936] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1
	[0106.937] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xb960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1
	[0106.937] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x39960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1
	[0106.938] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x47d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1
	[0106.938] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1
	[0106.939] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x248aaf00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x248aaf00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x16f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1
	[0106.939] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25bbdc00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25bbdc00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2b2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1
	[0106.940] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3564d600, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3564d600, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1
	[0106.941] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63b88300, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63b88300, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1
	[0106.941] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62875600, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62875600, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1
	[0106.942] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x35960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1
	[0106.942] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x9f560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1
	[0106.943] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x315ed100, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x315ed100, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1
	[0106.943] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a4a9400, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1a4a9400, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0xd160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1
	[0106.944] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19196700, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x19196700, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0x43560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1
	[0106.945] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1
	[0106.945] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57655500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57655500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x87f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1
	[0106.946] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2720b500, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2720b500, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x57f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1
	[0106.946] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x94d0df00, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x94d0df00, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1
	[0106.947] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca190500, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xca190500, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1
	[0106.947] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1
	[0106.948] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70273800, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x70273800, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x73960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1
	[0106.948] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1789a00, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa1789a00, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x24360, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1
	[0106.952] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a9c700, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2a9c700, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x110b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1
	[0106.953] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x23960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1
	[0106.953] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x126760, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1
	[0106.954] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1
	[0106.954] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0
	[0106.954] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0106.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0106.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0106.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0106.954] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x33
	[0106.955] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x34
	[0106.955] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0106.955] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0106.956] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4d9e6f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.956] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0106.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0106.956] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0106.956] GetFileType (hFile=0x224) returned 0x1
	[0106.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0106.957] GetFileType (hFile=0x224) returned 0x1
	[0106.957] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0106.957] ReadFile (in: hFile=0x224, lpBuffer=0x270b0e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x270b0e0*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0106.960] CloseHandle (hObject=0x224) returned 1
	[0106.960] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x44
	[0106.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0106.960] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0106.961] GetFileType (hFile=0x224) returned 0x1
	[0106.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0106.962] GetFileType (hFile=0x224) returned 0x1
	[0106.962] WriteFile (in: hFile=0x224, lpBuffer=0x270d7d0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x270d7d0*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0106.966] CloseHandle (hObject=0x224) returned 1
	[0106.966] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0106.967] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\decrypt.txt")) returned 1
	[0106.970] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1
	[0106.970] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xb960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1
	[0106.971] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x39960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1
	[0106.971] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x47d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1
	[0106.972] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1
	[0106.972] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x248aaf00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x248aaf00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x16f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1
	[0106.973] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25bbdc00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25bbdc00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2b2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1
	[0106.973] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3564d600, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3564d600, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1
	[0106.974] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63b88300, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63b88300, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1
	[0106.974] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62875600, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62875600, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1
	[0106.975] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x35960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1
	[0106.975] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x9f560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1
	[0106.976] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x315ed100, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x315ed100, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1
	[0106.976] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a4a9400, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1a4a9400, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0xd160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1
	[0106.977] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19196700, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x19196700, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0x43560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1
	[0106.979] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1
	[0106.979] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57655500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57655500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x87f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1
	[0106.980] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2720b500, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2720b500, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x57f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1
	[0106.980] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x94d0df00, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x94d0df00, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1
	[0106.981] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca190500, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xca190500, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1
	[0106.981] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1
	[0106.982] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70273800, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x70273800, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x73960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1
	[0106.982] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1789a00, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa1789a00, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x24360, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1
	[0106.983] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a9c700, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2a9c700, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x110b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1
	[0106.983] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x23960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1
	[0106.984] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x126760, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1
	[0106.984] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1
	[0106.985] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0106.985] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0106.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0106.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0106.986] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0106.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0106.987] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0106.988] GetFileType (hFile=0x220) returned 0x1
	[0106.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0106.988] GetFileType (hFile=0x220) returned 0x1
	[0106.993] WriteFile (in: hFile=0x220, lpBuffer=0x2716c3c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2716c3c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0106.996] CloseHandle (hObject=0x220) returned 1
	[0106.996] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4d9e6f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4dc4850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0106.997] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4d9e6f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4dc4850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0106.997] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0106.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0106.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0106.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0106.998] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2e
	[0106.998] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2f
	[0106.998] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0106.999] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4d9e6f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.000] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x10ae5a50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10ae5a50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1
	[0107.000] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x10b57e70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10b57e70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1
	[0107.001] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4d9e6f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4d9e6f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4dc4850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.001] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0107.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0107.001] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0107.002] GetFileType (hFile=0x220) returned 0x1
	[0107.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0107.002] GetFileType (hFile=0x220) returned 0x1
	[0107.002] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0107.002] ReadFile (in: hFile=0x220, lpBuffer=0x2718cbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2718cbc*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0107.008] CloseHandle (hObject=0x220) returned 1
	[0107.008] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3f
	[0107.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0107.008] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0107.009] GetFileType (hFile=0x220) returned 0x1
	[0107.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0107.009] GetFileType (hFile=0x220) returned 0x1
	[0107.010] WriteFile (in: hFile=0x220, lpBuffer=0x271b394*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x271b394*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0107.013] CloseHandle (hObject=0x220) returned 1
	[0107.014] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0107.014] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\decrypt.txt")) returned 1
	[0107.017] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.018] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0107.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0107.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0107.018] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0107.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0107.019] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0107.020] GetFileType (hFile=0x208) returned 0x1
	[0107.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0107.021] GetFileType (hFile=0x208) returned 0x1
	[0107.021] WriteFile (in: hFile=0x208, lpBuffer=0x271da70*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x271da70*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0107.024] CloseHandle (hObject=0x208) returned 1
	[0107.024] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.025] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0107.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0107.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0107.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0107.026] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x23
	[0107.026] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x24
	[0107.026] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4dc4850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4dc4850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0107.027] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4dc4850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4dc4850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.027] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1
	[0107.028] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4dc4850, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4dc4850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4dea9b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.028] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0107.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0107.028] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0107.029] GetFileType (hFile=0x208) returned 0x1
	[0107.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0107.029] GetFileType (hFile=0x208) returned 0x1
	[0107.029] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0107.029] ReadFile (in: hFile=0x208, lpBuffer=0x271f8e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x271f8e0*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0107.032] CloseHandle (hObject=0x208) returned 1
	[0107.032] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x34
	[0107.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0107.032] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\office\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0107.033] GetFileType (hFile=0x208) returned 0x1
	[0107.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0107.033] GetFileType (hFile=0x208) returned 0x1
	[0107.034] WriteFile (in: hFile=0x208, lpBuffer=0x2721f90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2721f90*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0107.043] CloseHandle (hObject=0x208) returned 1
	[0107.043] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0107.043] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\decrypt.txt")) returned 1
	[0107.047] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1
	[0107.047] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1
	[0107.048] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySite.ico", cAlternateFileName="")) returned 1
	[0107.048] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1
	[0107.048] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1
	[0107.049] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x10bca290, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10bca290, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1
	[0107.050] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x10bca290, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10bca290, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 0
	[0107.050] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0107.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0107.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0107.051] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0107.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0107.052] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\office\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0107.053] GetFileType (hFile=0x204) returned 0x1
	[0107.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0107.054] GetFileType (hFile=0x204) returned 0x1
	[0107.054] WriteFile (in: hFile=0x204, lpBuffer=0x272580c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x272580c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0107.060] CloseHandle (hObject=0x204) returned 1
	[0107.060] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf5345b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5345b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1
	[0107.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0107.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x3d
	[0107.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3e
	[0107.061] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf5345b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5345b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0107.062] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf5345b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5345b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.062] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4e5cdd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4e5cdd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0107.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0107.063] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x43
	[0107.063] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x44
	[0107.063] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4e5cdd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4e5cdd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0107.064] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4e5cdd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4e5cdd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.065] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4e36c70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4e36c70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4e36c70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache.dat.KEKW", cAlternateFileName="CACHED~1.KEK")) returned 1
	[0107.065] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4e5cdd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4e5cdd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4e5cdd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.066] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4e5cdd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4e5cdd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4e5cdd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0107.066] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0107.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0107.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0107.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0107.067] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x43
	[0107.067] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x44
	[0107.067] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4e5cdd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4e5cdd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0107.068] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf4e5cdd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4e5cdd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.068] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4e36c70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4e36c70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4e36c70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache.dat.KEKW", cAlternateFileName="CACHED~1.KEK")) returned 1
	[0107.069] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4e5cdd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf4e5cdd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf4e5cdd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.070] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0107.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0107.070] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0107.071] GetFileType (hFile=0x220) returned 0x1
	[0107.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0107.071] GetFileType (hFile=0x220) returned 0x1
	[0107.071] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0107.071] ReadFile (in: hFile=0x220, lpBuffer=0x2729668, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2729668*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0107.074] CloseHandle (hObject=0x220) returned 1
	[0107.074] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x54
	[0107.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0107.075] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0107.075] GetFileType (hFile=0x220) returned 0x1
	[0107.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0107.076] GetFileType (hFile=0x220) returned 0x1
	[0107.076] WriteFile (in: hFile=0x220, lpBuffer=0x272bd98*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x272bd98*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0107.088] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0107.089] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\decrypt.txt")) returned 1
	[0107.092] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.092] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0107.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0107.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0107.092] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0107.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0107.093] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0107.093] GetFileType (hFile=0x208) returned 0x1
	[0107.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0107.094] GetFileType (hFile=0x208) returned 0x1
	[0107.094] WriteFile (in: hFile=0x208, lpBuffer=0x272e4ec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x272e4ec*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0107.097] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5345b30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5345b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf536bc90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.098] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf531f9d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf531f9d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf531f9d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat.KEKW", cAlternateFileName="TOKENS~1.KEK")) returned 1
	[0107.099] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf531f9d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf531f9d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf531f9d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat.KEKW", cAlternateFileName="TOKENS~1.KEK")) returned 0
	[0107.099] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0107.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0107.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0107.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0107.100] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x3d
	[0107.100] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3e
	[0107.100] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf5345b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5345b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0107.101] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf5345b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5345b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.101] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10c62810, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10c62810, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0107.102] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5345b30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5345b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf536bc90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.102] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0107.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0107.102] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0107.103] GetFileType (hFile=0x208) returned 0x1
	[0107.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0107.103] GetFileType (hFile=0x208) returned 0x1
	[0107.103] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0107.103] ReadFile (in: hFile=0x208, lpBuffer=0x27308e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27308e0*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0107.106] CloseHandle (hObject=0x208) returned 1
	[0107.106] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x4e
	[0107.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0107.107] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0107.113] GetFileType (hFile=0x208) returned 0x1
	[0107.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0107.114] GetFileType (hFile=0x208) returned 0x1
	[0107.114] WriteFile (in: hFile=0x208, lpBuffer=0x2732ff8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2732ff8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0107.118] CloseHandle (hObject=0x208) returned 1
	[0107.118] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0107.119] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\decrypt.txt")) returned 1
	[0107.125] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf531f9d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf531f9d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf531f9d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat.KEKW", cAlternateFileName="TOKENS~1.KEK")) returned 1
	[0107.126] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.126] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0107.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0107.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0107.127] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0107.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0107.127] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0107.128] GetFileType (hFile=0x204) returned 0x1
	[0107.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0107.130] GetFileType (hFile=0x204) returned 0x1
	[0107.130] WriteFile (in: hFile=0x204, lpBuffer=0x2735b60*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2735b60*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0107.134] CloseHandle (hObject=0x204) returned 1
	[0107.135] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf542a370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf542a370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1
	[0107.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0107.135] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC", lpFilePart=0x0) returned 0x20
	[0107.136] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x21
	[0107.136] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf542a370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf542a370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0107.137] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf542a370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf542a370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.137] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf542a370, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf542a370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf542a370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.138] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf536bc90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf536bc90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outbound", cAlternateFileName="")) returned 1
	[0107.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0107.138] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x29
	[0107.138] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x2a
	[0107.139] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf536bc90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf536bc90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0107.140] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf536bc90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf536bc90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.140] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf536bc90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf536bc90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf536bc90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.141] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf536bc90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf536bc90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf536bc90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0107.141] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0107.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0107.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0107.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0107.142] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x29
	[0107.142] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x2a
	[0107.143] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf536bc90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf536bc90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0107.144] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf536bc90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf536bc90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.147] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf536bc90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf536bc90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf536bc90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.148] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0107.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0107.148] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0107.148] GetFileType (hFile=0x220) returned 0x1
	[0107.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0107.149] GetFileType (hFile=0x220) returned 0x1
	[0107.149] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0107.150] ReadFile (in: hFile=0x220, lpBuffer=0x273898c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x273898c*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0107.153] CloseHandle (hObject=0x220) returned 1
	[0107.153] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3a
	[0107.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0107.153] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0107.154] GetFileType (hFile=0x220) returned 0x1
	[0107.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0107.154] GetFileType (hFile=0x220) returned 0x1
	[0107.155] WriteFile (in: hFile=0x220, lpBuffer=0x273b054*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x273b054*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0107.157] CloseHandle (hObject=0x220) returned 1
	[0107.158] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0107.158] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\decrypt.txt")) returned 1
	[0107.161] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.162] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0107.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0107.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0107.162] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Decrypt.txt", lpFilePart=0x0) returned 0x35
	[0107.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0107.162] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0107.163] GetFileType (hFile=0x208) returned 0x1
	[0107.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0107.163] GetFileType (hFile=0x208) returned 0x1
	[0107.164] WriteFile (in: hFile=0x208, lpBuffer=0x273d70c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x273d70c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0107.168] CloseHandle (hObject=0x208) returned 1
	[0107.168] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5391df0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5391df0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1
	[0107.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0107.169] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2e
	[0107.169] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2f
	[0107.169] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5391df0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5391df0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0107.170] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5391df0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5391df0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.170] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5391df0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5391df0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5391df0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.171] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed673990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 1
	[0107.172] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed673990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0
	[0107.172] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0107.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0107.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0107.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0107.173] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2e
	[0107.173] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2f
	[0107.173] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5391df0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5391df0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0107.174] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5391df0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5391df0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.176] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5391df0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5391df0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5391df0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.176] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0107.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0107.177] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0107.177] GetFileType (hFile=0x220) returned 0x1
	[0107.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0107.177] GetFileType (hFile=0x220) returned 0x1
	[0107.177] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0107.178] ReadFile (in: hFile=0x220, lpBuffer=0x2740058, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2740058*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0107.181] CloseHandle (hObject=0x220) returned 1
	[0107.181] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3f
	[0107.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0107.181] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0107.187] GetFileType (hFile=0x220) returned 0x1
	[0107.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0107.188] GetFileType (hFile=0x220) returned 0x1
	[0107.188] WriteFile (in: hFile=0x220, lpBuffer=0x2742730*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2742730*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0107.191] CloseHandle (hObject=0x220) returned 1
	[0107.192] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0107.192] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\decrypt.txt")) returned 1
	[0107.195] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xed601570, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xed673990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 1
	[0107.196] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.196] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0107.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0107.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0107.196] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0107.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0107.197] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0107.197] GetFileType (hFile=0x208) returned 0x1
	[0107.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0107.198] GetFileType (hFile=0x208) returned 0x1
	[0107.198] WriteFile (in: hFile=0x208, lpBuffer=0x27451bc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27451bc*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0107.201] CloseHandle (hObject=0x208) returned 1
	[0107.201] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53de0b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf53de0b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1
	[0107.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0107.202] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x2a
	[0107.202] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x2b
	[0107.202] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53de0b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf53de0b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0107.203] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53de0b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf53de0b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.203] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf53de0b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf53de0b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf53de0b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.204] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb35800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xecb35800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xbddb7d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 1
	[0107.204] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 1
	[0107.205] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 0
	[0107.205] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0107.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0107.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0107.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0107.207] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x2a
	[0107.207] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x2b
	[0107.207] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53de0b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf53de0b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0107.208] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53de0b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf53de0b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.208] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf53de0b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf53de0b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf53de0b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.208] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0107.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0107.209] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0107.209] GetFileType (hFile=0x220) returned 0x1
	[0107.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0107.209] GetFileType (hFile=0x220) returned 0x1
	[0107.209] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0107.210] ReadFile (in: hFile=0x220, lpBuffer=0x2747b28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2747b28*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0107.213] CloseHandle (hObject=0x220) returned 1
	[0107.213] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3b
	[0107.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0107.213] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0107.214] GetFileType (hFile=0x220) returned 0x1
	[0107.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0107.214] GetFileType (hFile=0x220) returned 0x1
	[0107.214] WriteFile (in: hFile=0x220, lpBuffer=0x274a1f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x274a1f0*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0107.217] CloseHandle (hObject=0x220) returned 1
	[0107.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0107.218] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\decrypt.txt")) returned 1
	[0107.221] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb35800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xecb35800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xbddb7d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 1
	[0107.226] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 1
	[0107.227] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat", lpFilePart=0x0) returned 0x3a
	[0107.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0107.227] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0107.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc08) returned 1
	[0107.231] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.232] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0107.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0107.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0107.232] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0107.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0107.232] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0107.233] GetFileType (hFile=0x208) returned 0x1
	[0107.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0107.233] GetFileType (hFile=0x208) returned 0x1
	[0107.234] WriteFile (in: hFile=0x208, lpBuffer=0x274d5e0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x274d5e0*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0107.237] CloseHandle (hObject=0x208) returned 1
	[0107.237] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5404210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5404210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0107.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0107.238] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x25
	[0107.238] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x26
	[0107.238] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5404210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5404210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0107.239] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5404210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5404210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.240] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5404210, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5404210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5404210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.240] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeedcf170, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xeedcf170, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xeef72090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlD9E9.tmp", cAlternateFileName="")) returned 1
	[0107.241] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef0eee50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xef0eee50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xef0eee50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlDB32.tmp", cAlternateFileName="")) returned 1
	[0107.241] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef0eee50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xef0eee50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xef0eee50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlDB32.tmp", cAlternateFileName="")) returned 0
	[0107.242] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0107.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0107.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0107.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0107.242] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x25
	[0107.242] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x26
	[0107.243] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5404210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5404210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0107.243] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf5404210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5404210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.244] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5404210, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5404210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5404210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.245] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0107.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0107.245] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0107.245] GetFileType (hFile=0x220) returned 0x1
	[0107.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0107.245] GetFileType (hFile=0x220) returned 0x1
	[0107.245] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0107.246] ReadFile (in: hFile=0x220, lpBuffer=0x274fcb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x274fcb8*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0107.248] CloseHandle (hObject=0x220) returned 1
	[0107.249] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x36
	[0107.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0107.249] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0107.249] GetFileType (hFile=0x220) returned 0x1
	[0107.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0107.250] GetFileType (hFile=0x220) returned 0x1
	[0107.250] WriteFile (in: hFile=0x220, lpBuffer=0x2752370*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2752370*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0107.253] CloseHandle (hObject=0x220) returned 1
	[0107.253] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0107.253] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\decrypt.txt")) returned 1
	[0107.257] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeedcf170, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xeedcf170, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xeef72090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlD9E9.tmp", cAlternateFileName="")) returned 1
	[0107.257] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef0eee50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xef0eee50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xef0eee50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlDB32.tmp", cAlternateFileName="")) returned 1
	[0107.258] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.258] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0107.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0107.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0107.259] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0107.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0107.259] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0107.260] GetFileType (hFile=0x208) returned 0x1
	[0107.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0107.260] GetFileType (hFile=0x208) returned 0x1
	[0107.260] WriteFile (in: hFile=0x208, lpBuffer=0x2754fc0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2754fc0*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0107.264] CloseHandle (hObject=0x208) returned 1
	[0107.264] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.265] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0107.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0107.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0107.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0107.265] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC", lpFilePart=0x0) returned 0x20
	[0107.266] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x21
	[0107.266] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf542a370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf542a370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0107.266] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf542a370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf542a370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.267] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf542a370, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf542a370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf542a370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.267] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0107.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0107.268] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0107.268] GetFileType (hFile=0x208) returned 0x1
	[0107.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0107.268] GetFileType (hFile=0x208) returned 0x1
	[0107.273] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0107.273] ReadFile (in: hFile=0x208, lpBuffer=0x2756aa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2756aa0*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0107.276] CloseHandle (hObject=0x208) returned 1
	[0107.276] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x31
	[0107.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0107.276] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\rac\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0107.277] GetFileType (hFile=0x208) returned 0x1
	[0107.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0107.277] GetFileType (hFile=0x208) returned 0x1
	[0107.278] WriteFile (in: hFile=0x208, lpBuffer=0x2759140*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2759140*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0107.281] CloseHandle (hObject=0x208) returned 1
	[0107.281] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0107.282] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\decrypt.txt")) returned 1
	[0107.285] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10d20ef0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10d20ef0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outbound", cAlternateFileName="")) returned 1
	[0107.286] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10d6d1b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10d6d1b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1
	[0107.286] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10db9470, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10db9470, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1
	[0107.287] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10e05730, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10e05730, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0107.287] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10e05730, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10e05730, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0107.288] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0107.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0107.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0107.288] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0107.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0107.288] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\rac\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0107.289] GetFileType (hFile=0x204) returned 0x1
	[0107.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0107.289] GetFileType (hFile=0x204) returned 0x1
	[0107.289] WriteFile (in: hFile=0x204, lpBuffer=0x275bc00*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x275bc00*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0107.293] CloseHandle (hObject=0x204) returned 1
	[0107.293] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf568b970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf568b970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1
	[0107.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0107.294] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search", lpFilePart=0x0) returned 0x23
	[0107.294] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x24
	[0107.294] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf568b970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf568b970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0107.294] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf568b970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf568b970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.295] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0107.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0107.295] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x28
	[0107.296] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", lpFilePart=0x0) returned 0x29
	[0107.296] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0107.296] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.297] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1
	[0107.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0107.297] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x35
	[0107.298] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", lpFilePart=0x0) returned 0x36
	[0107.298] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0107.299] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.299] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5619550, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf563f6b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.300] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0107.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0107.300] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows", lpFilePart=0x0) returned 0x3d
	[0107.301] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\", lpFilePart=0x0) returned 0x3e
	[0107.301] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0107.301] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.302] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf549c790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf549c790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config", cAlternateFileName="")) returned 1
	[0107.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0107.302] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config", lpFilePart=0x0) returned 0x44
	[0107.302] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\", lpFilePart=0x0) returned 0x45
	[0107.303] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf549c790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf549c790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0107.303] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf549c790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf549c790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.304] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf549c790, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf549c790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf549c790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.305] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf549c790, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf549c790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf549c790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0107.305] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0107.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0107.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0107.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0107.306] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config", lpFilePart=0x0) returned 0x44
	[0107.306] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\", lpFilePart=0x0) returned 0x45
	[0107.306] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf549c790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf549c790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0107.307] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf549c790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf549c790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.307] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf549c790, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf549c790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf549c790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.307] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0107.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0107.308] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\config\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0107.308] GetFileType (hFile=0x22c) returned 0x1
	[0107.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0107.308] GetFileType (hFile=0x22c) returned 0x1
	[0107.308] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xa5
	[0107.309] ReadFile (in: hFile=0x22c, lpBuffer=0x2760f74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x2760f74*, lpNumberOfBytesRead=0x26eca4*=0xa5, lpOverlapped=0x0) returned 1
	[0107.311] CloseHandle (hObject=0x22c) returned 1
	[0107.311] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x55
	[0107.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0107.312] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\config\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0107.313] GetFileType (hFile=0x22c) returned 0x1
	[0107.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0107.313] GetFileType (hFile=0x22c) returned 0x1
	[0107.313] WriteFile (in: hFile=0x22c, lpBuffer=0x27636a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27636a4*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0107.318] CloseHandle (hObject=0x22c) returned 1
	[0107.318] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0107.318] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\config\\decrypt.txt")) returned 1
	[0107.322] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.322] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0107.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0107.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0107.322] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0107.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0107.323] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\config\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0107.323] GetFileType (hFile=0x228) returned 0x1
	[0107.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0107.324] GetFileType (hFile=0x228) returned 0x1
	[0107.324] WriteFile (in: hFile=0x228, lpBuffer=0x2765e04*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2765e04*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0107.327] CloseHandle (hObject=0x228) returned 1
	[0107.328] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5619550, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.328] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54e8a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54e8a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherLogs", cAlternateFileName="GATHER~1")) returned 1
	[0107.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0107.329] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs", lpFilePart=0x0) returned 0x48
	[0107.329] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\", lpFilePart=0x0) returned 0x49
	[0107.329] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54e8a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54e8a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0107.330] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54e8a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54e8a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.331] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf54e8a50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf54e8a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54e8a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.332] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54c28f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54c28f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1
	[0107.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0107.332] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex", lpFilePart=0x0) returned 0x54
	[0107.332] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\", lpFilePart=0x0) returned 0x55
	[0107.333] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54c28f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54c28f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0107.333] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54c28f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54c28f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.334] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf54c28f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf54c28f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54c28f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.335] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.Crwl", cAlternateFileName="SYSTEM~1.CRW")) returned 1
	[0107.335] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 1
	[0107.336] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 0
	[0107.336] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0107.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0107.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0107.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0107.337] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex", lpFilePart=0x0) returned 0x54
	[0107.337] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\", lpFilePart=0x0) returned 0x55
	[0107.337] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54c28f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54c28f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0107.338] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54c28f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54c28f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.338] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf54c28f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf54c28f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54c28f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.339] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0107.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb50) returned 1
	[0107.339] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0107.339] GetFileType (hFile=0x230) returned 0x1
	[0107.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb4c) returned 1
	[0107.340] GetFileType (hFile=0x230) returned 0x1
	[0107.340] GetFileSize (in: hFile=0x230, lpFileSizeHigh=0x26ec58 | out: lpFileSizeHigh=0x26ec58*=0x0) returned 0xa5
	[0107.340] ReadFile (in: hFile=0x230, lpBuffer=0x276a410, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ec04, lpOverlapped=0x0 | out: lpBuffer=0x276a410*, lpNumberOfBytesRead=0x26ec04*=0xa5, lpOverlapped=0x0) returned 1
	[0107.343] CloseHandle (hObject=0x230) returned 1
	[0107.343] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x65
	[0107.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb84) returned 1
	[0107.343] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0107.344] GetFileType (hFile=0x230) returned 0x1
	[0107.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb80) returned 1
	[0107.344] GetFileType (hFile=0x230) returned 0x1
	[0107.345] WriteFile (in: hFile=0x230, lpBuffer=0x276cb80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eba8, lpOverlapped=0x0 | out: lpBuffer=0x276cb80*, lpNumberOfBytesWritten=0x26eba8*=0x10, lpOverlapped=0x0) returned 1
	[0107.348] CloseHandle (hObject=0x230) returned 1
	[0107.348] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0107.349] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\decrypt.txt")) returned 1
	[0107.352] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.Crwl", cAlternateFileName="SYSTEM~1.CRW")) returned 1
	[0107.352] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 1
	[0107.353] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.353] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0107.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0107.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0107.354] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt", lpFilePart=0x0) returned 0x60
	[0107.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0107.354] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0107.354] GetFileType (hFile=0x22c) returned 0x1
	[0107.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0107.355] GetFileType (hFile=0x22c) returned 0x1
	[0107.355] WriteFile (in: hFile=0x22c, lpBuffer=0x276fdc8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x276fdc8*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0107.358] CloseHandle (hObject=0x22c) returned 1
	[0107.359] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.359] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0107.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0107.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0107.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0107.360] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs", lpFilePart=0x0) returned 0x48
	[0107.360] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\", lpFilePart=0x0) returned 0x49
	[0107.360] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54e8a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54e8a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0107.361] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf54e8a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54e8a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.361] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf54e8a50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf54e8a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf54e8a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.362] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0107.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0107.369] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0107.371] GetFileType (hFile=0x22c) returned 0x1
	[0107.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0107.371] GetFileType (hFile=0x22c) returned 0x1
	[0107.371] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xa5
	[0107.371] ReadFile (in: hFile=0x22c, lpBuffer=0x2771e98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x2771e98*, lpNumberOfBytesRead=0x26eca4*=0xa5, lpOverlapped=0x0) returned 1
	[0107.374] CloseHandle (hObject=0x22c) returned 1
	[0107.375] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x59
	[0107.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0107.375] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0107.376] GetFileType (hFile=0x22c) returned 0x1
	[0107.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0107.376] GetFileType (hFile=0x22c) returned 0x1
	[0107.377] WriteFile (in: hFile=0x22c, lpBuffer=0x27745d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27745d8*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0107.380] CloseHandle (hObject=0x22c) returned 1
	[0107.380] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0107.380] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\decrypt.txt")) returned 1
	[0107.384] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x10ee9f70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10ee9f70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1
	[0107.384] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x10ee9f70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10ee9f70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0
	[0107.385] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0107.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0107.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0107.385] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0107.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0107.386] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0107.386] GetFileType (hFile=0x228) returned 0x1
	[0107.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0107.387] GetFileType (hFile=0x228) returned 0x1
	[0107.387] WriteFile (in: hFile=0x228, lpBuffer=0x2776f5c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2776f5c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0107.390] CloseHandle (hObject=0x228) returned 1
	[0107.390] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.chk", cAlternateFileName="")) returned 1
	[0107.391] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295a0600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295a0600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.log", cAlternateFileName="")) returned 1
	[0107.391] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295c6760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295c6760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00001.jrs", cAlternateFileName="MSSRES~1.JRS")) returned 1
	[0107.392] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295ec8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295ec8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00002.jrs", cAlternateFileName="MSSRES~2.JRS")) returned 1
	[0107.393] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects", cAlternateFileName="")) returned 1
	[0107.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0107.394] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects", lpFilePart=0x0) returned 0x46
	[0107.395] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\", lpFilePart=0x0) returned 0x47
	[0107.395] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0107.396] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.396] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf55f33f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.397] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1
	[0107.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0107.397] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex", lpFilePart=0x0) returned 0x52
	[0107.397] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\", lpFilePart=0x0) returned 0x53
	[0107.397] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0107.398] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.399] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf55f33f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.399] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5580fd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5580fd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexer", cAlternateFileName="")) returned 1
	[0107.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0107.400] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer", lpFilePart=0x0) returned 0x5a
	[0107.400] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\", lpFilePart=0x0) returned 0x5b
	[0107.400] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5580fd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5580fd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0107.401] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5580fd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5580fd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.401] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf555ae70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf555ae70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiFiles", cAlternateFileName="")) returned 1
	[0107.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0107.402] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles", lpFilePart=0x0) returned 0x62
	[0107.402] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\", lpFilePart=0x0) returned 0x63
	[0107.402] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf555ae70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf555ae70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0107.403] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf555ae70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf555ae70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.403] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299f0de0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299f0de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.000", cAlternateFileName="")) returned 1
	[0107.404] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.001", cAlternateFileName="")) returned 1
	[0107.404] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.002", cAlternateFileName="")) returned 1
	[0107.405] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.000", cAlternateFileName="")) returned 1
	[0107.405] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.001", cAlternateFileName="")) returned 1
	[0107.406] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.002", cAlternateFileName="")) returned 1
	[0107.406] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299f0de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.000", cAlternateFileName="")) returned 1
	[0107.407] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.001", cAlternateFileName="")) returned 1
	[0107.407] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.002", cAlternateFileName="")) returned 1
	[0107.408] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf555ae70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf555ae70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf555ae70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.409] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.000", cAlternateFileName="")) returned 1
	[0107.410] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.001", cAlternateFileName="")) returned 1
	[0107.410] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.002", cAlternateFileName="")) returned 1
	[0107.411] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 1
	[0107.411] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 0
	[0107.412] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0107.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0107.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0107.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0107.412] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles", nBufferLength=0x105, lpBuffer=0x26e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles", lpFilePart=0x0) returned 0x62
	[0107.413] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\", nBufferLength=0x105, lpBuffer=0x26e638, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\", lpFilePart=0x0) returned 0x63
	[0107.413] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*", lpFindFileData=0x26e884 | out: lpFindFileData=0x26e884*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf555ae70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf555ae70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5df0
	[0107.413] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf555ae70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf555ae70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.414] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299f0de0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299f0de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.000", cAlternateFileName="")) returned 1
	[0107.414] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.001", cAlternateFileName="")) returned 1
	[0107.415] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.002", cAlternateFileName="")) returned 1
	[0107.415] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.000", cAlternateFileName="")) returned 1
	[0107.415] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.001", cAlternateFileName="")) returned 1
	[0107.416] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.002", cAlternateFileName="")) returned 1
	[0107.416] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299f0de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.000", cAlternateFileName="")) returned 1
	[0107.416] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.001", cAlternateFileName="")) returned 1
	[0107.417] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.002", cAlternateFileName="")) returned 1
	[0107.417] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf555ae70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf555ae70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf555ae70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.418] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0107.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea10) returned 1
	[0107.418] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x218
	[0107.418] GetFileType (hFile=0x218) returned 0x1
	[0107.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea0c) returned 1
	[0107.418] GetFileType (hFile=0x218) returned 0x1
	[0107.419] GetFileSize (in: hFile=0x218, lpFileSizeHigh=0x26eb18 | out: lpFileSizeHigh=0x26eb18*=0x0) returned 0xa5
	[0107.419] ReadFile (in: hFile=0x218, lpBuffer=0x27820b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eac4, lpOverlapped=0x0 | out: lpBuffer=0x27820b0*, lpNumberOfBytesRead=0x26eac4*=0xa5, lpOverlapped=0x0) returned 1
	[0107.422] CloseHandle (hObject=0x218) returned 1
	[0107.422] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x73
	[0107.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea44) returned 1
	[0107.422] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x218
	[0107.423] GetFileType (hFile=0x218) returned 0x1
	[0107.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea40) returned 1
	[0107.423] GetFileType (hFile=0x218) returned 0x1
	[0107.423] WriteFile (in: hFile=0x218, lpBuffer=0x2784858*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ea68, lpOverlapped=0x0 | out: lpBuffer=0x2784858*, lpNumberOfBytesWritten=0x26ea68*=0x10, lpOverlapped=0x0) returned 1
	[0107.427] CloseHandle (hObject=0x218) returned 1
	[0107.427] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0107.427] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\decrypt.txt")) returned 1
	[0107.430] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.000", cAlternateFileName="")) returned 1
	[0107.431] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.001", cAlternateFileName="")) returned 1
	[0107.431] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.002", cAlternateFileName="")) returned 1
	[0107.431] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 1
	[0107.432] FindNextFileW (in: hFindFile=0x5f5df0, lpFindFileData=0x26e8dc | out: lpFindFileData=0x26e8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.432] FindClose (in: hFindFile=0x5f5df0 | out: hFindFile=0x5f5df0) returned 1
	[0107.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb64) returned 1
	[0107.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb70) returned 1
	[0107.432] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt", lpFilePart=0x0) returned 0x6e
	[0107.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea1c) returned 1
	[0107.433] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x234
	[0107.590] GetFileType (hFile=0x234) returned 0x1
	[0107.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ea18) returned 1
	[0107.591] GetFileType (hFile=0x234) returned 0x1
	[0107.591] WriteFile (in: hFile=0x234, lpBuffer=0x278852c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eab4, lpOverlapped=0x0 | out: lpBuffer=0x278852c*, lpNumberOfBytesWritten=0x26eab4*=0xa5, lpOverlapped=0x0) returned 1
	[0107.594] CloseHandle (hObject=0x234) returned 1
	[0107.595] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5580fd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5580fd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5580fd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.595] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5580fd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5580fd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5580fd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0107.596] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0107.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0107.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0107.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0107.597] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer", lpFilePart=0x0) returned 0x5a
	[0107.597] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\", lpFilePart=0x0) returned 0x5b
	[0107.597] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5580fd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5580fd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0107.598] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5580fd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5580fd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.599] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x11125410, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11125410, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiFiles", cAlternateFileName="")) returned 1
	[0107.599] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5580fd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5580fd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5580fd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.599] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0107.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0107.600] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0107.600] GetFileType (hFile=0x234) returned 0x1
	[0107.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0107.600] GetFileType (hFile=0x234) returned 0x1
	[0107.601] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xa5
	[0107.601] ReadFile (in: hFile=0x234, lpBuffer=0x278ac94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x278ac94*, lpNumberOfBytesRead=0x26eb64*=0xa5, lpOverlapped=0x0) returned 1
	[0107.603] CloseHandle (hObject=0x234) returned 1
	[0107.604] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6b
	[0107.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0107.604] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0107.605] GetFileType (hFile=0x234) returned 0x1
	[0107.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0107.605] GetFileType (hFile=0x234) returned 0x1
	[0107.605] WriteFile (in: hFile=0x234, lpBuffer=0x278d41c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x278d41c*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0107.609] CloseHandle (hObject=0x234) returned 1
	[0107.609] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0107.609] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\decrypt.txt")) returned 1
	[0107.613] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.613] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0107.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0107.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0107.613] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0107.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0107.614] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0107.614] GetFileType (hFile=0x230) returned 0x1
	[0107.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0107.614] GetFileType (hFile=0x230) returned 0x1
	[0107.615] WriteFile (in: hFile=0x230, lpBuffer=0x278fc00*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x278fc00*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0107.618] CloseHandle (hObject=0x230) returned 1
	[0107.618] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55a7130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55a7130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PropMap", cAlternateFileName="")) returned 1
	[0107.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0107.619] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap", lpFilePart=0x0) returned 0x5a
	[0107.619] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\", lpFilePart=0x0) returned 0x5b
	[0107.619] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55a7130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55a7130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0107.620] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55a7130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55a7130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.620] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.000", cAlternateFileName="")) returned 1
	[0107.621] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.001", cAlternateFileName="")) returned 1
	[0107.621] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.002", cAlternateFileName="")) returned 1
	[0107.622] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf55a7130, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf55a7130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55a7130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.623] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf55a7130, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf55a7130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55a7130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0107.623] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0107.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0107.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0107.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0107.623] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap", lpFilePart=0x0) returned 0x5a
	[0107.624] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\", lpFilePart=0x0) returned 0x5b
	[0107.624] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55a7130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55a7130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0107.624] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55a7130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55a7130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.625] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.000", cAlternateFileName="")) returned 1
	[0107.625] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.001", cAlternateFileName="")) returned 1
	[0107.626] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiPT0000.002", cAlternateFileName="")) returned 1
	[0107.626] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf55a7130, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf55a7130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55a7130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.627] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0107.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0107.675] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0107.675] GetFileType (hFile=0x234) returned 0x1
	[0107.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0107.675] GetFileType (hFile=0x234) returned 0x1
	[0107.676] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xa5
	[0107.676] ReadFile (in: hFile=0x234, lpBuffer=0x279447c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x279447c*, lpNumberOfBytesRead=0x26eb64*=0xa5, lpOverlapped=0x0) returned 1
	[0107.731] CloseHandle (hObject=0x234) returned 1
	[0107.731] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6b
	[0107.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0107.731] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0107.733] GetFileType (hFile=0x234) returned 0x1
	[0107.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0107.733] GetFileType (hFile=0x234) returned 0x1
	[0107.733] WriteFile (in: hFile=0x234, lpBuffer=0x2796c04*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x2796c04*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0107.737] CloseHandle (hObject=0x234) returned 1
	[0107.737] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0107.737] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\decrypt.txt")) returned 1
	[0107.740] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.741] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0107.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0107.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0107.741] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt", lpFilePart=0x0) returned 0x66
	[0107.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0107.741] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0107.742] GetFileType (hFile=0x230) returned 0x1
	[0107.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0107.742] GetFileType (hFile=0x230) returned 0x1
	[0107.743] WriteFile (in: hFile=0x230, lpBuffer=0x27993e8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x27993e8*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0107.746] CloseHandle (hObject=0x230) returned 1
	[0107.746] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55cd290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55cd290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecStore", cAlternateFileName="")) returned 1
	[0107.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0107.746] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore", lpFilePart=0x0) returned 0x5b
	[0107.747] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\", lpFilePart=0x0) returned 0x5c
	[0107.747] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55cd290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55cd290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0107.748] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55cd290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55cd290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.748] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.000", cAlternateFileName="")) returned 1
	[0107.749] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.001", cAlternateFileName="")) returned 1
	[0107.749] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.002", cAlternateFileName="")) returned 1
	[0107.750] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf55cd290, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf55cd290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55cd290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.750] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf55cd290, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf55cd290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55cd290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0107.751] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0107.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0107.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0107.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0107.751] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore", lpFilePart=0x0) returned 0x5b
	[0107.751] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\", lpFilePart=0x0) returned 0x5c
	[0107.752] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55cd290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55cd290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0107.753] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55cd290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55cd290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.754] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.000", cAlternateFileName="")) returned 1
	[0107.754] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.001", cAlternateFileName="")) returned 1
	[0107.754] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiST0000.002", cAlternateFileName="")) returned 1
	[0107.755] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf55cd290, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf55cd290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55cd290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.755] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0107.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab0) returned 1
	[0107.756] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0107.756] GetFileType (hFile=0x234) returned 0x1
	[0107.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eaac) returned 1
	[0107.756] GetFileType (hFile=0x234) returned 0x1
	[0107.756] GetFileSize (in: hFile=0x234, lpFileSizeHigh=0x26ebb8 | out: lpFileSizeHigh=0x26ebb8*=0x0) returned 0xa5
	[0107.756] ReadFile (in: hFile=0x234, lpBuffer=0x279dcd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eb64, lpOverlapped=0x0 | out: lpBuffer=0x279dcd4*, lpNumberOfBytesRead=0x26eb64*=0xa5, lpOverlapped=0x0) returned 1
	[0107.759] CloseHandle (hObject=0x234) returned 1
	[0107.760] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6c
	[0107.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae4) returned 1
	[0107.760] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x234
	[0107.760] GetFileType (hFile=0x234) returned 0x1
	[0107.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eae0) returned 1
	[0107.761] GetFileType (hFile=0x234) returned 0x1
	[0107.761] WriteFile (in: hFile=0x234, lpBuffer=0x27a0464*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eb08, lpOverlapped=0x0 | out: lpBuffer=0x27a0464*, lpNumberOfBytesWritten=0x26eb08*=0x10, lpOverlapped=0x0) returned 1
	[0107.765] CloseHandle (hObject=0x234) returned 1
	[0107.765] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0107.765] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\decrypt.txt")) returned 1
	[0107.770] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.770] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0107.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0107.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0107.771] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0107.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0107.771] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0107.772] GetFileType (hFile=0x230) returned 0x1
	[0107.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0107.772] GetFileType (hFile=0x230) returned 0x1
	[0107.772] WriteFile (in: hFile=0x230, lpBuffer=0x27a2c48*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x27a2c48*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0107.776] CloseHandle (hObject=0x230) returned 1
	[0107.776] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.776] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0107.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0107.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0107.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0107.777] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex", lpFilePart=0x0) returned 0x52
	[0107.777] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\", lpFilePart=0x0) returned 0x53
	[0107.777] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0107.778] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.779] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf55f33f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.779] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0107.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb50) returned 1
	[0107.779] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0107.780] GetFileType (hFile=0x230) returned 0x1
	[0107.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb4c) returned 1
	[0107.780] GetFileType (hFile=0x230) returned 0x1
	[0107.780] GetFileSize (in: hFile=0x230, lpFileSizeHigh=0x26ec58 | out: lpFileSizeHigh=0x26ec58*=0x0) returned 0xa5
	[0107.780] ReadFile (in: hFile=0x230, lpBuffer=0x27a4e94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ec04, lpOverlapped=0x0 | out: lpBuffer=0x27a4e94*, lpNumberOfBytesRead=0x26ec04*=0xa5, lpOverlapped=0x0) returned 1
	[0107.783] CloseHandle (hObject=0x230) returned 1
	[0107.783] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x63
	[0107.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb84) returned 1
	[0107.783] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x230
	[0107.788] GetFileType (hFile=0x230) returned 0x1
	[0107.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb80) returned 1
	[0107.789] GetFileType (hFile=0x230) returned 0x1
	[0107.789] WriteFile (in: hFile=0x230, lpBuffer=0x27a75fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eba8, lpOverlapped=0x0 | out: lpBuffer=0x27a75fc*, lpNumberOfBytesWritten=0x26eba8*=0x10, lpOverlapped=0x0) returned 1
	[0107.792] CloseHandle (hObject=0x230) returned 1
	[0107.793] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e77c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0107.793] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\decrypt.txt")) returned 1
	[0107.796] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x111716d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x111716d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexer", cAlternateFileName="")) returned 1
	[0107.797] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x112a21d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x112a21d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PropMap", cAlternateFileName="")) returned 1
	[0107.797] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x112ee490, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x112ee490, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecStore", cAlternateFileName="")) returned 1
	[0107.798] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x112ee490, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x112ee490, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecStore", cAlternateFileName="")) returned 0
	[0107.798] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0107.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0107.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0107.798] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0107.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0107.799] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0107.799] GetFileType (hFile=0x22c) returned 0x1
	[0107.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0107.800] GetFileType (hFile=0x22c) returned 0x1
	[0107.800] WriteFile (in: hFile=0x22c, lpBuffer=0x27aa2fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x27aa2fc*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0107.803] CloseHandle (hObject=0x22c) returned 1
	[0107.804] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.804] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0107.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0107.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0107.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0107.805] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects", lpFilePart=0x0) returned 0x46
	[0107.805] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\", lpFilePart=0x0) returned 0x47
	[0107.805] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0107.806] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf55f33f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.806] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf55f33f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf55f33f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.807] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0107.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0107.807] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0107.807] GetFileType (hFile=0x22c) returned 0x1
	[0107.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0107.808] GetFileType (hFile=0x22c) returned 0x1
	[0107.808] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xa5
	[0107.808] ReadFile (in: hFile=0x22c, lpBuffer=0x27ac380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x27ac380*, lpNumberOfBytesRead=0x26eca4*=0xa5, lpOverlapped=0x0) returned 1
	[0107.811] CloseHandle (hObject=0x22c) returned 1
	[0107.811] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x57
	[0107.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0107.812] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0107.812] GetFileType (hFile=0x22c) returned 0x1
	[0107.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0107.812] GetFileType (hFile=0x22c) returned 0x1
	[0107.813] WriteFile (in: hFile=0x22c, lpBuffer=0x27aeab8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x27aeab8*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0107.817] CloseHandle (hObject=0x22c) returned 1
	[0107.817] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0107.817] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\decrypt.txt")) returned 1
	[0107.821] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1133a750, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1133a750, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1
	[0107.821] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1133a750, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1133a750, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0
	[0107.822] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0107.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0107.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0107.822] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0107.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0107.822] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0107.823] GetFileType (hFile=0x228) returned 0x1
	[0107.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0107.823] GetFileType (hFile=0x228) returned 0x1
	[0107.824] WriteFile (in: hFile=0x228, lpBuffer=0x27b1428*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27b1428*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0107.827] CloseHandle (hObject=0x228) returned 1
	[0107.827] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.edb", cAlternateFileName="")) returned 1
	[0107.828] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.edb", cAlternateFileName="")) returned 0
	[0107.828] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0107.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0107.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0107.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0107.829] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows", lpFilePart=0x0) returned 0x3d
	[0107.829] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\", lpFilePart=0x0) returned 0x3e
	[0107.829] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0107.830] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0107.831] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x10e9dcb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10e9dcb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config", cAlternateFileName="")) returned 1
	[0107.839] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5619550, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0107.839] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0107.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0107.840] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0107.841] GetFileType (hFile=0x228) returned 0x1
	[0107.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0107.841] GetFileType (hFile=0x228) returned 0x1
	[0107.841] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0107.841] ReadFile (in: hFile=0x228, lpBuffer=0x27b3640, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x27b3640*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0107.844] CloseHandle (hObject=0x228) returned 1
	[0107.844] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x4e
	[0107.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0107.845] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0107.846] GetFileType (hFile=0x228) returned 0x1
	[0107.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0107.846] GetFileType (hFile=0x228) returned 0x1
	[0107.847] WriteFile (in: hFile=0x228, lpBuffer=0x27b5d58*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x27b5d58*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0107.849] CloseHandle (hObject=0x228) returned 1
	[0107.850] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0107.850] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\decrypt.txt")) returned 1
	[0107.853] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x10f36230, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10f36230, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherLogs", cAlternateFileName="GATHER~1")) returned 1
	[0107.854] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.chk", cAlternateFileName="")) returned 1
	[0107.854] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295a0600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295a0600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.log", cAlternateFileName="")) returned 1
	[0107.855] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295c6760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295c6760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00001.jrs", cAlternateFileName="MSSRES~1.JRS")) returned 1
	[0107.855] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295ec8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295ec8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00002.jrs", cAlternateFileName="MSSRES~2.JRS")) returned 1
	[0107.856] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x113608b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x113608b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects", cAlternateFileName="")) returned 1
	[0107.856] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.edb", cAlternateFileName="")) returned 1
	[0107.856] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0107.857] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0107.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0107.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0107.857] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0107.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0107.857] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0107.858] GetFileType (hFile=0x224) returned 0x1
	[0107.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0107.858] GetFileType (hFile=0x224) returned 0x1
	[0107.859] WriteFile (in: hFile=0x224, lpBuffer=0x27b9ac4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27b9ac4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0108.077] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0108.077] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0108.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0108.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0108.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0108.077] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x35
	[0108.077] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", lpFilePart=0x0) returned 0x36
	[0108.078] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0108.078] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5619550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.079] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5619550, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5619550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf563f6b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.080] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0108.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0108.080] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0108.080] GetFileType (hFile=0x224) returned 0x1
	[0108.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0108.080] GetFileType (hFile=0x224) returned 0x1
	[0108.081] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0108.081] ReadFile (in: hFile=0x224, lpBuffer=0x27bb8b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27bb8b0*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0108.084] CloseHandle (hObject=0x224) returned 1
	[0108.084] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x46
	[0108.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0108.084] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0108.085] GetFileType (hFile=0x224) returned 0x1
	[0108.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0108.085] GetFileType (hFile=0x224) returned 0x1
	[0108.086] WriteFile (in: hFile=0x224, lpBuffer=0x27bdfa8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27bdfa8*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0108.089] CloseHandle (hObject=0x224) returned 1
	[0108.089] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0108.090] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\decrypt.txt")) returned 1
	[0108.093] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x113acb70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x113acb70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0108.093] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x113acb70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x113acb70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0
	[0108.094] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0108.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0108.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0108.094] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0108.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0108.095] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0108.095] GetFileType (hFile=0x220) returned 0x1
	[0108.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0108.096] GetFileType (hFile=0x220) returned 0x1
	[0108.096] WriteFile (in: hFile=0x220, lpBuffer=0x27c0804*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27c0804*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0108.099] CloseHandle (hObject=0x220) returned 1
	[0108.099] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5665810, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.099] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0108.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0108.100] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x2d
	[0108.100] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2e
	[0108.100] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0108.101] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.101] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5665810, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.102] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5665810, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0108.102] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0108.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0108.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0108.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0108.103] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x2d
	[0108.103] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2e
	[0108.103] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0108.104] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.104] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5665810, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.105] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0108.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0108.105] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0108.105] GetFileType (hFile=0x224) returned 0x1
	[0108.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0108.106] GetFileType (hFile=0x224) returned 0x1
	[0108.106] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0108.106] ReadFile (in: hFile=0x224, lpBuffer=0x27c3014, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27c3014*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0108.109] CloseHandle (hObject=0x224) returned 1
	[0108.109] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3e
	[0108.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0108.109] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0108.110] GetFileType (hFile=0x224) returned 0x1
	[0108.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0108.110] GetFileType (hFile=0x224) returned 0x1
	[0108.112] WriteFile (in: hFile=0x224, lpBuffer=0x27c56ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27c56ec*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0108.115] CloseHandle (hObject=0x224) returned 1
	[0108.116] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0108.116] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\decrypt.txt")) returned 1
	[0108.119] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0108.119] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0108.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0108.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0108.120] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0108.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0108.120] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0108.121] GetFileType (hFile=0x220) returned 0x1
	[0108.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0108.121] GetFileType (hFile=0x220) returned 0x1
	[0108.121] WriteFile (in: hFile=0x220, lpBuffer=0x27c7dbc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27c7dbc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0108.124] CloseHandle (hObject=0x220) returned 1
	[0108.125] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0108.125] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0108.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0108.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0108.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0108.125] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x28
	[0108.126] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", lpFilePart=0x0) returned 0x29
	[0108.126] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0108.127] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.128] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x115e8010, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x115e8010, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1
	[0108.128] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5665810, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5665810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5665810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.129] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0108.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.129] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.130] GetFileType (hFile=0x220) returned 0x1
	[0108.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.130] GetFileType (hFile=0x220) returned 0x1
	[0108.130] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0108.130] ReadFile (in: hFile=0x220, lpBuffer=0x27c9b18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27c9b18*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0108.133] CloseHandle (hObject=0x220) returned 1
	[0108.133] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x39
	[0108.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.134] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.134] GetFileType (hFile=0x220) returned 0x1
	[0108.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0108.135] GetFileType (hFile=0x220) returned 0x1
	[0108.135] WriteFile (in: hFile=0x220, lpBuffer=0x27cc1d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27cc1d8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0108.138] CloseHandle (hObject=0x220) returned 1
	[0108.138] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0108.138] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\decrypt.txt")) returned 1
	[0108.141] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x116342d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x116342d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0108.142] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x116342d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x116342d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0
	[0108.142] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0108.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0108.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0108.143] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0108.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0108.143] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0108.144] GetFileType (hFile=0x208) returned 0x1
	[0108.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0108.144] GetFileType (hFile=0x208) returned 0x1
	[0108.145] WriteFile (in: hFile=0x208, lpBuffer=0x27ce9a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27ce9a4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0108.148] CloseHandle (hObject=0x208) returned 1
	[0108.148] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf568b970, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf568b970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf568b970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.149] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf568b970, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf568b970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf568b970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0108.149] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0108.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0108.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0108.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0108.150] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search", lpFilePart=0x0) returned 0x23
	[0108.150] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x24
	[0108.150] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf568b970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf568b970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0108.151] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf568b970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf568b970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.151] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x11680590, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11680590, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0108.152] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf568b970, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf568b970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf568b970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.152] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0108.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0108.153] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0108.153] GetFileType (hFile=0x208) returned 0x1
	[0108.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0108.153] GetFileType (hFile=0x208) returned 0x1
	[0108.153] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0108.153] ReadFile (in: hFile=0x208, lpBuffer=0x27d0704, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27d0704*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0108.156] CloseHandle (hObject=0x208) returned 1
	[0108.157] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x34
	[0108.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0108.157] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\search\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0108.159] GetFileType (hFile=0x208) returned 0x1
	[0108.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0108.159] GetFileType (hFile=0x208) returned 0x1
	[0108.159] WriteFile (in: hFile=0x208, lpBuffer=0x27d2db4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27d2db4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0108.162] CloseHandle (hObject=0x208) returned 1
	[0108.163] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0108.163] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\decrypt.txt")) returned 1
	[0108.166] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0108.166] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0108.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0108.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0108.167] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0108.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0108.167] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\search\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0108.168] GetFileType (hFile=0x204) returned 0x1
	[0108.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0108.168] GetFileType (hFile=0x204) returned 0x1
	[0108.168] WriteFile (in: hFile=0x204, lpBuffer=0x27d5448*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27d5448*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0108.171] CloseHandle (hObject=0x204) returned 1
	[0108.172] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6415690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6415690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1
	[0108.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0108.172] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x32
	[0108.172] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x33
	[0108.173] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6415690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6415690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0108.174] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6415690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6415690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.174] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf63c93d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf63c93d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63c93d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz.dat.KEKW", cAlternateFileName="5P5NRG~1.KEK")) returned 1
	[0108.175] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6415690, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6415690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf643b7f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.176] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf63a3270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63a3270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1
	[0108.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0108.176] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x43
	[0108.176] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x44
	[0108.176] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf63a3270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63a3270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0108.177] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf63a3270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63a3270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.178] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf63a3270, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf63a3270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63a3270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.179] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile10.bmp", cAlternateFileName="")) returned 1
	[0108.179] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf56d7c30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf56d7c30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf56fdd90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile10.bmp.KEKW", cAlternateFileName="USERTI~1.KEK")) returned 1
	[0108.180] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile11.bmp", cAlternateFileName="")) returned 1
	[0108.181] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5723ef0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5723ef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5723ef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile11.bmp.KEKW", cAlternateFileName="USERTI~2.KEK")) returned 1
	[0108.181] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile12.bmp", cAlternateFileName="")) returned 1
	[0108.182] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf574a050, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf574a050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf574a050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile12.bmp.KEKW", cAlternateFileName="USERTI~3.KEK")) returned 1
	[0108.182] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile13.bmp", cAlternateFileName="")) returned 1
	[0108.183] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf57701b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf57701b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5796310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile13.bmp.KEKW", cAlternateFileName="USERTI~4.KEK")) returned 1
	[0108.183] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile14.bmp", cAlternateFileName="")) returned 1
	[0108.184] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5796310, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5796310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf57bc470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile14.bmp.KEKW", cAlternateFileName="US2DD7~1.KEK")) returned 1
	[0108.184] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile15.bmp", cAlternateFileName="")) returned 1
	[0108.185] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf57e25d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf57e25d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf57e25d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile15.bmp.KEKW", cAlternateFileName="US9D59~1.KEK")) returned 1
	[0108.185] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile16.bmp", cAlternateFileName="")) returned 1
	[0108.186] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5808730, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5808730, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5808730, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile16.bmp.KEKW", cAlternateFileName="US29D3~1.KEK")) returned 1
	[0108.186] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile17.bmp", cAlternateFileName="")) returned 1
	[0108.187] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf582e890, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf582e890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf582e890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile17.bmp.KEKW", cAlternateFileName="USB45E~1.KEK")) returned 1
	[0108.188] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile18.bmp", cAlternateFileName="")) returned 1
	[0108.188] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf58549f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf58549f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf58549f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile18.bmp.KEKW", cAlternateFileName="USB075~1.KEK")) returned 1
	[0108.189] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile19.bmp", cAlternateFileName="")) returned 1
	[0108.190] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf587ab50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf587ab50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf587ab50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile19.bmp.KEKW", cAlternateFileName="USC310~1.KEK")) returned 1
	[0108.191] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile20.bmp", cAlternateFileName="")) returned 1
	[0108.191] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf58a0cb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf58a0cb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf58c6e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile20.bmp.KEKW", cAlternateFileName="US9FC8~1.KEK")) returned 1
	[0108.192] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile21.bmp", cAlternateFileName="")) returned 1
	[0108.192] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf58c6e10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf58c6e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf58ecf70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile21.bmp.KEKW", cAlternateFileName="US2B43~1.KEK")) returned 1
	[0108.193] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile22.bmp", cAlternateFileName="")) returned 1
	[0108.194] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf59130d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf59130d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf59130d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile22.bmp.KEKW", cAlternateFileName="USE895~1.KEK")) returned 1
	[0108.194] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile23.bmp", cAlternateFileName="")) returned 1
	[0108.195] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5939230, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5939230, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5939230, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile23.bmp.KEKW", cAlternateFileName="US5D1B~1.KEK")) returned 1
	[0108.195] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile24.bmp", cAlternateFileName="")) returned 1
	[0108.196] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf59d17b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf59d17b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf59f7910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile24.bmp.KEKW", cAlternateFileName="USC1A0~1.KEK")) returned 1
	[0108.196] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile25.bmp", cAlternateFileName="")) returned 1
	[0108.197] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf59f7910, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf59f7910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5a1da70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile25.bmp.KEKW", cAlternateFileName="USC589~1.KEK")) returned 1
	[0108.197] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile26.bmp", cAlternateFileName="")) returned 1
	[0108.198] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5a43bd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5a43bd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5a43bd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile26.bmp.KEKW", cAlternateFileName="USC962~1.KEK")) returned 1
	[0108.198] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile27.bmp", cAlternateFileName="")) returned 1
	[0108.199] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5a69d30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5a69d30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5a69d30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile27.bmp.KEKW", cAlternateFileName="US8032~1.KEK")) returned 1
	[0108.199] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile28.bmp", cAlternateFileName="")) returned 1
	[0108.199] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5a8fe90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5a8fe90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5a8fe90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile28.bmp.KEKW", cAlternateFileName="US1CAC~1.KEK")) returned 1
	[0108.200] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile29.bmp", cAlternateFileName="")) returned 1
	[0108.200] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5ab5ff0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5ab5ff0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5ab5ff0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile29.bmp.KEKW", cAlternateFileName="US18C3~1.KEK")) returned 1
	[0108.201] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile30.bmp", cAlternateFileName="")) returned 1
	[0108.201] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5adc150, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5adc150, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5b022b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile30.bmp.KEKW", cAlternateFileName="USC31A~1.KEK")) returned 1
	[0108.202] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile31.bmp", cAlternateFileName="")) returned 1
	[0108.202] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5b28410, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5b28410, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5b28410, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile31.bmp.KEKW", cAlternateFileName="USF627~1.KEK")) returned 1
	[0108.203] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile32.bmp", cAlternateFileName="")) returned 1
	[0108.203] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5b746d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5b746d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5b746d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile32.bmp.KEKW", cAlternateFileName="USF24E~1.KEK")) returned 1
	[0108.204] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile33.bmp", cAlternateFileName="")) returned 1
	[0108.208] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5b9a830, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5b9a830, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5bc0990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile33.bmp.KEKW", cAlternateFileName="US8EB8~1.KEK")) returned 1
	[0108.209] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile34.bmp", cAlternateFileName="")) returned 1
	[0108.209] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5be6af0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5be6af0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5be6af0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile34.bmp.KEKW", cAlternateFileName="US1A33~1.KEK")) returned 1
	[0108.210] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile35.bmp", cAlternateFileName="")) returned 1
	[0108.210] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5c0cc50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5c0cc50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5c32db0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile35.bmp.KEKW", cAlternateFileName="USF9A5~1.KEK")) returned 1
	[0108.211] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile36.bmp", cAlternateFileName="")) returned 1
	[0108.211] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5c58f10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5c58f10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5c58f10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile36.bmp.KEKW", cAlternateFileName="US6E2B~1.KEK")) returned 1
	[0108.212] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile37.bmp", cAlternateFileName="")) returned 1
	[0108.212] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5d3d750, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5d3d750, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5d638b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile37.bmp.KEKW", cAlternateFileName="USD2B0~1.KEK")) returned 1
	[0108.213] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile38.bmp", cAlternateFileName="")) returned 1
	[0108.214] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5d638b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5d638b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf624c610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile38.bmp.KEKW", cAlternateFileName="US4736~1.KEK")) returned 1
	[0108.214] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile39.bmp", cAlternateFileName="")) returned 1
	[0108.229] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf637d110, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf637d110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63a3270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp.KEKW", cAlternateFileName="US757A~1.KEK")) returned 1
	[0108.230] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf637d110, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf637d110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63a3270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp.KEKW", cAlternateFileName="US757A~1.KEK")) returned 0
	[0108.230] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0108.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0108.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0108.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0108.230] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x43
	[0108.231] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x44
	[0108.231] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf63a3270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63a3270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0108.232] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf63a3270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63a3270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.232] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf63a3270, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf63a3270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63a3270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.233] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0108.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.233] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.233] GetFileType (hFile=0x220) returned 0x1
	[0108.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.234] GetFileType (hFile=0x220) returned 0x1
	[0108.234] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0108.234] ReadFile (in: hFile=0x220, lpBuffer=0x25e1848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x25e1848*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0108.238] CloseHandle (hObject=0x220) returned 1
	[0108.238] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x54
	[0108.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.238] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.240] GetFileType (hFile=0x220) returned 0x1
	[0108.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0108.240] GetFileType (hFile=0x220) returned 0x1
	[0108.241] WriteFile (in: hFile=0x220, lpBuffer=0x25e3ff4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x25e3ff4*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0108.244] CloseHandle (hObject=0x220) returned 1
	[0108.244] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0108.244] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\decrypt.txt")) returned 1
	[0108.251] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile10.bmp", cAlternateFileName="")) returned 1
	[0108.251] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", lpFilePart=0x0) returned 0x52
	[0108.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.272] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.272] GetFileType (hFile=0x220) returned 0x1
	[0108.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.273] GetFileType (hFile=0x220) returned 0x1
	[0108.273] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.273] ReadFile (in: hFile=0x220, lpBuffer=0x25e5618, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x25e5618*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.277] CloseHandle (hObject=0x220) returned 1
	[0108.277] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.277] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.282] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf56d7c30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf56d7c30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf56fdd90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile10.bmp.KEKW", cAlternateFileName="USERTI~1.KEK")) returned 1
	[0108.283] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile11.bmp", cAlternateFileName="")) returned 1
	[0108.283] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", lpFilePart=0x0) returned 0x52
	[0108.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.283] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.284] GetFileType (hFile=0x220) returned 0x1
	[0108.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.284] GetFileType (hFile=0x220) returned 0x1
	[0108.284] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.284] ReadFile (in: hFile=0x220, lpBuffer=0x25f26c4, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x25f26c4*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.288] CloseHandle (hObject=0x220) returned 1
	[0108.288] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.289] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.292] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5723ef0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5723ef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5723ef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile11.bmp.KEKW", cAlternateFileName="USERTI~2.KEK")) returned 1
	[0108.293] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile12.bmp", cAlternateFileName="")) returned 1
	[0108.293] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", lpFilePart=0x0) returned 0x52
	[0108.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.293] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.294] GetFileType (hFile=0x220) returned 0x1
	[0108.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.294] GetFileType (hFile=0x220) returned 0x1
	[0108.294] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.294] ReadFile (in: hFile=0x220, lpBuffer=0x25ff770, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x25ff770*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.298] CloseHandle (hObject=0x220) returned 1
	[0108.298] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.299] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.302] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf574a050, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf574a050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf574a050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile12.bmp.KEKW", cAlternateFileName="USERTI~3.KEK")) returned 1
	[0108.302] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile13.bmp", cAlternateFileName="")) returned 1
	[0108.303] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", lpFilePart=0x0) returned 0x52
	[0108.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.303] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.303] GetFileType (hFile=0x220) returned 0x1
	[0108.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.304] GetFileType (hFile=0x220) returned 0x1
	[0108.304] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xbeb8
	[0108.304] ReadFile (in: hFile=0x220, lpBuffer=0x260c81c, nNumberOfBytesToRead=0xbeb8, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x260c81c*, lpNumberOfBytesRead=0x26ee84*=0xbeb8, lpOverlapped=0x0) returned 1
	[0108.307] CloseHandle (hObject=0x220) returned 1
	[0108.307] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.308] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.311] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf57701b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf57701b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5796310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile13.bmp.KEKW", cAlternateFileName="USERTI~4.KEK")) returned 1
	[0108.311] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile14.bmp", cAlternateFileName="")) returned 1
	[0108.312] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", lpFilePart=0x0) returned 0x52
	[0108.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.312] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.312] GetFileType (hFile=0x220) returned 0x1
	[0108.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.312] GetFileType (hFile=0x220) returned 0x1
	[0108.312] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.313] ReadFile (in: hFile=0x220, lpBuffer=0x2619748, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2619748*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.322] CloseHandle (hObject=0x220) returned 1
	[0108.322] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.322] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.326] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5796310, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5796310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf57bc470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile14.bmp.KEKW", cAlternateFileName="US2DD7~1.KEK")) returned 1
	[0108.326] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile15.bmp", cAlternateFileName="")) returned 1
	[0108.327] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", lpFilePart=0x0) returned 0x52
	[0108.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.327] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.328] GetFileType (hFile=0x220) returned 0x1
	[0108.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.328] GetFileType (hFile=0x220) returned 0x1
	[0108.328] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.328] ReadFile (in: hFile=0x220, lpBuffer=0x26267f4, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26267f4*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.332] CloseHandle (hObject=0x220) returned 1
	[0108.332] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.332] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.336] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf57e25d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf57e25d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf57e25d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile15.bmp.KEKW", cAlternateFileName="US9D59~1.KEK")) returned 1
	[0108.337] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile16.bmp", cAlternateFileName="")) returned 1
	[0108.337] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", lpFilePart=0x0) returned 0x52
	[0108.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.337] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.338] GetFileType (hFile=0x220) returned 0x1
	[0108.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.338] GetFileType (hFile=0x220) returned 0x1
	[0108.338] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.338] ReadFile (in: hFile=0x220, lpBuffer=0x26338a0, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26338a0*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.342] CloseHandle (hObject=0x220) returned 1
	[0108.342] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.343] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.347] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5808730, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5808730, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5808730, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile16.bmp.KEKW", cAlternateFileName="US29D3~1.KEK")) returned 1
	[0108.348] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile17.bmp", cAlternateFileName="")) returned 1
	[0108.348] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", lpFilePart=0x0) returned 0x52
	[0108.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.348] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.349] GetFileType (hFile=0x220) returned 0x1
	[0108.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.349] GetFileType (hFile=0x220) returned 0x1
	[0108.349] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.349] ReadFile (in: hFile=0x220, lpBuffer=0x264094c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x264094c*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.353] CloseHandle (hObject=0x220) returned 1
	[0108.353] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.353] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.357] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf582e890, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf582e890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf582e890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile17.bmp.KEKW", cAlternateFileName="USB45E~1.KEK")) returned 1
	[0108.358] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile18.bmp", cAlternateFileName="")) returned 1
	[0108.358] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", lpFilePart=0x0) returned 0x52
	[0108.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.358] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.359] GetFileType (hFile=0x220) returned 0x1
	[0108.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.359] GetFileType (hFile=0x220) returned 0x1
	[0108.359] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.359] ReadFile (in: hFile=0x220, lpBuffer=0x264d9f8, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x264d9f8*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.364] CloseHandle (hObject=0x220) returned 1
	[0108.364] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.364] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.368] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf58549f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf58549f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf58549f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile18.bmp.KEKW", cAlternateFileName="USB075~1.KEK")) returned 1
	[0108.368] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile19.bmp", cAlternateFileName="")) returned 1
	[0108.369] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", lpFilePart=0x0) returned 0x52
	[0108.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.369] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.369] GetFileType (hFile=0x220) returned 0x1
	[0108.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.370] GetFileType (hFile=0x220) returned 0x1
	[0108.370] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.370] ReadFile (in: hFile=0x220, lpBuffer=0x265aaa4, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x265aaa4*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.374] CloseHandle (hObject=0x220) returned 1
	[0108.374] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.374] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.379] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf587ab50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf587ab50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf587ab50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile19.bmp.KEKW", cAlternateFileName="USC310~1.KEK")) returned 1
	[0108.379] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile20.bmp", cAlternateFileName="")) returned 1
	[0108.380] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", lpFilePart=0x0) returned 0x52
	[0108.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.380] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.380] GetFileType (hFile=0x220) returned 0x1
	[0108.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.381] GetFileType (hFile=0x220) returned 0x1
	[0108.381] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.381] ReadFile (in: hFile=0x220, lpBuffer=0x2667b50, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2667b50*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.385] CloseHandle (hObject=0x220) returned 1
	[0108.385] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.385] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.389] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf58a0cb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf58a0cb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf58c6e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile20.bmp.KEKW", cAlternateFileName="US9FC8~1.KEK")) returned 1
	[0108.389] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile21.bmp", cAlternateFileName="")) returned 1
	[0108.390] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", lpFilePart=0x0) returned 0x52
	[0108.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.390] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.390] GetFileType (hFile=0x220) returned 0x1
	[0108.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.391] GetFileType (hFile=0x220) returned 0x1
	[0108.391] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.391] ReadFile (in: hFile=0x220, lpBuffer=0x2674bfc, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2674bfc*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.395] CloseHandle (hObject=0x220) returned 1
	[0108.395] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.396] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.400] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf58c6e10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf58c6e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf58ecf70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile21.bmp.KEKW", cAlternateFileName="US2B43~1.KEK")) returned 1
	[0108.401] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile22.bmp", cAlternateFileName="")) returned 1
	[0108.401] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", lpFilePart=0x0) returned 0x52
	[0108.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.401] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.402] GetFileType (hFile=0x220) returned 0x1
	[0108.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.402] GetFileType (hFile=0x220) returned 0x1
	[0108.402] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.402] ReadFile (in: hFile=0x220, lpBuffer=0x2681ca8, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2681ca8*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.406] CloseHandle (hObject=0x220) returned 1
	[0108.406] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.407] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.412] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf59130d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf59130d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf59130d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile22.bmp.KEKW", cAlternateFileName="USE895~1.KEK")) returned 1
	[0108.413] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile23.bmp", cAlternateFileName="")) returned 1
	[0108.413] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", lpFilePart=0x0) returned 0x52
	[0108.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.413] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.414] GetFileType (hFile=0x220) returned 0x1
	[0108.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.414] GetFileType (hFile=0x220) returned 0x1
	[0108.414] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.415] ReadFile (in: hFile=0x220, lpBuffer=0x268ed54, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x268ed54*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.419] CloseHandle (hObject=0x220) returned 1
	[0108.419] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.419] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.423] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5939230, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5939230, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5939230, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile23.bmp.KEKW", cAlternateFileName="US5D1B~1.KEK")) returned 1
	[0108.423] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile24.bmp", cAlternateFileName="")) returned 1
	[0108.424] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", lpFilePart=0x0) returned 0x52
	[0108.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.424] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.424] GetFileType (hFile=0x220) returned 0x1
	[0108.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.425] GetFileType (hFile=0x220) returned 0x1
	[0108.425] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.425] ReadFile (in: hFile=0x220, lpBuffer=0x269be00, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x269be00*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.429] CloseHandle (hObject=0x220) returned 1
	[0108.429] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.429] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.433] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf59d17b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf59d17b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf59f7910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile24.bmp.KEKW", cAlternateFileName="USC1A0~1.KEK")) returned 1
	[0108.434] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile25.bmp", cAlternateFileName="")) returned 1
	[0108.434] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", lpFilePart=0x0) returned 0x52
	[0108.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.435] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.435] GetFileType (hFile=0x220) returned 0x1
	[0108.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.435] GetFileType (hFile=0x220) returned 0x1
	[0108.435] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.436] ReadFile (in: hFile=0x220, lpBuffer=0x26a8eac, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26a8eac*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.440] CloseHandle (hObject=0x220) returned 1
	[0108.440] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.440] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.444] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf59f7910, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf59f7910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5a1da70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile25.bmp.KEKW", cAlternateFileName="USC589~1.KEK")) returned 1
	[0108.445] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile26.bmp", cAlternateFileName="")) returned 1
	[0108.445] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", lpFilePart=0x0) returned 0x52
	[0108.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.445] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.446] GetFileType (hFile=0x220) returned 0x1
	[0108.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.446] GetFileType (hFile=0x220) returned 0x1
	[0108.446] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.446] ReadFile (in: hFile=0x220, lpBuffer=0x26b5f58, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26b5f58*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.450] CloseHandle (hObject=0x220) returned 1
	[0108.450] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.451] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.468] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5a43bd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5a43bd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5a43bd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile26.bmp.KEKW", cAlternateFileName="USC962~1.KEK")) returned 1
	[0108.469] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile27.bmp", cAlternateFileName="")) returned 1
	[0108.469] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", lpFilePart=0x0) returned 0x52
	[0108.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.469] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.496] GetFileType (hFile=0x220) returned 0x1
	[0108.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.496] GetFileType (hFile=0x220) returned 0x1
	[0108.496] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.497] ReadFile (in: hFile=0x220, lpBuffer=0x26c3004, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26c3004*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.501] CloseHandle (hObject=0x220) returned 1
	[0108.501] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.502] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.506] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5a69d30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5a69d30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5a69d30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile27.bmp.KEKW", cAlternateFileName="US8032~1.KEK")) returned 1
	[0108.507] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile28.bmp", cAlternateFileName="")) returned 1
	[0108.507] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", lpFilePart=0x0) returned 0x52
	[0108.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.507] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.508] GetFileType (hFile=0x220) returned 0x1
	[0108.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.508] GetFileType (hFile=0x220) returned 0x1
	[0108.508] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.508] ReadFile (in: hFile=0x220, lpBuffer=0x26d00b0, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26d00b0*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.512] CloseHandle (hObject=0x220) returned 1
	[0108.512] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.512] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.516] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5a8fe90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5a8fe90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5a8fe90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile28.bmp.KEKW", cAlternateFileName="US1CAC~1.KEK")) returned 1
	[0108.517] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile29.bmp", cAlternateFileName="")) returned 1
	[0108.517] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", lpFilePart=0x0) returned 0x52
	[0108.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.518] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.518] GetFileType (hFile=0x220) returned 0x1
	[0108.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.518] GetFileType (hFile=0x220) returned 0x1
	[0108.518] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.519] ReadFile (in: hFile=0x220, lpBuffer=0x26dd15c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26dd15c*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.522] CloseHandle (hObject=0x220) returned 1
	[0108.523] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.523] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.527] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5ab5ff0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5ab5ff0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5ab5ff0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile29.bmp.KEKW", cAlternateFileName="US18C3~1.KEK")) returned 1
	[0108.528] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile30.bmp", cAlternateFileName="")) returned 1
	[0108.528] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", lpFilePart=0x0) returned 0x52
	[0108.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.528] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile30.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.529] GetFileType (hFile=0x220) returned 0x1
	[0108.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.529] GetFileType (hFile=0x220) returned 0x1
	[0108.529] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.530] ReadFile (in: hFile=0x220, lpBuffer=0x26ea208, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26ea208*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.540] CloseHandle (hObject=0x220) returned 1
	[0108.540] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.541] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile30.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.545] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5adc150, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5adc150, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5b022b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile30.bmp.KEKW", cAlternateFileName="USC31A~1.KEK")) returned 1
	[0108.545] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile31.bmp", cAlternateFileName="")) returned 1
	[0108.545] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", lpFilePart=0x0) returned 0x52
	[0108.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.546] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile31.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.546] GetFileType (hFile=0x220) returned 0x1
	[0108.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.546] GetFileType (hFile=0x220) returned 0x1
	[0108.547] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.547] ReadFile (in: hFile=0x220, lpBuffer=0x26f72b4, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26f72b4*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.551] CloseHandle (hObject=0x220) returned 1
	[0108.551] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.551] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile31.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.555] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5b28410, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5b28410, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5b28410, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile31.bmp.KEKW", cAlternateFileName="USF627~1.KEK")) returned 1
	[0108.556] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile32.bmp", cAlternateFileName="")) returned 1
	[0108.556] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", lpFilePart=0x0) returned 0x52
	[0108.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.557] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile32.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.557] GetFileType (hFile=0x220) returned 0x1
	[0108.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.557] GetFileType (hFile=0x220) returned 0x1
	[0108.557] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.557] ReadFile (in: hFile=0x220, lpBuffer=0x2704360, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2704360*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.561] CloseHandle (hObject=0x220) returned 1
	[0108.561] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.561] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile32.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.566] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5b746d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5b746d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5b746d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile32.bmp.KEKW", cAlternateFileName="USF24E~1.KEK")) returned 1
	[0108.566] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile33.bmp", cAlternateFileName="")) returned 1
	[0108.567] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", lpFilePart=0x0) returned 0x52
	[0108.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.567] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile33.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.567] GetFileType (hFile=0x220) returned 0x1
	[0108.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.568] GetFileType (hFile=0x220) returned 0x1
	[0108.568] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.568] ReadFile (in: hFile=0x220, lpBuffer=0x271140c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x271140c*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.572] CloseHandle (hObject=0x220) returned 1
	[0108.572] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.572] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile33.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.576] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5b9a830, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5b9a830, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5bc0990, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile33.bmp.KEKW", cAlternateFileName="US8EB8~1.KEK")) returned 1
	[0108.577] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile34.bmp", cAlternateFileName="")) returned 1
	[0108.577] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp", lpFilePart=0x0) returned 0x52
	[0108.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.577] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile34.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.578] GetFileType (hFile=0x220) returned 0x1
	[0108.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.578] GetFileType (hFile=0x220) returned 0x1
	[0108.578] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.578] ReadFile (in: hFile=0x220, lpBuffer=0x271e4b8, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x271e4b8*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.585] CloseHandle (hObject=0x220) returned 1
	[0108.585] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.586] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile34.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.590] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5be6af0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5be6af0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5be6af0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile34.bmp.KEKW", cAlternateFileName="US1A33~1.KEK")) returned 1
	[0108.590] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile35.bmp", cAlternateFileName="")) returned 1
	[0108.590] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp", lpFilePart=0x0) returned 0x52
	[0108.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.591] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile35.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.591] GetFileType (hFile=0x220) returned 0x1
	[0108.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.591] GetFileType (hFile=0x220) returned 0x1
	[0108.591] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.592] ReadFile (in: hFile=0x220, lpBuffer=0x272b564, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x272b564*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.596] CloseHandle (hObject=0x220) returned 1
	[0108.596] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.596] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile35.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.601] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5c0cc50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5c0cc50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5c32db0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile35.bmp.KEKW", cAlternateFileName="USF9A5~1.KEK")) returned 1
	[0108.601] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile36.bmp", cAlternateFileName="")) returned 1
	[0108.601] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", lpFilePart=0x0) returned 0x52
	[0108.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.602] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.602] GetFileType (hFile=0x220) returned 0x1
	[0108.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.602] GetFileType (hFile=0x220) returned 0x1
	[0108.602] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.602] ReadFile (in: hFile=0x220, lpBuffer=0x2738610, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2738610*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.606] CloseHandle (hObject=0x220) returned 1
	[0108.606] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.606] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.610] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5c58f10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5c58f10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5c58f10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile36.bmp.KEKW", cAlternateFileName="US6E2B~1.KEK")) returned 1
	[0108.611] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile37.bmp", cAlternateFileName="")) returned 1
	[0108.611] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp", lpFilePart=0x0) returned 0x52
	[0108.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.612] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile37.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.612] GetFileType (hFile=0x220) returned 0x1
	[0108.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.612] GetFileType (hFile=0x220) returned 0x1
	[0108.612] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.613] ReadFile (in: hFile=0x220, lpBuffer=0x27456bc, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27456bc*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.616] CloseHandle (hObject=0x220) returned 1
	[0108.616] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.617] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile37.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.621] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5d3d750, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5d3d750, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf5d638b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile37.bmp.KEKW", cAlternateFileName="USD2B0~1.KEK")) returned 1
	[0108.621] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile38.bmp", cAlternateFileName="")) returned 1
	[0108.622] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", lpFilePart=0x0) returned 0x52
	[0108.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.622] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.622] GetFileType (hFile=0x220) returned 0x1
	[0108.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.623] GetFileType (hFile=0x220) returned 0x1
	[0108.623] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.623] ReadFile (in: hFile=0x220, lpBuffer=0x2752768, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2752768*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.629] CloseHandle (hObject=0x220) returned 1
	[0108.629] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.629] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.634] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf5d638b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf5d638b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf624c610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile38.bmp.KEKW", cAlternateFileName="US4736~1.KEK")) returned 1
	[0108.634] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile39.bmp", cAlternateFileName="")) returned 1
	[0108.634] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", lpFilePart=0x0) returned 0x52
	[0108.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.635] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.635] GetFileType (hFile=0x220) returned 0x1
	[0108.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.635] GetFileType (hFile=0x220) returned 0x1
	[0108.636] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.636] ReadFile (in: hFile=0x220, lpBuffer=0x275f814, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x275f814*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.639] CloseHandle (hObject=0x220) returned 1
	[0108.640] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.640] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.644] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6272770, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6272770, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6272770, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile39.bmp.KEKW", cAlternateFileName="US730B~1.KEK")) returned 1
	[0108.644] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae607689, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae607689, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc50c9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile40.bmp", cAlternateFileName="")) returned 1
	[0108.645] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", lpFilePart=0x0) returned 0x52
	[0108.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.645] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.646] GetFileType (hFile=0x220) returned 0x1
	[0108.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.646] GetFileType (hFile=0x220) returned 0x1
	[0108.646] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.646] ReadFile (in: hFile=0x220, lpBuffer=0x276c8c0, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x276c8c0*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.650] CloseHandle (hObject=0x220) returned 1
	[0108.650] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.651] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.655] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf62988d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf62988d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf62bea30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile40.bmp.KEKW", cAlternateFileName="US68D2~1.KEK")) returned 1
	[0108.655] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae62d7e6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae62d7e6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddcc30b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile41.bmp", cAlternateFileName="")) returned 1
	[0108.656] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", lpFilePart=0x0) returned 0x52
	[0108.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.656] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.656] GetFileType (hFile=0x220) returned 0x1
	[0108.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.656] GetFileType (hFile=0x220) returned 0x1
	[0108.657] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.674] ReadFile (in: hFile=0x220, lpBuffer=0x277996c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x277996c*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.678] CloseHandle (hObject=0x220) returned 1
	[0108.681] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.682] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.697] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf62bea30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf62bea30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf62bea30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile41.bmp.KEKW", cAlternateFileName="USC20B~1.KEK")) returned 1
	[0108.700] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddce9217, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile42.bmp", cAlternateFileName="")) returned 1
	[0108.700] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", lpFilePart=0x0) returned 0x52
	[0108.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.700] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.701] GetFileType (hFile=0x220) returned 0x1
	[0108.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.701] GetFileType (hFile=0x220) returned 0x1
	[0108.701] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.702] ReadFile (in: hFile=0x220, lpBuffer=0x2786a18, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2786a18*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.706] CloseHandle (hObject=0x220) returned 1
	[0108.706] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.706] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.711] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6330e50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6330e50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6330e50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile42.bmp.KEKW", cAlternateFileName="US5E75~1.KEK")) returned 1
	[0108.711] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd0f375, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile43.bmp", cAlternateFileName="")) returned 1
	[0108.712] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", lpFilePart=0x0) returned 0x52
	[0108.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.712] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.712] GetFileType (hFile=0x220) returned 0x1
	[0108.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.713] GetFileType (hFile=0x220) returned 0x1
	[0108.713] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.713] ReadFile (in: hFile=0x220, lpBuffer=0x2793ac4, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2793ac4*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.717] CloseHandle (hObject=0x220) returned 1
	[0108.717] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.718] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.722] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6356fb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6356fb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf637d110, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile43.bmp.KEKW", cAlternateFileName="USE9FF~1.KEK")) returned 1
	[0108.722] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 1
	[0108.723] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp", lpFilePart=0x0) returned 0x52
	[0108.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.723] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile44.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.723] GetFileType (hFile=0x220) returned 0x1
	[0108.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.724] GetFileType (hFile=0x220) returned 0x1
	[0108.724] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xc038
	[0108.724] ReadFile (in: hFile=0x220, lpBuffer=0x27a0b70, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27a0b70*, lpNumberOfBytesRead=0x26ee84*=0xc038, lpOverlapped=0x0) returned 1
	[0108.728] CloseHandle (hObject=0x220) returned 1
	[0108.728] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp.KEKW", lpFilePart=0x0) returned 0x57
	[0108.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.729] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile44.bmp.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0108.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0108.733] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf637d110, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf637d110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63a3270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp.KEKW", cAlternateFileName="US757A~1.KEK")) returned 1
	[0108.734] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0108.734] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0108.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0108.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0108.735] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0108.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0108.735] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0108.737] GetFileType (hFile=0x208) returned 0x1
	[0108.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0108.738] GetFileType (hFile=0x208) returned 0x1
	[0108.738] WriteFile (in: hFile=0x208, lpBuffer=0x27aed4c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27aed4c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0108.742] CloseHandle (hObject=0x208) returned 1
	[0108.742] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf63ef530, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf63ef530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63ef530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp.KEKW", cAlternateFileName="GUESTB~1.KEK")) returned 1
	[0108.743] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6415690, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6415690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6415690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp.KEKW", cAlternateFileName="USERBM~1.KEK")) returned 1
	[0108.743] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6415690, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6415690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6415690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp.KEKW", cAlternateFileName="USERBM~1.KEK")) returned 0
	[0108.744] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0108.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0108.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0108.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0108.745] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x32
	[0108.745] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x33
	[0108.745] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6415690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6415690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0108.746] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6415690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6415690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.746] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf63c93d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf63c93d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63c93d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz.dat.KEKW", cAlternateFileName="5P5NRG~1.KEK")) returned 1
	[0108.747] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6415690, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6415690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf643b7f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.749] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0108.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0108.749] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0108.749] GetFileType (hFile=0x208) returned 0x1
	[0108.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0108.750] GetFileType (hFile=0x208) returned 0x1
	[0108.750] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0108.750] ReadFile (in: hFile=0x208, lpBuffer=0x27b12a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27b12a8*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0108.755] CloseHandle (hObject=0x208) returned 1
	[0108.755] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x43
	[0108.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0108.755] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0108.757] GetFileType (hFile=0x208) returned 0x1
	[0108.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0108.758] GetFileType (hFile=0x208) returned 0x1
	[0108.759] WriteFile (in: hFile=0x208, lpBuffer=0x27b3990*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27b3990*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0108.762] CloseHandle (hObject=0x208) returned 1
	[0108.762] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0108.762] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\decrypt.txt")) returned 1
	[0108.767] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x11c279d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11c279d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1
	[0108.769] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf63ef530, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf63ef530, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf63ef530, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp.KEKW", cAlternateFileName="GUESTB~1.KEK")) returned 1
	[0108.769] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6415690, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6415690, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6415690, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp.KEKW", cAlternateFileName="USERBM~1.KEK")) returned 1
	[0108.770] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0108.770] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0108.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0108.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0108.771] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0108.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0108.771] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0108.772] GetFileType (hFile=0x204) returned 0x1
	[0108.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0108.772] GetFileType (hFile=0x204) returned 0x1
	[0108.773] WriteFile (in: hFile=0x204, lpBuffer=0x27b6984*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27b6984*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0108.776] CloseHandle (hObject=0x204) returned 1
	[0108.777] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1
	[0108.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0108.777] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault", lpFilePart=0x0) returned 0x22
	[0108.777] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x23
	[0108.778] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0108.778] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.779] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6461950, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.780] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6461950, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0108.780] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0108.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0108.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0108.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0108.781] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault", lpFilePart=0x0) returned 0x22
	[0108.781] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x23
	[0108.781] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0108.782] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.782] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6461950, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.782] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0108.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0108.783] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\vault\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0108.783] GetFileType (hFile=0x208) returned 0x1
	[0108.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0108.783] GetFileType (hFile=0x208) returned 0x1
	[0108.784] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0108.784] ReadFile (in: hFile=0x208, lpBuffer=0x27b8d78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27b8d78*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0108.787] CloseHandle (hObject=0x208) returned 1
	[0108.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x33
	[0108.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0108.787] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\vault\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0108.788] GetFileType (hFile=0x208) returned 0x1
	[0108.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0108.789] GetFileType (hFile=0x208) returned 0x1
	[0108.789] WriteFile (in: hFile=0x208, lpBuffer=0x27bb420*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27bb420*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0108.792] CloseHandle (hObject=0x208) returned 1
	[0108.793] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0108.793] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\vault\\decrypt.txt")) returned 1
	[0108.796] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0108.797] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0108.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0108.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0108.799] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0108.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0108.799] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\vault\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0108.800] GetFileType (hFile=0x204) returned 0x1
	[0108.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0108.800] GetFileType (hFile=0x204) returned 0x1
	[0108.800] WriteFile (in: hFile=0x204, lpBuffer=0x27bdab4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27bdab4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0108.804] CloseHandle (hObject=0x204) returned 1
	[0108.804] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1
	[0108.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0108.804] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x22
	[0108.804] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x23
	[0108.805] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0108.806] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.806] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6461950, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6487ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.807] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6461950, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6487ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0108.807] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0108.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0108.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0108.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0108.808] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x22
	[0108.808] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x23
	[0108.808] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0108.809] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6461950, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.810] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6461950, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6461950, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6487ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.810] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0108.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0108.811] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\visio\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0108.811] GetFileType (hFile=0x208) returned 0x1
	[0108.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0108.811] GetFileType (hFile=0x208) returned 0x1
	[0108.811] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0108.812] ReadFile (in: hFile=0x208, lpBuffer=0x27bfea8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27bfea8*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0108.816] CloseHandle (hObject=0x208) returned 1
	[0108.816] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x33
	[0108.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0108.817] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\visio\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0108.818] GetFileType (hFile=0x208) returned 0x1
	[0108.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0108.818] GetFileType (hFile=0x208) returned 0x1
	[0108.819] WriteFile (in: hFile=0x208, lpBuffer=0x27c2550*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27c2550*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0108.822] CloseHandle (hObject=0x208) returned 1
	[0108.822] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0108.823] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\visio\\decrypt.txt")) returned 1
	[0108.826] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0108.827] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0108.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0108.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0108.827] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0108.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0108.827] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\visio\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0108.828] GetFileType (hFile=0x204) returned 0x1
	[0108.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0108.828] GetFileType (hFile=0x204) returned 0x1
	[0108.829] WriteFile (in: hFile=0x204, lpBuffer=0x27c4be4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27c4be4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0108.832] CloseHandle (hObject=0x204) returned 1
	[0108.833] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0108.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0108.833] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows", lpFilePart=0x0) returned 0x24
	[0108.833] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x25
	[0108.834] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0108.834] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.835] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6487ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6487ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIT", cAlternateFileName="")) returned 1
	[0108.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0108.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AIT", lpFilePart=0x0) returned 0x28
	[0108.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\", lpFilePart=0x0) returned 0x29
	[0108.836] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6487ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6487ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0108.837] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6487ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6487ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.838] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6487ab0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6487ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64adc10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.838] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6487ab0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6487ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64adc10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0108.839] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0108.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0108.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0108.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0108.839] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AIT", lpFilePart=0x0) returned 0x28
	[0108.839] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\", lpFilePart=0x0) returned 0x29
	[0108.840] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6487ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6487ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0108.840] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6487ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6487ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.841] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6487ab0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6487ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64adc10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.841] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0108.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.841] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\ait\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.842] GetFileType (hFile=0x220) returned 0x1
	[0108.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.842] GetFileType (hFile=0x220) returned 0x1
	[0108.842] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0108.843] ReadFile (in: hFile=0x220, lpBuffer=0x27c7958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27c7958*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0108.846] CloseHandle (hObject=0x220) returned 1
	[0108.846] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x39
	[0108.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.846] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\ait\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.847] GetFileType (hFile=0x220) returned 0x1
	[0108.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0108.848] GetFileType (hFile=0x220) returned 0x1
	[0108.848] WriteFile (in: hFile=0x220, lpBuffer=0x27ca018*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27ca018*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0108.851] CloseHandle (hObject=0x220) returned 1
	[0108.851] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0108.852] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\ait\\decrypt.txt")) returned 1
	[0108.855] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0108.855] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0108.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0108.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0108.856] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0108.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0108.856] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\ait\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0108.857] GetFileType (hFile=0x208) returned 0x1
	[0108.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0108.857] GetFileType (hFile=0x208) returned 0x1
	[0108.857] WriteFile (in: hFile=0x208, lpBuffer=0x27cc6d0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27cc6d0*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0108.874] CloseHandle (hObject=0x208) returned 1
	[0108.874] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xf64d3d70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64d3d70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1
	[0108.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0108.875] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x2b
	[0108.875] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x2c
	[0108.875] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xf64d3d70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64d3d70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0108.876] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xf64d3d70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64d3d70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.877] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x284cecd2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x284cecd2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x284cecd2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cversions.2.db", cAlternateFileName="CVERSI~1.DB")) returned 1
	[0108.877] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf64d3d70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf64d3d70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64f9ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.881] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x10f4d170, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x10f4d170, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x10f4d170, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="{11336D5B-7F61-4871-82E3-E0F59766823B}.2.ver0x0000000000000001.db", cAlternateFileName="{11336~1.DB")) returned 1
	[0108.881] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x75fef9b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x75fef9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75fef9b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db", cAlternateFileName="{3978E~1.DB")) returned 1
	[0108.882] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf67691e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xcf67691e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xcf67691e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x0, dwReserved1=0x0, cFileName="{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db", cAlternateFileName="{40FC8~1.DB")) returned 1
	[0108.883] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b7d54e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9b7d54e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b7d54e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db", cAlternateFileName="{4E36E~1.DB")) returned 1
	[0108.883] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab9fb9ff, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab9fb9ff, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab9fb9ff, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db", cAlternateFileName="{4E426~2.DB")) returned 1
	[0108.884] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76015b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x76015b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76015b10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000011.db", cAlternateFileName="{6AF06~1.DB")) returned 1
	[0108.885] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b8217a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9b8217a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b8217a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f5f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db", cAlternateFileName="{6AF06~2.DB")) returned 1
	[0108.885] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab96347e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab96347e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab96347e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x65578, dwReserved0=0x0, dwReserved1=0x0, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", cAlternateFileName="{DDF57~2.DB")) returned 1
	[0108.886] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab96347e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab96347e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab96347e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x65578, dwReserved0=0x0, dwReserved1=0x0, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", cAlternateFileName="{DDF57~2.DB")) returned 0
	[0108.886] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0108.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0108.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0108.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0108.887] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x2b
	[0108.887] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x2c
	[0108.888] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xf64d3d70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64d3d70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0108.888] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xf64d3d70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64d3d70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.889] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x284cecd2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x284cecd2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x284cecd2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cversions.2.db", cAlternateFileName="CVERSI~1.DB")) returned 1
	[0108.889] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf64d3d70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf64d3d70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64f9ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.890] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0108.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.890] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.890] GetFileType (hFile=0x220) returned 0x1
	[0108.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.891] GetFileType (hFile=0x220) returned 0x1
	[0108.891] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0108.891] ReadFile (in: hFile=0x220, lpBuffer=0x27d075c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27d075c*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0108.895] CloseHandle (hObject=0x220) returned 1
	[0108.895] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3c
	[0108.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.895] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.897] GetFileType (hFile=0x220) returned 0x1
	[0108.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0108.897] GetFileType (hFile=0x220) returned 0x1
	[0108.897] WriteFile (in: hFile=0x220, lpBuffer=0x27d2e2c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27d2e2c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0108.901] CloseHandle (hObject=0x220) returned 1
	[0108.901] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0108.901] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\decrypt.txt")) returned 1
	[0108.905] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x10f4d170, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x10f4d170, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x10f4d170, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="{11336D5B-7F61-4871-82E3-E0F59766823B}.2.ver0x0000000000000001.db", cAlternateFileName="{11336~1.DB")) returned 1
	[0108.906] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x75fef9b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x75fef9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75fef9b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db", cAlternateFileName="{3978E~1.DB")) returned 1
	[0108.906] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf67691e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xcf67691e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xcf67691e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x0, dwReserved1=0x0, cFileName="{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db", cAlternateFileName="{40FC8~1.DB")) returned 1
	[0108.908] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b7d54e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9b7d54e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b7d54e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db", cAlternateFileName="{4E36E~1.DB")) returned 1
	[0108.909] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab9fb9ff, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab9fb9ff, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab9fb9ff, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x0, dwReserved1=0x0, cFileName="{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db", cAlternateFileName="{4E426~2.DB")) returned 1
	[0108.909] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76015b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x76015b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76015b10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000011.db", cAlternateFileName="{6AF06~1.DB")) returned 1
	[0108.910] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b8217a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9b8217a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b8217a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f5f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db", cAlternateFileName="{6AF06~2.DB")) returned 1
	[0108.910] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab96347e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab96347e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab96347e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x65578, dwReserved0=0x0, dwReserved1=0x0, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", cAlternateFileName="{DDF57~2.DB")) returned 1
	[0108.911] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0108.911] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0108.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0108.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0108.912] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0108.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0108.912] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0108.913] GetFileType (hFile=0x208) returned 0x1
	[0108.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0108.913] GetFileType (hFile=0x208) returned 0x1
	[0108.914] WriteFile (in: hFile=0x208, lpBuffer=0x27d8410*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27d8410*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0108.917] CloseHandle (hObject=0x208) returned 1
	[0108.917] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6924550, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf694a6b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.917] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6520030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6520030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1
	[0108.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0108.918] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore", lpFilePart=0x0) returned 0x38
	[0108.918] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\", lpFilePart=0x0) returned 0x39
	[0108.918] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6520030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6520030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0108.919] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6520030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6520030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.920] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6520030, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6520030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6520030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.920] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf64f9ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64f9ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0108.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0108.921] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", lpFilePart=0x0) returned 0x3e
	[0108.921] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", lpFilePart=0x0) returned 0x3f
	[0108.921] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf64f9ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64f9ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0108.922] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf64f9ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64f9ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.923] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x0, dwReserved1=0x0, cFileName="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", cAlternateFileName="")) returned 1
	[0108.923] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 1
	[0108.924] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf64f9ed0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf64f9ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6520030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.924] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf64f9ed0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf64f9ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6520030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0108.925] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0108.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0108.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0108.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0108.925] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US", lpFilePart=0x0) returned 0x3e
	[0108.925] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\", lpFilePart=0x0) returned 0x3f
	[0108.925] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf64f9ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64f9ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0108.926] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf64f9ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf64f9ed0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.927] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x0, dwReserved1=0x0, cFileName="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", cAlternateFileName="")) returned 1
	[0108.927] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 1
	[0108.928] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf64f9ed0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf64f9ed0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6520030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.928] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0108.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0108.928] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0108.929] GetFileType (hFile=0x224) returned 0x1
	[0108.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0108.929] GetFileType (hFile=0x224) returned 0x1
	[0108.929] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0108.930] ReadFile (in: hFile=0x224, lpBuffer=0x27dcdb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27dcdb0*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0108.932] CloseHandle (hObject=0x224) returned 1
	[0108.932] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x4f
	[0108.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0108.933] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0108.939] GetFileType (hFile=0x224) returned 0x1
	[0108.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0108.939] GetFileType (hFile=0x224) returned 0x1
	[0108.940] WriteFile (in: hFile=0x224, lpBuffer=0x27df4c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27df4c8*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0108.944] CloseHandle (hObject=0x224) returned 1
	[0108.944] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0108.944] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\decrypt.txt")) returned 1
	[0108.948] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0108.948] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0108.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0108.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0108.949] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0108.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0108.949] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0108.950] GetFileType (hFile=0x220) returned 0x1
	[0108.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0108.950] GetFileType (hFile=0x220) returned 0x1
	[0108.974] WriteFile (in: hFile=0x220, lpBuffer=0x25e48dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25e48dc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0108.977] CloseHandle (hObject=0x220) returned 1
	[0108.978] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0108.978] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0108.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0108.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0108.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0108.979] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore", lpFilePart=0x0) returned 0x38
	[0108.979] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\", lpFilePart=0x0) returned 0x39
	[0108.979] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6520030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6520030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0108.980] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6520030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6520030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0108.981] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6520030, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6520030, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6520030, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0108.981] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0108.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0108.982] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.982] GetFileType (hFile=0x220) returned 0x1
	[0108.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0108.982] GetFileType (hFile=0x220) returned 0x1
	[0108.983] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0108.983] ReadFile (in: hFile=0x220, lpBuffer=0x25e674c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x25e674c*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0108.986] CloseHandle (hObject=0x220) returned 1
	[0108.986] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x49
	[0108.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0108.987] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0108.988] GetFileType (hFile=0x220) returned 0x1
	[0108.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0108.988] GetFileType (hFile=0x220) returned 0x1
	[0108.990] WriteFile (in: hFile=0x220, lpBuffer=0x25e8ec8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x25e8ec8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0108.994] CloseHandle (hObject=0x220) returned 1
	[0108.994] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0108.994] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\decrypt.txt")) returned 1
	[0108.998] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x11e16bb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11e16bb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0108.999] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x11e16bb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11e16bb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0108.999] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0108.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0108.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0108.999] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0108.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.000] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0109.001] GetFileType (hFile=0x208) returned 0x1
	[0109.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0109.001] GetFileType (hFile=0x208) returned 0x1
	[0109.002] WriteFile (in: hFile=0x208, lpBuffer=0x25eb73c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x25eb73c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0109.005] CloseHandle (hObject=0x208) returned 1
	[0109.006] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1
	[0109.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0109.006] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM", lpFilePart=0x0) returned 0x28
	[0109.006] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\", lpFilePart=0x0) returned 0x29
	[0109.007] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0109.007] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.008] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6546190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6546190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0109.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0109.009] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache", lpFilePart=0x0) returned 0x2e
	[0109.009] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\", lpFilePart=0x0) returned 0x2f
	[0109.009] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6546190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6546190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0109.010] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6546190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6546190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.010] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6546190, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6546190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6546190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.011] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6546190, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6546190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6546190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0109.012] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0109.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0109.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0109.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0109.012] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache", lpFilePart=0x0) returned 0x2e
	[0109.012] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\", lpFilePart=0x0) returned 0x2f
	[0109.013] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6546190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6546190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0109.013] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6546190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6546190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.014] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6546190, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6546190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6546190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.014] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0109.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0109.015] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\drm\\cache\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0109.015] GetFileType (hFile=0x224) returned 0x1
	[0109.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0109.015] GetFileType (hFile=0x224) returned 0x1
	[0109.016] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0109.016] ReadFile (in: hFile=0x224, lpBuffer=0x25ee6d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x25ee6d4*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.019] CloseHandle (hObject=0x224) returned 1
	[0109.019] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3f
	[0109.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0109.020] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\drm\\cache\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0109.021] GetFileType (hFile=0x224) returned 0x1
	[0109.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0109.021] GetFileType (hFile=0x224) returned 0x1
	[0109.022] WriteFile (in: hFile=0x224, lpBuffer=0x25f0dac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x25f0dac*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0109.025] CloseHandle (hObject=0x224) returned 1
	[0109.025] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0109.026] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\drm\\cache\\decrypt.txt")) returned 1
	[0109.029] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.030] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0109.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0109.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0109.030] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0109.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.030] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\drm\\cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0109.031] GetFileType (hFile=0x220) returned 0x1
	[0109.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0109.032] GetFileType (hFile=0x220) returned 0x1
	[0109.032] WriteFile (in: hFile=0x220, lpBuffer=0x25f3488*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25f3488*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.035] CloseHandle (hObject=0x220) returned 1
	[0109.036] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf656c2f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.036] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf656c2f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0109.036] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0109.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0109.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0109.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0109.037] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM", lpFilePart=0x0) returned 0x28
	[0109.037] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\", lpFilePart=0x0) returned 0x29
	[0109.037] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0109.038] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.039] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x11ed5290, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11ed5290, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0109.039] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf656c2f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.040] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0109.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0109.040] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\drm\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0109.040] GetFileType (hFile=0x220) returned 0x1
	[0109.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0109.041] GetFileType (hFile=0x220) returned 0x1
	[0109.041] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0109.041] ReadFile (in: hFile=0x220, lpBuffer=0x25f52e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x25f52e8*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0109.044] CloseHandle (hObject=0x220) returned 1
	[0109.044] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x39
	[0109.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0109.044] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\drm\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0109.045] GetFileType (hFile=0x220) returned 0x1
	[0109.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0109.045] GetFileType (hFile=0x220) returned 0x1
	[0109.046] WriteFile (in: hFile=0x220, lpBuffer=0x25f79a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x25f79a8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0109.049] CloseHandle (hObject=0x220) returned 1
	[0109.049] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0109.050] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\drm\\decrypt.txt")) returned 1
	[0109.053] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.053] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0109.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0109.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0109.054] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0109.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.054] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\drm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0109.055] GetFileType (hFile=0x208) returned 0x1
	[0109.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0109.055] GetFileType (hFile=0x208) returned 0x1
	[0109.055] WriteFile (in: hFile=0x208, lpBuffer=0x25fa060*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x25fa060*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0109.059] CloseHandle (hObject=0x208) returned 1
	[0109.059] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0109.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0109.060] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x31
	[0109.060] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x32
	[0109.060] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0109.061] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.061] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf656c2f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.062] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf656c2f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0109.062] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0109.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0109.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0109.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0109.064] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x31
	[0109.064] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x32
	[0109.065] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0109.065] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.066] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf656c2f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf656c2f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf656c2f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.066] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0109.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0109.067] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\gameexplorer\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0109.067] GetFileType (hFile=0x220) returned 0x1
	[0109.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0109.067] GetFileType (hFile=0x220) returned 0x1
	[0109.068] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0109.068] ReadFile (in: hFile=0x220, lpBuffer=0x25fc898, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x25fc898*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0109.070] CloseHandle (hObject=0x220) returned 1
	[0109.071] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x42
	[0109.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0109.071] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\gameexplorer\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0109.072] GetFileType (hFile=0x220) returned 0x1
	[0109.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0109.072] GetFileType (hFile=0x220) returned 0x1
	[0109.073] WriteFile (in: hFile=0x220, lpBuffer=0x25fef80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x25fef80*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0109.076] CloseHandle (hObject=0x220) returned 1
	[0109.076] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0109.076] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\gameexplorer\\decrypt.txt")) returned 1
	[0109.080] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.080] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0109.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0109.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0109.080] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0109.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.081] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\gameexplorer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0109.081] GetFileType (hFile=0x208) returned 0x1
	[0109.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0109.082] GetFileType (hFile=0x208) returned 0x1
	[0109.082] WriteFile (in: hFile=0x208, lpBuffer=0x2601668*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2601668*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0109.085] CloseHandle (hObject=0x208) returned 1
	[0109.085] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf65de710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf65de710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1
	[0109.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0109.086] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics", lpFilePart=0x0) returned 0x41
	[0109.086] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", lpFilePart=0x0) returned 0x42
	[0109.086] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf65de710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf65de710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0109.087] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf65de710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf65de710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.088] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf65de710, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf65de710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf65de710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.089] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f828940, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x2b0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-ntkl.etl", cAlternateFileName="ENERGY~2.ETL")) returned 1
	[0109.089] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9bd2ca0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9bd2ca0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xd9bd2ca0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x7122, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-12.xml", cAlternateFileName="ENERGY~2.XML")) returned 1
	[0109.090] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e53620, ftCreationTime.dwHighDateTime=0x1d305f5, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-26.xml", cAlternateFileName="ENERGY~3.XML")) returned 1
	[0109.091] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b145c0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9b145c0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-latest.xml", cAlternateFileName="ENERGY~1.XML")) returned 1
	[0109.091] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf65b85b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf65b85b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf65de710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report.html.KEKW", cAlternateFileName="ENERGY~1.KEK")) returned 1
	[0109.092] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 1
	[0109.093] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 0
	[0109.093] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0109.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0109.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0109.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0109.094] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics", lpFilePart=0x0) returned 0x41
	[0109.094] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\", lpFilePart=0x0) returned 0x42
	[0109.094] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf65de710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf65de710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0109.095] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf65de710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf65de710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.095] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf65de710, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf65de710, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf65de710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.096] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0109.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0109.096] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0109.096] GetFileType (hFile=0x220) returned 0x1
	[0109.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0109.097] GetFileType (hFile=0x220) returned 0x1
	[0109.097] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0109.097] ReadFile (in: hFile=0x220, lpBuffer=0x2604f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2604f44*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0109.100] CloseHandle (hObject=0x220) returned 1
	[0109.101] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x52
	[0109.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0109.101] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0109.102] GetFileType (hFile=0x220) returned 0x1
	[0109.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0109.102] GetFileType (hFile=0x220) returned 0x1
	[0109.103] WriteFile (in: hFile=0x220, lpBuffer=0x260766c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x260766c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0109.106] CloseHandle (hObject=0x220) returned 1
	[0109.107] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0109.107] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\decrypt.txt")) returned 1
	[0109.111] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f828940, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x2b0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-ntkl.etl", cAlternateFileName="ENERGY~2.ETL")) returned 1
	[0109.112] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9bd2ca0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9bd2ca0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xd9bd2ca0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x7122, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-12.xml", cAlternateFileName="ENERGY~2.XML")) returned 1
	[0109.112] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e53620, ftCreationTime.dwHighDateTime=0x1d305f5, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-26.xml", cAlternateFileName="ENERGY~3.XML")) returned 1
	[0109.113] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b145c0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9b145c0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-latest.xml", cAlternateFileName="ENERGY~1.XML")) returned 1
	[0109.113] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf65b85b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf65b85b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf65de710, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report.html.KEKW", cAlternateFileName="ENERGY~1.KEK")) returned 1
	[0109.114] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 1
	[0109.114] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.115] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0109.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0109.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0109.115] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0109.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.116] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0109.116] GetFileType (hFile=0x208) returned 0x1
	[0109.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0109.117] GetFileType (hFile=0x208) returned 0x1
	[0109.117] WriteFile (in: hFile=0x208, lpBuffer=0x260b9ac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x260b9ac*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0109.120] CloseHandle (hObject=0x208) returned 1
	[0109.121] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf662a9d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf662a9d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1
	[0109.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0109.121] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x2e
	[0109.121] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x2f
	[0109.122] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf662a9d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf662a9d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0109.122] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf662a9d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf662a9d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.123] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf662a9d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf662a9d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6650b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.124] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0109.124] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1
	[0109.126] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1
	[0109.126] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1
	[0109.127] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1
	[0109.127] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1
	[0109.128] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1
	[0109.129] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1
	[0109.129] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1
	[0109.130] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1
	[0109.131] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1
	[0109.131] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0
	[0109.132] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0109.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0109.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0109.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0109.132] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x2e
	[0109.133] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x2f
	[0109.133] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf662a9d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf662a9d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0109.133] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf662a9d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf662a9d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.134] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf662a9d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf662a9d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6650b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.134] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0109.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0109.135] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0109.135] GetFileType (hFile=0x220) returned 0x1
	[0109.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0109.135] GetFileType (hFile=0x220) returned 0x1
	[0109.135] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0109.136] ReadFile (in: hFile=0x220, lpBuffer=0x260f198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x260f198*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0109.139] CloseHandle (hObject=0x220) returned 1
	[0109.139] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3f
	[0109.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0109.139] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0109.140] GetFileType (hFile=0x220) returned 0x1
	[0109.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0109.141] GetFileType (hFile=0x220) returned 0x1
	[0109.141] WriteFile (in: hFile=0x220, lpBuffer=0x2611870*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2611870*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0109.144] CloseHandle (hObject=0x220) returned 1
	[0109.145] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0109.145] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\decrypt.txt")) returned 1
	[0109.149] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0109.149] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1
	[0109.149] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1
	[0109.150] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1
	[0109.150] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1
	[0109.151] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1
	[0109.151] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1
	[0109.152] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1
	[0109.152] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1
	[0109.152] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1
	[0109.153] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1
	[0109.153] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.154] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0109.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0109.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0109.154] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0109.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.155] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0109.155] GetFileType (hFile=0x208) returned 0x1
	[0109.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0109.155] GetFileType (hFile=0x208) returned 0x1
	[0109.157] WriteFile (in: hFile=0x208, lpBuffer=0x2616624*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2616624*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0109.163] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sqm", cAlternateFileName="")) returned 1
	[0109.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0109.163] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm", lpFilePart=0x0) returned 0x28
	[0109.164] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\", lpFilePart=0x0) returned 0x29
	[0109.164] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0109.165] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.165] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf669cdf0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf66c2f50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.166] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf6650b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6650b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest", cAlternateFileName="")) returned 1
	[0109.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0109.166] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest", lpFilePart=0x0) returned 0x31
	[0109.166] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\", lpFilePart=0x0) returned 0x32
	[0109.166] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf6650b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6650b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0109.167] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf6650b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6650b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.167] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6650b30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6650b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6676c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.168] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6650b30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6650b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6676c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0109.168] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0109.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0109.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0109.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0109.169] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest", lpFilePart=0x0) returned 0x31
	[0109.169] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\", lpFilePart=0x0) returned 0x32
	[0109.169] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf6650b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6650b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0109.170] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf6650b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6650b30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.170] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6650b30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6650b30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6676c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.170] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0109.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0109.171] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\manifest\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0109.171] GetFileType (hFile=0x224) returned 0x1
	[0109.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0109.171] GetFileType (hFile=0x224) returned 0x1
	[0109.171] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0109.172] ReadFile (in: hFile=0x224, lpBuffer=0x26197a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26197a0*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.174] CloseHandle (hObject=0x224) returned 1
	[0109.174] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x42
	[0109.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0109.175] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\manifest\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0109.176] GetFileType (hFile=0x224) returned 0x1
	[0109.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0109.176] GetFileType (hFile=0x224) returned 0x1
	[0109.176] WriteFile (in: hFile=0x224, lpBuffer=0x261be88*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x261be88*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0109.179] CloseHandle (hObject=0x224) returned 1
	[0109.179] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0109.180] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\manifest\\decrypt.txt")) returned 1
	[0109.183] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.183] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0109.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0109.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0109.184] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0109.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.184] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\manifest\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0109.185] GetFileType (hFile=0x220) returned 0x1
	[0109.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0109.185] GetFileType (hFile=0x220) returned 0x1
	[0109.185] WriteFile (in: hFile=0x220, lpBuffer=0x261e570*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x261e570*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.190] CloseHandle (hObject=0x220) returned 1
	[0109.190] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf6676c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6676c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1
	[0109.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0109.191] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions", lpFilePart=0x0) returned 0x31
	[0109.191] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\", lpFilePart=0x0) returned 0x32
	[0109.191] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf6676c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6676c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0109.192] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf6676c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6676c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.192] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6676c90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6676c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6676c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.193] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6676c90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6676c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6676c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0109.193] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0109.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0109.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0109.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0109.194] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions", lpFilePart=0x0) returned 0x31
	[0109.194] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\", lpFilePart=0x0) returned 0x32
	[0109.194] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf6676c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6676c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0109.195] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf6676c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6676c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.196] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6676c90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6676c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6676c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.196] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0109.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0109.196] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\sessions\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0109.197] GetFileType (hFile=0x224) returned 0x1
	[0109.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0109.197] GetFileType (hFile=0x224) returned 0x1
	[0109.197] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0109.198] ReadFile (in: hFile=0x224, lpBuffer=0x2620d80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2620d80*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.200] CloseHandle (hObject=0x224) returned 1
	[0109.201] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x42
	[0109.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0109.201] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\sessions\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0109.202] GetFileType (hFile=0x224) returned 0x1
	[0109.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0109.202] GetFileType (hFile=0x224) returned 0x1
	[0109.203] WriteFile (in: hFile=0x224, lpBuffer=0x2623468*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2623468*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0109.207] CloseHandle (hObject=0x224) returned 1
	[0109.207] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0109.207] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\sessions\\decrypt.txt")) returned 1
	[0109.210] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.211] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0109.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0109.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0109.211] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0109.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.212] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\sessions\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0109.212] GetFileType (hFile=0x220) returned 0x1
	[0109.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0109.213] GetFileType (hFile=0x220) returned 0x1
	[0109.213] WriteFile (in: hFile=0x220, lpBuffer=0x2625b50*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2625b50*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.216] CloseHandle (hObject=0x220) returned 1
	[0109.216] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1
	[0109.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0109.217] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload", lpFilePart=0x0) returned 0x2f
	[0109.217] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\", lpFilePart=0x0) returned 0x30
	[0109.217] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0109.218] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.219] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf669cdf0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.220] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf669cdf0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0109.220] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0109.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0109.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0109.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0109.221] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload", lpFilePart=0x0) returned 0x2f
	[0109.221] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\", lpFilePart=0x0) returned 0x30
	[0109.221] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0109.222] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.222] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf669cdf0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.223] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0109.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0109.223] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\upload\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0109.224] GetFileType (hFile=0x224) returned 0x1
	[0109.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0109.224] GetFileType (hFile=0x224) returned 0x1
	[0109.224] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0109.224] ReadFile (in: hFile=0x224, lpBuffer=0x26282cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26282cc*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.227] CloseHandle (hObject=0x224) returned 1
	[0109.228] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x40
	[0109.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0109.228] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\upload\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0109.229] GetFileType (hFile=0x224) returned 0x1
	[0109.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0109.229] GetFileType (hFile=0x224) returned 0x1
	[0109.230] WriteFile (in: hFile=0x224, lpBuffer=0x262a9ac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x262a9ac*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0109.232] CloseHandle (hObject=0x224) returned 1
	[0109.233] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0109.233] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\upload\\decrypt.txt")) returned 1
	[0109.239] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.240] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0109.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0109.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0109.240] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0109.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.241] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\upload\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0109.241] GetFileType (hFile=0x220) returned 0x1
	[0109.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0109.242] GetFileType (hFile=0x220) returned 0x1
	[0109.242] WriteFile (in: hFile=0x220, lpBuffer=0x262d088*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x262d088*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.245] CloseHandle (hObject=0x220) returned 1
	[0109.255] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.256] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0109.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0109.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0109.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0109.256] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm", lpFilePart=0x0) returned 0x28
	[0109.256] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\", lpFilePart=0x0) returned 0x29
	[0109.257] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0109.257] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf669cdf0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.258] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf669cdf0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf669cdf0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf66c2f50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.258] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0109.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0109.259] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0109.259] GetFileType (hFile=0x220) returned 0x1
	[0109.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0109.259] GetFileType (hFile=0x220) returned 0x1
	[0109.260] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0109.260] ReadFile (in: hFile=0x220, lpBuffer=0x262ec98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x262ec98*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0109.263] CloseHandle (hObject=0x220) returned 1
	[0109.263] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x39
	[0109.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0109.263] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0109.265] GetFileType (hFile=0x220) returned 0x1
	[0109.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0109.266] GetFileType (hFile=0x220) returned 0x1
	[0109.266] WriteFile (in: hFile=0x220, lpBuffer=0x2631358*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2631358*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0109.269] CloseHandle (hObject=0x220) returned 1
	[0109.269] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0109.270] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\decrypt.txt")) returned 1
	[0109.273] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x12052050, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12052050, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest", cAlternateFileName="")) returned 1
	[0109.274] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x1209e310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1209e310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1
	[0109.274] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x120ea5d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x120ea5d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1
	[0109.275] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x120ea5d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x120ea5d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 0
	[0109.275] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0109.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0109.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0109.276] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0109.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.276] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0109.286] GetFileType (hFile=0x208) returned 0x1
	[0109.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0109.286] GetFileType (hFile=0x208) returned 0x1
	[0109.287] WriteFile (in: hFile=0x208, lpBuffer=0x2633d5c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2633d5c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0109.290] CloseHandle (hObject=0x208) returned 1
	[0109.290] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68d8290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0109.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0109.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x2f
	[0109.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x30
	[0109.291] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68d8290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0109.292] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68d8290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.293] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf68d8290, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68d8290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.293] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 1
	[0109.294] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0109.294] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68b2130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68b2130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1
	[0109.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0109.295] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x38
	[0109.295] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x39
	[0109.295] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68b2130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68b2130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0109.296] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68b2130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68b2130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.296] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6781630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1
	[0109.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.297] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x44
	[0109.297] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x45
	[0109.297] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6781630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0109.298] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6781630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.299] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf66e90b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf66e90b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1
	[0109.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.299] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x52
	[0109.299] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x53
	[0109.299] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf66e90b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf66e90b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0109.300] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf66e90b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf66e90b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.301] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66e90b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf66e90b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf66e90b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.301] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0109.302] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 1
	[0109.302] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0
	[0109.302] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0109.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0109.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0109.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.303] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x52
	[0109.303] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x53
	[0109.303] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf66e90b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf66e90b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0109.304] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf66e90b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf66e90b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.305] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66e90b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf66e90b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf66e90b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.305] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0109.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0109.305] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0109.305] GetFileType (hFile=0x22c) returned 0x1
	[0109.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0109.306] GetFileType (hFile=0x22c) returned 0x1
	[0109.306] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xa5
	[0109.306] ReadFile (in: hFile=0x22c, lpBuffer=0x2639690, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x2639690*, lpNumberOfBytesRead=0x26eca4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.309] CloseHandle (hObject=0x22c) returned 1
	[0109.309] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x63
	[0109.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0109.310] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0109.317] GetFileType (hFile=0x22c) returned 0x1
	[0109.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0109.317] GetFileType (hFile=0x22c) returned 0x1
	[0109.318] WriteFile (in: hFile=0x22c, lpBuffer=0x263bdf8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x263bdf8*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0109.324] CloseHandle (hObject=0x22c) returned 1
	[0109.324] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0109.325] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\decrypt.txt")) returned 1
	[0109.331] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0109.332] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 1
	[0109.332] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.333] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0109.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0109.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0109.335] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0109.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0109.336] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0109.339] GetFileType (hFile=0x228) returned 0x1
	[0109.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0109.340] GetFileType (hFile=0x228) returned 0x1
	[0109.340] WriteFile (in: hFile=0x228, lpBuffer=0x263ef94*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x263ef94*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0109.344] CloseHandle (hObject=0x228) returned 1
	[0109.345] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1
	[0109.345] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6781630, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6781630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.346] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0109.346] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 1
	[0109.347] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 1
	[0109.348] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 1
	[0109.348] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 1
	[0109.349] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paint.lnk", cAlternateFileName="")) returned 1
	[0109.350] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1
	[0109.350] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 1
	[0109.351] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 1
	[0109.351] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 1
	[0109.352] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 1
	[0109.353] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf670f210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf670f210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1
	[0109.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.353] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x51
	[0109.353] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x52
	[0109.354] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf670f210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf670f210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0109.354] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf670f210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf670f210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.355] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 1
	[0109.355] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf670f210, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf670f210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6735370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.356] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0109.356] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1
	[0109.357] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 1
	[0109.358] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 1
	[0109.358] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1
	[0109.359] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 1
	[0109.360] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1
	[0109.360] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0109.361] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0109.362] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0
	[0109.362] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0109.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0109.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0109.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.363] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x51
	[0109.363] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x52
	[0109.363] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf670f210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf670f210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0109.364] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf670f210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf670f210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.364] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 1
	[0109.365] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf670f210, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf670f210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6735370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.365] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0109.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0109.365] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0109.366] GetFileType (hFile=0x22c) returned 0x1
	[0109.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0109.366] GetFileType (hFile=0x22c) returned 0x1
	[0109.366] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xa5
	[0109.366] ReadFile (in: hFile=0x22c, lpBuffer=0x2645320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x2645320*, lpNumberOfBytesRead=0x26eca4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.369] CloseHandle (hObject=0x22c) returned 1
	[0109.369] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x62
	[0109.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0109.370] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0109.373] GetFileType (hFile=0x22c) returned 0x1
	[0109.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0109.373] GetFileType (hFile=0x22c) returned 0x1
	[0109.374] WriteFile (in: hFile=0x22c, lpBuffer=0x2647a88*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x2647a88*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0109.381] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0109.381] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\decrypt.txt")) returned 1
	[0109.385] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0109.386] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1
	[0109.386] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 1
	[0109.386] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 1
	[0109.387] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1
	[0109.387] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 1
	[0109.388] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1
	[0109.388] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0109.388] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0109.389] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.389] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0109.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0109.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0109.390] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x5d
	[0109.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0109.390] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0109.393] GetFileType (hFile=0x228) returned 0x1
	[0109.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0109.393] GetFileType (hFile=0x228) returned 0x1
	[0109.394] WriteFile (in: hFile=0x228, lpBuffer=0x264d000*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x264d000*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0109.398] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf6735370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6735370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1
	[0109.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.398] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC", lpFilePart=0x0) returned 0x4e
	[0109.398] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\", lpFilePart=0x0) returned 0x4f
	[0109.398] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf6735370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6735370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0109.399] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf6735370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6735370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.400] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6735370, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6735370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6735370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.400] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0109.401] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 1
	[0109.401] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.lnk", cAlternateFileName="")) returned 1
	[0109.402] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0109.403] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0
	[0109.403] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0109.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0109.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0109.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.403] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC", lpFilePart=0x0) returned 0x4e
	[0109.404] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\", lpFilePart=0x0) returned 0x4f
	[0109.404] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf6735370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6735370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0109.404] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf6735370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6735370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.405] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6735370, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6735370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6735370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.405] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0109.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0109.405] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0109.406] GetFileType (hFile=0x22c) returned 0x1
	[0109.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0109.406] GetFileType (hFile=0x22c) returned 0x1
	[0109.406] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xa5
	[0109.406] ReadFile (in: hFile=0x22c, lpBuffer=0x2650854, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x2650854*, lpNumberOfBytesRead=0x26eca4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.409] CloseHandle (hObject=0x22c) returned 1
	[0109.409] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x5f
	[0109.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0109.410] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0109.413] GetFileType (hFile=0x22c) returned 0x1
	[0109.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0109.413] GetFileType (hFile=0x22c) returned 0x1
	[0109.414] WriteFile (in: hFile=0x22c, lpBuffer=0x2652fac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x2652fac*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0109.417] CloseHandle (hObject=0x22c) returned 1
	[0109.418] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0109.418] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\decrypt.txt")) returned 1
	[0109.423] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0109.423] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 1
	[0109.424] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.lnk", cAlternateFileName="")) returned 1
	[0109.424] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0109.425] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.425] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0109.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0109.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0109.427] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0109.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0109.427] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0109.430] GetFileType (hFile=0x228) returned 0x1
	[0109.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0109.430] GetFileType (hFile=0x228) returned 0x1
	[0109.430] WriteFile (in: hFile=0x228, lpBuffer=0x2656a18*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2656a18*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0109.433] CloseHandle (hObject=0x228) returned 1
	[0109.435] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 1
	[0109.435] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf675b4d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf675b4d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1
	[0109.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.436] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell", lpFilePart=0x0) returned 0x57
	[0109.436] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\", lpFilePart=0x0) returned 0x58
	[0109.437] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf675b4d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf675b4d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0109.445] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf675b4d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf675b4d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.446] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf675b4d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf675b4d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf675b4d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.446] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0109.447] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0109.448] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1
	[0109.448] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1
	[0109.449] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0109.449] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0
	[0109.450] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0109.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0109.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0109.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.451] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell", lpFilePart=0x0) returned 0x57
	[0109.451] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\", lpFilePart=0x0) returned 0x58
	[0109.451] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf675b4d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf675b4d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0109.452] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf675b4d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf675b4d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.453] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf675b4d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf675b4d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf675b4d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.453] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0109.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0109.454] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0109.454] GetFileType (hFile=0x22c) returned 0x1
	[0109.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0109.454] GetFileType (hFile=0x22c) returned 0x1
	[0109.455] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xa5
	[0109.455] ReadFile (in: hFile=0x22c, lpBuffer=0x265aacc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x265aacc*, lpNumberOfBytesRead=0x26eca4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.458] CloseHandle (hObject=0x22c) returned 1
	[0109.458] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x68
	[0109.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0109.458] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0109.462] GetFileType (hFile=0x22c) returned 0x1
	[0109.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0109.462] GetFileType (hFile=0x22c) returned 0x1
	[0109.463] WriteFile (in: hFile=0x22c, lpBuffer=0x265d24c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x265d24c*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0109.466] CloseHandle (hObject=0x22c) returned 1
	[0109.467] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0109.468] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\decrypt.txt")) returned 1
	[0109.515] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0109.516] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0109.516] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1
	[0109.517] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1
	[0109.517] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0109.518] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.518] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0109.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0109.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0109.520] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt", lpFilePart=0x0) returned 0x63
	[0109.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0109.520] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0109.523] GetFileType (hFile=0x228) returned 0x1
	[0109.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0109.523] GetFileType (hFile=0x228) returned 0x1
	[0109.524] WriteFile (in: hFile=0x228, lpBuffer=0x26615d4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26615d4*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0109.527] CloseHandle (hObject=0x228) returned 1
	[0109.528] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1
	[0109.528] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0
	[0109.529] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0109.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0109.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0109.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.529] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x44
	[0109.529] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x45
	[0109.530] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6781630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0109.530] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6781630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.531] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x121cee10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x121cee10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1
	[0109.532] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1
	[0109.532] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6781630, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6781630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.532] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0109.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0109.533] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0109.533] GetFileType (hFile=0x228) returned 0x1
	[0109.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0109.533] GetFileType (hFile=0x228) returned 0x1
	[0109.534] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0109.534] ReadFile (in: hFile=0x228, lpBuffer=0x2663de8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2663de8*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0109.536] CloseHandle (hObject=0x228) returned 1
	[0109.537] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x55
	[0109.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0109.537] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0109.563] GetFileType (hFile=0x228) returned 0x1
	[0109.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0109.563] GetFileType (hFile=0x228) returned 0x1
	[0109.564] WriteFile (in: hFile=0x228, lpBuffer=0x2666518*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2666518*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0109.567] CloseHandle (hObject=0x228) returned 1
	[0109.568] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0109.568] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\decrypt.txt")) returned 1
	[0109.573] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0109.573] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 1
	[0109.574] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 1
	[0109.574] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 1
	[0109.575] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 1
	[0109.575] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paint.lnk", cAlternateFileName="")) returned 1
	[0109.575] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1
	[0109.576] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 1
	[0109.576] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 1
	[0109.578] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 1
	[0109.578] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 1
	[0109.579] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12267390, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12267390, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1
	[0109.579] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x122b3650, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x122b3650, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1
	[0109.580] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 1
	[0109.580] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x12397e90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12397e90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1
	[0109.581] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1
	[0109.581] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.582] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0109.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0109.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0109.583] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0109.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0109.583] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0109.586] GetFileType (hFile=0x224) returned 0x1
	[0109.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0109.586] GetFileType (hFile=0x224) returned 0x1
	[0109.586] WriteFile (in: hFile=0x224, lpBuffer=0x266cbec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x266cbec*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0109.589] CloseHandle (hObject=0x224) returned 1
	[0109.591] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6781630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1
	[0109.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.591] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x4d
	[0109.591] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x4e
	[0109.592] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6781630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0109.592] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6781630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.593] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 1
	[0109.594] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 1
	[0109.595] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 1
	[0109.595] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6781630, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67a7790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.596] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0109.596] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 1
	[0109.597] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 1
	[0109.597] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 1
	[0109.598] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 1
	[0109.599] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8071cca0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 1
	[0109.609] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c3cfe0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 1
	[0109.609] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="services.lnk", cAlternateFileName="")) returned 1
	[0109.627] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1
	[0109.657] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1
	[0109.658] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0109.658] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0109.659] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0
	[0109.659] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0109.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0109.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0109.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.660] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x4d
	[0109.660] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x4e
	[0109.660] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6781630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0109.661] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6781630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.662] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 1
	[0109.662] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 1
	[0109.663] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 1
	[0109.663] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6781630, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6781630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67a7790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.663] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0109.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0109.664] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0109.664] GetFileType (hFile=0x228) returned 0x1
	[0109.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0109.664] GetFileType (hFile=0x228) returned 0x1
	[0109.665] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0109.665] ReadFile (in: hFile=0x228, lpBuffer=0x2672c04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2672c04*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0109.668] CloseHandle (hObject=0x228) returned 1
	[0109.668] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x5e
	[0109.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0109.669] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0109.673] GetFileType (hFile=0x228) returned 0x1
	[0109.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0109.674] GetFileType (hFile=0x228) returned 0x1
	[0109.674] WriteFile (in: hFile=0x228, lpBuffer=0x267535c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x267535c*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0109.678] CloseHandle (hObject=0x228) returned 1
	[0109.679] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0109.679] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\decrypt.txt")) returned 1
	[0109.684] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0109.684] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 1
	[0109.685] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 1
	[0109.685] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 1
	[0109.685] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 1
	[0109.686] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8071cca0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 1
	[0109.691] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0109.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0109.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0109.694] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0109.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0109.695] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0109.698] GetFileType (hFile=0x224) returned 0x1
	[0109.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0109.698] GetFileType (hFile=0x224) returned 0x1
	[0109.699] WriteFile (in: hFile=0x224, lpBuffer=0x267b87c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x267b87c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0109.702] CloseHandle (hObject=0x224) returned 1
	[0109.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.705] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games", lpFilePart=0x0) returned 0x3e
	[0109.706] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\", lpFilePart=0x0) returned 0x3f
	[0109.706] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf67a7790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67a7790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0109.710] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0109.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0109.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0109.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.710] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games", lpFilePart=0x0) returned 0x3e
	[0109.710] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\", lpFilePart=0x0) returned 0x3f
	[0109.711] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf67a7790, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67a7790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0109.712] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0109.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0109.712] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0109.712] GetFileType (hFile=0x228) returned 0x1
	[0109.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0109.713] GetFileType (hFile=0x228) returned 0x1
	[0109.713] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0109.713] ReadFile (in: hFile=0x228, lpBuffer=0x267ec50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x267ec50*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0109.716] CloseHandle (hObject=0x228) returned 1
	[0109.716] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x4f
	[0109.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0109.717] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0109.720] GetFileType (hFile=0x228) returned 0x1
	[0109.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0109.720] GetFileType (hFile=0x228) returned 0x1
	[0109.721] WriteFile (in: hFile=0x228, lpBuffer=0x2681368*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2681368*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0109.725] CloseHandle (hObject=0x228) returned 1
	[0109.726] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0109.726] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\decrypt.txt")) returned 1
	[0109.736] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0109.736] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 1
	[0109.737] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.737] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0109.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0109.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0109.739] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt", lpFilePart=0x0) returned 0x4a
	[0109.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0109.739] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0109.742] GetFileType (hFile=0x224) returned 0x1
	[0109.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0109.742] GetFileType (hFile=0x224) returned 0x1
	[0109.742] WriteFile (in: hFile=0x224, lpBuffer=0x26842b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26842b4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0109.746] CloseHandle (hObject=0x224) returned 1
	[0109.747] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1
	[0109.751] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf67cd8f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67cd8f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0109.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.751] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java", lpFilePart=0x0) returned 0x3d
	[0109.751] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\", lpFilePart=0x0) returned 0x3e
	[0109.752] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf67cd8f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67cd8f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0109.753] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf67cd8f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67cd8f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.753] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 1
	[0109.754] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 1
	[0109.754] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 1
	[0109.755] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf67cd8f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf67cd8f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67f3a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.755] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Help.lnk", cAlternateFileName="GETHEL~1.LNK")) returned 1
	[0109.756] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 1
	[0109.757] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 0
	[0109.757] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0109.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0109.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0109.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.758] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java", lpFilePart=0x0) returned 0x3d
	[0109.758] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\", lpFilePart=0x0) returned 0x3e
	[0109.758] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf67cd8f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67cd8f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0109.759] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf67cd8f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67cd8f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.759] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 1
	[0109.760] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 1
	[0109.760] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 1
	[0109.761] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf67cd8f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf67cd8f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67f3a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.761] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0109.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0109.761] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0109.762] GetFileType (hFile=0x228) returned 0x1
	[0109.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0109.762] GetFileType (hFile=0x228) returned 0x1
	[0109.762] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0109.762] ReadFile (in: hFile=0x228, lpBuffer=0x26885b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26885b8*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0109.765] CloseHandle (hObject=0x228) returned 1
	[0109.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x4e
	[0109.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0109.766] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0109.769] GetFileType (hFile=0x228) returned 0x1
	[0109.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0109.769] GetFileType (hFile=0x228) returned 0x1
	[0109.770] WriteFile (in: hFile=0x228, lpBuffer=0x268acd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x268acd0*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0109.773] CloseHandle (hObject=0x228) returned 1
	[0109.776] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0109.776] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\decrypt.txt")) returned 1
	[0109.781] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Help.lnk", cAlternateFileName="GETHEL~1.LNK")) returned 1
	[0109.782] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 1
	[0109.782] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.782] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0109.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0109.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0109.784] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0109.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0109.784] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0109.787] GetFileType (hFile=0x224) returned 0x1
	[0109.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0109.787] GetFileType (hFile=0x224) returned 0x1
	[0109.788] WriteFile (in: hFile=0x224, lpBuffer=0x268dc60*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x268dc60*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0109.790] CloseHandle (hObject=0x224) returned 1
	[0109.792] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf67f3a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67f3a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1
	[0109.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.792] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x44
	[0109.792] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x45
	[0109.792] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf67f3a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67f3a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0109.793] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf67f3a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67f3a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.794] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 1
	[0109.794] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 1
	[0109.795] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf67f3a50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf67f3a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67f3a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.796] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0109.796] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1
	[0109.797] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0
	[0109.797] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0109.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0109.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0109.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.798] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x44
	[0109.798] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x45
	[0109.798] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf67f3a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67f3a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0109.799] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf67f3a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67f3a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.799] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 1
	[0109.800] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 1
	[0109.800] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf67f3a50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf67f3a50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf67f3a50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.801] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0109.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0109.801] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0109.801] GetFileType (hFile=0x228) returned 0x1
	[0109.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0109.802] GetFileType (hFile=0x228) returned 0x1
	[0109.802] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0109.802] ReadFile (in: hFile=0x228, lpBuffer=0x2691c00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2691c00*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0109.805] CloseHandle (hObject=0x228) returned 1
	[0109.805] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x55
	[0109.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0109.806] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0109.809] GetFileType (hFile=0x228) returned 0x1
	[0109.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0109.809] GetFileType (hFile=0x228) returned 0x1
	[0109.809] WriteFile (in: hFile=0x228, lpBuffer=0x2694330*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2694330*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0109.813] CloseHandle (hObject=0x228) returned 1
	[0109.814] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0109.815] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\decrypt.txt")) returned 1
	[0109.819] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0109.819] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1
	[0109.820] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.820] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0109.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0109.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0109.821] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0109.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0109.822] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0109.824] GetFileType (hFile=0x224) returned 0x1
	[0109.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0109.824] GetFileType (hFile=0x224) returned 0x1
	[0109.825] WriteFile (in: hFile=0x224, lpBuffer=0x2697358*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2697358*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0109.828] CloseHandle (hObject=0x224) returned 1
	[0109.829] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 1
	[0109.830] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf683fd10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf683fd10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1
	[0109.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.831] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office", lpFilePart=0x0) returned 0x49
	[0109.831] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\", lpFilePart=0x0) returned 0x4a
	[0109.831] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf683fd10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf683fd10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0109.832] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf683fd10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf683fd10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.832] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf683fd10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf683fd10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf683fd10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.833] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Access 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1
	[0109.834] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Excel 2010.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1
	[0109.834] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Designer 2010.lnk", cAlternateFileName="MIA4FF~1.LNK")) returned 1
	[0109.835] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Filler 2010.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1
	[0109.836] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf6819bb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6819bb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Tools", cAlternateFileName="MICROS~1")) returned 1
	[0109.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools", lpFilePart=0x0) returned 0x65
	[0109.837] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\", lpFilePart=0x0) returned 0x66
	[0109.837] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf6819bb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6819bb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0109.838] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf6819bb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6819bb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.838] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6819bb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6819bb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf683fd10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.839] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Digital Certificate for VBA Projects.lnk", cAlternateFileName="DIGITA~1.LNK")) returned 1
	[0109.840] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb65, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Clip Organizer.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1
	[0109.840] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xabf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Language Preferences.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1
	[0109.841] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Upload Center.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1
	[0109.841] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office Picture Manager.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1
	[0109.842] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 1
	[0109.843] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 0
	[0109.844] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0109.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0109.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0109.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0109.844] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools", lpFilePart=0x0) returned 0x65
	[0109.844] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\", lpFilePart=0x0) returned 0x66
	[0109.845] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf6819bb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6819bb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0109.845] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf6819bb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6819bb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.846] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6819bb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6819bb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf683fd10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.846] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x71
	[0109.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0109.847] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0109.847] GetFileType (hFile=0x22c) returned 0x1
	[0109.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0109.847] GetFileType (hFile=0x22c) returned 0x1
	[0109.847] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xa5
	[0109.848] ReadFile (in: hFile=0x22c, lpBuffer=0x269d4e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x269d4e8*, lpNumberOfBytesRead=0x26eca4*=0xa5, lpOverlapped=0x0) returned 1
	[0109.851] CloseHandle (hObject=0x22c) returned 1
	[0109.851] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x76
	[0109.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0109.851] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0109.855] GetFileType (hFile=0x22c) returned 0x1
	[0109.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0109.855] GetFileType (hFile=0x22c) returned 0x1
	[0109.856] WriteFile (in: hFile=0x22c, lpBuffer=0x269fca0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x269fca0*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0109.861] CloseHandle (hObject=0x22c) returned 1
	[0109.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x71
	[0109.862] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\decrypt.txt")) returned 1
	[0109.867] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Digital Certificate for VBA Projects.lnk", cAlternateFileName="DIGITA~1.LNK")) returned 1
	[0109.867] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb65, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Clip Organizer.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1
	[0109.867] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xabf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Language Preferences.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1
	[0109.868] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Upload Center.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1
	[0109.868] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office Picture Manager.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1
	[0109.869] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 1
	[0109.869] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0109.869] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0109.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0109.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0109.871] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x71
	[0109.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0109.871] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0109.874] GetFileType (hFile=0x228) returned 0x1
	[0109.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0109.875] GetFileType (hFile=0x228) returned 0x1
	[0109.875] WriteFile (in: hFile=0x228, lpBuffer=0x26a4da4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26a4da4*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0109.878] CloseHandle (hObject=0x228) returned 1
	[0109.880] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneNote 2010.lnk", cAlternateFileName="MI807F~1.LNK")) returned 1
	[0109.880] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Outlook 2010.lnk", cAlternateFileName="MI4465~1.LNK")) returned 1
	[0109.881] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft PowerPoint 2010.lnk", cAlternateFileName="MIAF79~1.LNK")) returned 1
	[0109.881] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project 2010.lnk", cAlternateFileName="MI6860~1.LNK")) returned 1
	[0109.882] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Publisher 2010.lnk", cAlternateFileName="MI260D~1.LNK")) returned 1
	[0109.882] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1
	[0109.883] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87381f60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Visio 2010.lnk", cAlternateFileName="MI7E65~1.LNK")) returned 1
	[0109.884] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 1
	[0109.884] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 0
	[0109.885] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0109.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0109.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0109.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0109.886] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office", lpFilePart=0x0) returned 0x49
	[0109.886] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\", lpFilePart=0x0) returned 0x4a
	[0109.886] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf683fd10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf683fd10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0109.886] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf683fd10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf683fd10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0109.887] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf683fd10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf683fd10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf683fd10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0109.887] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0109.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0109.888] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0109.888] GetFileType (hFile=0x228) returned 0x1
	[0109.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0109.888] GetFileType (hFile=0x228) returned 0x1
	[0109.888] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0109.889] ReadFile (in: hFile=0x228, lpBuffer=0x26a80a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26a80a8*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0109.891] CloseHandle (hObject=0x228) returned 1
	[0109.892] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x5a
	[0109.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0109.892] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0110.408] GetFileType (hFile=0x228) returned 0x1
	[0110.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0110.408] GetFileType (hFile=0x228) returned 0x1
	[0110.409] WriteFile (in: hFile=0x228, lpBuffer=0x26aa7f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26aa7f0*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0110.413] CloseHandle (hObject=0x228) returned 1
	[0110.413] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0110.414] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\decrypt.txt")) returned 1
	[0110.416] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Access 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1
	[0110.417] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Excel 2010.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1
	[0110.417] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Designer 2010.lnk", cAlternateFileName="MIA4FF~1.LNK")) returned 1
	[0110.418] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Filler 2010.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1
	[0110.418] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x126ddcd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x126ddcd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Tools", cAlternateFileName="MICROS~1")) returned 1
	[0110.419] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneNote 2010.lnk", cAlternateFileName="MI807F~1.LNK")) returned 1
	[0110.419] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Outlook 2010.lnk", cAlternateFileName="MI4465~1.LNK")) returned 1
	[0110.420] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft PowerPoint 2010.lnk", cAlternateFileName="MIAF79~1.LNK")) returned 1
	[0110.421] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project 2010.lnk", cAlternateFileName="MI6860~1.LNK")) returned 1
	[0110.422] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Publisher 2010.lnk", cAlternateFileName="MI260D~1.LNK")) returned 1
	[0110.422] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1
	[0110.422] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87381f60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Visio 2010.lnk", cAlternateFileName="MI7E65~1.LNK")) returned 1
	[0110.423] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 1
	[0110.423] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.424] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0110.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0110.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0110.425] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0110.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0110.425] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0110.426] GetFileType (hFile=0x224) returned 0x1
	[0110.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0110.427] GetFileType (hFile=0x224) returned 0x1
	[0110.427] WriteFile (in: hFile=0x224, lpBuffer=0x26b1070*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26b1070*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0110.430] CloseHandle (hObject=0x224) returned 1
	[0110.431] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1
	[0110.431] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf6865e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6865e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1
	[0110.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0110.432] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint", lpFilePart=0x0) returned 0x43
	[0110.432] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\", lpFilePart=0x0) returned 0x44
	[0110.432] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf6865e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6865e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0110.434] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf6865e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6865e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.434] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6865e70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6865e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.435] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1
	[0110.435] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0
	[0110.436] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0110.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0110.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0110.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0110.437] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint", lpFilePart=0x0) returned 0x43
	[0110.437] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\", lpFilePart=0x0) returned 0x44
	[0110.437] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf6865e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6865e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0110.438] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf6865e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6865e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.438] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6865e70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6865e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.439] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0110.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0110.439] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0110.439] GetFileType (hFile=0x228) returned 0x1
	[0110.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0110.440] GetFileType (hFile=0x228) returned 0x1
	[0110.440] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0110.440] ReadFile (in: hFile=0x228, lpBuffer=0x26b4234, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26b4234*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0110.442] CloseHandle (hObject=0x228) returned 1
	[0110.443] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x54
	[0110.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0110.443] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0110.444] GetFileType (hFile=0x228) returned 0x1
	[0110.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0110.445] GetFileType (hFile=0x228) returned 0x1
	[0110.445] WriteFile (in: hFile=0x228, lpBuffer=0x26b6964*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26b6964*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0110.448] CloseHandle (hObject=0x228) returned 1
	[0110.449] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0110.449] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\decrypt.txt")) returned 1
	[0110.457] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1
	[0110.458] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.458] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0110.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0110.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0110.458] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0110.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0110.459] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0110.460] GetFileType (hFile=0x224) returned 0x1
	[0110.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0110.460] GetFileType (hFile=0x224) returned 0x1
	[0110.461] WriteFile (in: hFile=0x224, lpBuffer=0x26b9634*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26b9634*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0110.464] CloseHandle (hObject=0x224) returned 1
	[0110.464] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 1
	[0110.465] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1
	[0110.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0110.465] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x40
	[0110.465] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x41
	[0110.466] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0110.550] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.550] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf688bfd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.551] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0110.552] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0110.552] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0110.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0110.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0110.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0110.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x40
	[0110.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x41
	[0110.553] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0110.554] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.554] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf688bfd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.555] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0110.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0110.555] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0110.556] GetFileType (hFile=0x228) returned 0x1
	[0110.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0110.556] GetFileType (hFile=0x228) returned 0x1
	[0110.556] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0110.556] ReadFile (in: hFile=0x228, lpBuffer=0x26bc58c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26bc58c*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0110.559] CloseHandle (hObject=0x228) returned 1
	[0110.559] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x51
	[0110.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0110.560] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0110.562] GetFileType (hFile=0x228) returned 0x1
	[0110.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0110.562] GetFileType (hFile=0x228) returned 0x1
	[0110.562] WriteFile (in: hFile=0x228, lpBuffer=0x26becac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26becac*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0110.568] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0110.568] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\decrypt.txt")) returned 1
	[0110.572] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0110.572] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.572] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0110.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0110.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0110.573] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0110.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0110.573] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0110.574] GetFileType (hFile=0x224) returned 0x1
	[0110.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0110.574] GetFileType (hFile=0x224) returned 0x1
	[0110.575] WriteFile (in: hFile=0x224, lpBuffer=0x26c17e0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26c17e0*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0110.581] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1
	[0110.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0110.581] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC", lpFilePart=0x0) returned 0x42
	[0110.581] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\", lpFilePart=0x0) returned 0x43
	[0110.581] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0110.582] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.583] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf688bfd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68b2130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.583] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf688bfd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68b2130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0110.584] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0110.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0110.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0110.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0110.584] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC", lpFilePart=0x0) returned 0x42
	[0110.584] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\", lpFilePart=0x0) returned 0x43
	[0110.584] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0110.585] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf688bfd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.586] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf688bfd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf688bfd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68b2130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.586] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0110.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0110.586] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\tablet pc\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0110.587] GetFileType (hFile=0x228) returned 0x1
	[0110.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0110.587] GetFileType (hFile=0x228) returned 0x1
	[0110.587] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0110.587] ReadFile (in: hFile=0x228, lpBuffer=0x26c44fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26c44fc*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0110.590] CloseHandle (hObject=0x228) returned 1
	[0110.590] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x53
	[0110.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0110.591] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\tablet pc\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0110.592] GetFileType (hFile=0x228) returned 0x1
	[0110.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0110.592] GetFileType (hFile=0x228) returned 0x1
	[0110.593] WriteFile (in: hFile=0x228, lpBuffer=0x26c6c24*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26c6c24*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0110.596] CloseHandle (hObject=0x228) returned 1
	[0110.596] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0110.596] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\tablet pc\\decrypt.txt")) returned 1
	[0110.599] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.600] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0110.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0110.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0110.600] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0110.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0110.601] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\tablet pc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0110.601] GetFileType (hFile=0x224) returned 0x1
	[0110.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0110.601] GetFileType (hFile=0x224) returned 0x1
	[0110.602] WriteFile (in: hFile=0x224, lpBuffer=0x26c9378*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26c9378*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0110.605] CloseHandle (hObject=0x224) returned 1
	[0110.605] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1
	[0110.606] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1
	[0110.606] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0110.607] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0110.608] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 1
	[0110.608] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0
	[0110.609] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0110.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0110.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0110.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0110.610] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x38
	[0110.610] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x39
	[0110.610] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68b2130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68b2130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0110.611] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68b2130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68b2130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.611] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12430410, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12430410, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1
	[0110.612] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1253adb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1253adb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1
	[0110.612] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1
	[0110.613] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf68b2130, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf68b2130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68b2130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.613] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0110.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0110.614] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0110.614] GetFileType (hFile=0x224) returned 0x1
	[0110.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0110.614] GetFileType (hFile=0x224) returned 0x1
	[0110.614] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0110.614] ReadFile (in: hFile=0x224, lpBuffer=0x26cc2a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26cc2a8*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0110.618] CloseHandle (hObject=0x224) returned 1
	[0110.618] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x49
	[0110.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0110.618] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0110.619] GetFileType (hFile=0x224) returned 0x1
	[0110.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0110.620] GetFileType (hFile=0x224) returned 0x1
	[0110.620] WriteFile (in: hFile=0x224, lpBuffer=0x26ce9a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26ce9a8*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0110.630] CloseHandle (hObject=0x224) returned 1
	[0110.630] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0110.631] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\decrypt.txt")) returned 1
	[0110.634] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0110.635] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x125ad1d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x125ad1d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Games", cAlternateFileName="")) returned 1
	[0110.635] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1
	[0110.636] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x1261f5f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1261f5f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0110.636] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1266b8b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1266b8b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1
	[0110.637] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 1
	[0110.637] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x12c38e50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12c38e50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1
	[0110.638] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1
	[0110.638] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x12c85110, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12c85110, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1
	[0110.639] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 1
	[0110.639] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12d8fab0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12d8fab0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1
	[0110.640] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x12ddbd70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12ddbd70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1
	[0110.641] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1
	[0110.641] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1
	[0110.642] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0110.643] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0110.643] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 1
	[0110.644] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.644] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0110.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0110.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0110.644] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0110.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0110.645] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0110.646] GetFileType (hFile=0x220) returned 0x1
	[0110.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0110.646] GetFileType (hFile=0x220) returned 0x1
	[0110.647] WriteFile (in: hFile=0x220, lpBuffer=0x26d4378*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26d4378*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0110.650] CloseHandle (hObject=0x220) returned 1
	[0110.650] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0110.651] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0
	[0110.651] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0110.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0110.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0110.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0110.652] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x2f
	[0110.652] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x30
	[0110.653] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68d8290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0110.653] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68d8290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.655] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf68d8290, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68d8290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.655] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0110.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0110.656] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0110.656] GetFileType (hFile=0x220) returned 0x1
	[0110.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0110.656] GetFileType (hFile=0x220) returned 0x1
	[0110.656] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0110.657] ReadFile (in: hFile=0x220, lpBuffer=0x26d6274, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26d6274*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0110.660] CloseHandle (hObject=0x220) returned 1
	[0110.660] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x40
	[0110.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0110.660] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0110.662] GetFileType (hFile=0x220) returned 0x1
	[0110.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0110.662] GetFileType (hFile=0x220) returned 0x1
	[0110.662] WriteFile (in: hFile=0x220, lpBuffer=0x26d8954*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26d8954*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0110.665] CloseHandle (hObject=0x220) returned 1
	[0110.665] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0110.665] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\decrypt.txt")) returned 1
	[0110.669] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 1
	[0110.673] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0110.673] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12e4e190, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12e4e190, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1
	[0110.674] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0110.674] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.675] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0110.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0110.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0110.675] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Decrypt.txt", lpFilePart=0x0) returned 0x3b
	[0110.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0110.676] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0110.676] GetFileType (hFile=0x208) returned 0x1
	[0110.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0110.677] GetFileType (hFile=0x208) returned 0x1
	[0110.677] WriteFile (in: hFile=0x208, lpBuffer=0x26dbc38*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26dbc38*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0110.680] CloseHandle (hObject=0x208) returned 1
	[0110.680] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68d8290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0110.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0110.681] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x2e
	[0110.681] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x2f
	[0110.681] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68d8290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0110.682] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68d8290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.682] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf68d8290, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.683] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf68d8290, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0110.683] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0110.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0110.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0110.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0110.684] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x2e
	[0110.684] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x2f
	[0110.684] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68d8290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0110.685] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68d8290, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.685] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf68d8290, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf68d8290, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.686] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0110.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0110.686] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\templates\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0110.686] GetFileType (hFile=0x220) returned 0x1
	[0110.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0110.687] GetFileType (hFile=0x220) returned 0x1
	[0110.687] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0110.687] ReadFile (in: hFile=0x220, lpBuffer=0x26de3b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26de3b4*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0110.690] CloseHandle (hObject=0x220) returned 1
	[0110.690] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3f
	[0110.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0110.690] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\templates\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0110.691] GetFileType (hFile=0x220) returned 0x1
	[0110.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0110.691] GetFileType (hFile=0x220) returned 0x1
	[0110.692] WriteFile (in: hFile=0x220, lpBuffer=0x26e0a8c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26e0a8c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0110.695] CloseHandle (hObject=0x220) returned 1
	[0110.695] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0110.695] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\templates\\decrypt.txt")) returned 1
	[0110.699] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.699] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0110.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0110.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0110.700] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0110.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0110.700] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\templates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0110.701] GetFileType (hFile=0x208) returned 0x1
	[0110.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0110.701] GetFileType (hFile=0x208) returned 0x1
	[0110.701] WriteFile (in: hFile=0x208, lpBuffer=0x26e3168*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26e3168*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0110.705] CloseHandle (hObject=0x208) returned 1
	[0110.705] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1
	[0110.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0110.705] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x28
	[0110.706] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x29
	[0110.706] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0110.706] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.707] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6924550, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.708] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1
	[0110.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0110.708] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x36
	[0110.708] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x37
	[0110.709] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0110.709] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.710] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf68fe3f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.711] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf68fe3f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0110.711] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0110.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0110.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0110.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0110.711] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x36
	[0110.712] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x37
	[0110.712] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0110.713] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.713] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf68fe3f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.714] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt", lpFilePart=0x0) returned 0x42
	[0110.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0110.714] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportarchive\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0110.714] GetFileType (hFile=0x224) returned 0x1
	[0110.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0110.714] GetFileType (hFile=0x224) returned 0x1
	[0110.715] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0110.715] ReadFile (in: hFile=0x224, lpBuffer=0x26e6498, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26e6498*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0110.719] CloseHandle (hObject=0x224) returned 1
	[0110.719] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x47
	[0110.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0110.719] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportarchive\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0110.720] GetFileType (hFile=0x224) returned 0x1
	[0110.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0110.721] GetFileType (hFile=0x224) returned 0x1
	[0110.721] WriteFile (in: hFile=0x224, lpBuffer=0x26e8b90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26e8b90*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0110.724] CloseHandle (hObject=0x224) returned 1
	[0110.725] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt", lpFilePart=0x0) returned 0x42
	[0110.725] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportarchive\\decrypt.txt")) returned 1
	[0110.728] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.728] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0110.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0110.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0110.729] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt", lpFilePart=0x0) returned 0x42
	[0110.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0110.729] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportarchive\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0110.730] GetFileType (hFile=0x220) returned 0x1
	[0110.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0110.730] GetFileType (hFile=0x220) returned 0x1
	[0110.731] WriteFile (in: hFile=0x220, lpBuffer=0x26eb29c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26eb29c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0110.734] CloseHandle (hObject=0x220) returned 1
	[0110.735] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1
	[0110.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0110.735] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue", lpFilePart=0x0) returned 0x34
	[0110.736] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\", lpFilePart=0x0) returned 0x35
	[0110.736] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0110.737] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.737] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xf68fe3f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.738] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xf68fe3f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0110.738] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0110.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0110.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0110.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0110.739] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue", lpFilePart=0x0) returned 0x34
	[0110.739] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\", lpFilePart=0x0) returned 0x35
	[0110.739] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0110.740] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf68fe3f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.740] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xf68fe3f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf68fe3f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.741] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0110.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0110.741] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0110.741] GetFileType (hFile=0x224) returned 0x1
	[0110.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0110.742] GetFileType (hFile=0x224) returned 0x1
	[0110.742] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0110.742] ReadFile (in: hFile=0x224, lpBuffer=0x26edbcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26edbcc*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0110.745] CloseHandle (hObject=0x224) returned 1
	[0110.745] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x45
	[0110.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0110.745] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0110.746] GetFileType (hFile=0x224) returned 0x1
	[0110.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0110.746] GetFileType (hFile=0x224) returned 0x1
	[0110.747] WriteFile (in: hFile=0x224, lpBuffer=0x26f02bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26f02bc*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0110.751] CloseHandle (hObject=0x224) returned 1
	[0110.751] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0110.751] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\decrypt.txt")) returned 1
	[0110.754] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.755] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0110.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0110.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0110.755] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0110.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0110.755] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0110.756] GetFileType (hFile=0x220) returned 0x1
	[0110.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0110.756] GetFileType (hFile=0x220) returned 0x1
	[0110.757] WriteFile (in: hFile=0x220, lpBuffer=0x26f29bc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26f29bc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0110.760] CloseHandle (hObject=0x220) returned 1
	[0110.760] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.760] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0110.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0110.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0110.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0110.761] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x28
	[0110.761] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x29
	[0110.761] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0110.762] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.762] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6924550, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.764] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0110.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0110.764] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0110.765] GetFileType (hFile=0x220) returned 0x1
	[0110.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0110.765] GetFileType (hFile=0x220) returned 0x1
	[0110.765] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0110.765] ReadFile (in: hFile=0x220, lpBuffer=0x26f45cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26f45cc*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0110.768] CloseHandle (hObject=0x220) returned 1
	[0110.768] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x39
	[0110.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0110.768] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0110.784] GetFileType (hFile=0x220) returned 0x1
	[0110.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0110.785] GetFileType (hFile=0x220) returned 0x1
	[0110.785] WriteFile (in: hFile=0x220, lpBuffer=0x26f6c8c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26f6c8c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0110.791] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0110.792] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\decrypt.txt")) returned 1
	[0110.796] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12f0c870, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12f0c870, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1
	[0110.797] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12f58b30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12f58b30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1
	[0110.797] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12f58b30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12f58b30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 0
	[0110.798] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0110.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0110.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0110.798] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0110.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0110.799] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0110.799] GetFileType (hFile=0x208) returned 0x1
	[0110.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0110.799] GetFileType (hFile=0x208) returned 0x1
	[0110.800] WriteFile (in: hFile=0x208, lpBuffer=0x26f9624*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26f9624*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0110.803] CloseHandle (hObject=0x208) returned 1
	[0110.803] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.804] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0110.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0110.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0110.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0110.804] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows", lpFilePart=0x0) returned 0x24
	[0110.805] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x25
	[0110.805] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0110.805] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6924550, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.806] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x11d32370, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11d32370, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIT", cAlternateFileName="")) returned 1
	[0110.807] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x11dca8f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11dca8f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1
	[0110.807] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6924550, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6924550, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf694a6b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.807] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0110.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0110.808] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0110.808] GetFileType (hFile=0x208) returned 0x1
	[0110.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0110.808] GetFileType (hFile=0x208) returned 0x1
	[0110.809] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0110.809] ReadFile (in: hFile=0x208, lpBuffer=0x26fb37c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26fb37c*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0110.812] CloseHandle (hObject=0x208) returned 1
	[0110.812] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x35
	[0110.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0110.813] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0110.814] GetFileType (hFile=0x208) returned 0x1
	[0110.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0110.814] GetFileType (hFile=0x208) returned 0x1
	[0110.814] WriteFile (in: hFile=0x208, lpBuffer=0x26fda2c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26fda2c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0110.817] CloseHandle (hObject=0x208) returned 1
	[0110.818] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0110.818] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\decrypt.txt")) returned 1
	[0110.821] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x11eaf130, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11eaf130, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1
	[0110.822] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x11f21550, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11f21550, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1
	[0110.822] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x11f6d810, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11f6d810, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0110.823] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x11fb9ad0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11fb9ad0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1
	[0110.823] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x12005d90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12005d90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1
	[0110.824] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x12136890, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12136890, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sqm", cAlternateFileName="")) returned 1
	[0110.825] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12e9a450, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12e9a450, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0110.825] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12ee6710, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12ee6710, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0110.826] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12fcaf50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12fcaf50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1
	[0110.826] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x12fcaf50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x12fcaf50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 0
	[0110.827] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0110.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0110.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0110.827] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0110.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0110.828] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0110.828] GetFileType (hFile=0x204) returned 0x1
	[0110.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0110.829] GetFileType (hFile=0x204) returned 0x1
	[0110.829] WriteFile (in: hFile=0x204, lpBuffer=0x2700b60*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2700b60*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0110.832] CloseHandle (hObject=0x204) returned 1
	[0110.832] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0110.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0110.833] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x2d
	[0110.833] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\", lpFilePart=0x0) returned 0x2e
	[0110.833] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0110.834] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.834] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6aed5d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b13730, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.835] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1
	[0110.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0110.835] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates", lpFilePart=0x0) returned 0x40
	[0110.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\", lpFilePart=0x0) returned 0x41
	[0110.836] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0110.837] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.837] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf694a6b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf694a6b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1
	[0110.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0110.838] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup", lpFilePart=0x0) returned 0x47
	[0110.838] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\", lpFilePart=0x0) returned 0x48
	[0110.838] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf694a6b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf694a6b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0110.839] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf694a6b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf694a6b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.839] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf694a6b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf694a6b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6970810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.840] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf694a6b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf694a6b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6970810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0110.840] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0110.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0110.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0110.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0110.841] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup", lpFilePart=0x0) returned 0x47
	[0110.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\", lpFilePart=0x0) returned 0x48
	[0110.842] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf694a6b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf694a6b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0110.842] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf694a6b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf694a6b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.843] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf694a6b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf694a6b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6970810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.843] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0110.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0110.843] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\backup\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0110.844] GetFileType (hFile=0x224) returned 0x1
	[0110.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0110.844] GetFileType (hFile=0x224) returned 0x1
	[0110.844] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0110.845] ReadFile (in: hFile=0x224, lpBuffer=0x2704f30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2704f30*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0110.848] CloseHandle (hObject=0x224) returned 1
	[0110.848] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x58
	[0110.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0110.848] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\backup\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0110.849] GetFileType (hFile=0x224) returned 0x1
	[0110.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0110.849] GetFileType (hFile=0x224) returned 0x1
	[0110.850] WriteFile (in: hFile=0x224, lpBuffer=0x2707670*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2707670*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0110.853] CloseHandle (hObject=0x224) returned 1
	[0110.853] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0110.853] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\backup\\decrypt.txt")) returned 1
	[0110.860] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.860] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0110.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0110.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0110.860] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0110.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0110.861] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\backup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0110.861] GetFileType (hFile=0x220) returned 0x1
	[0110.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0110.862] GetFileType (hFile=0x220) returned 0x1
	[0110.862] WriteFile (in: hFile=0x220, lpBuffer=0x2709ddc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2709ddc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0110.865] CloseHandle (hObject=0x220) returned 1
	[0110.866] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6996970, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.866] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6970810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6970810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 1
	[0110.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0110.866] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates", lpFilePart=0x0) returned 0x48
	[0110.867] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\", lpFilePart=0x0) returned 0x49
	[0110.867] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6970810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6970810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0110.868] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6970810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6970810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.868] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6970810, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6970810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6970810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.869] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6970810, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6970810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6970810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0110.869] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0110.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0110.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0110.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0110.870] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates", lpFilePart=0x0) returned 0x48
	[0110.870] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\", lpFilePart=0x0) returned 0x49
	[0110.870] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6970810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6970810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0110.871] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6970810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6970810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.871] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6970810, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6970810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6970810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.872] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0110.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0110.872] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\updates\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0110.872] GetFileType (hFile=0x224) returned 0x1
	[0110.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0110.873] GetFileType (hFile=0x224) returned 0x1
	[0110.873] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0110.873] ReadFile (in: hFile=0x224, lpBuffer=0x270ce0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x270ce0c*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0110.876] CloseHandle (hObject=0x224) returned 1
	[0110.876] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x59
	[0110.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0110.876] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\updates\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0110.877] GetFileType (hFile=0x224) returned 0x1
	[0110.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0110.877] GetFileType (hFile=0x224) returned 0x1
	[0110.878] WriteFile (in: hFile=0x224, lpBuffer=0x270f54c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x270f54c*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0110.881] CloseHandle (hObject=0x224) returned 1
	[0110.882] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0110.882] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\updates\\decrypt.txt")) returned 1
	[0110.885] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.885] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0110.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0110.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0110.886] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0110.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0110.886] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\updates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0110.887] GetFileType (hFile=0x220) returned 0x1
	[0110.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0110.887] GetFileType (hFile=0x220) returned 0x1
	[0110.887] WriteFile (in: hFile=0x220, lpBuffer=0x2711cc4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2711cc4*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0110.891] CloseHandle (hObject=0x220) returned 1
	[0110.891] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", cAlternateFileName="{D2B0B~1")) returned 1
	[0110.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0110.892] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpFilePart=0x0) returned 0x67
	[0110.892] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\", lpFilePart=0x0) returned 0x68
	[0110.892] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0110.893] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.894] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6996970, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.895] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fd91f9, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fd91f9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x12c4d000, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0xb17190, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpasbase.vdm", cAlternateFileName="")) returned 1
	[0110.895] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fff35a, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x6da22700, ftLastWriteTime.dwHighDateTime=0x1cb8783, nFileSizeHigh=0x0, nFileSizeLow=0x52d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpasdlta.vdm", cAlternateFileName="")) returned 1
	[0110.896] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpengine.dll", cAlternateFileName="")) returned 1
	[0110.896] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpengine.dll", cAlternateFileName="")) returned 0
	[0110.897] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0110.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0110.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0110.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0110.898] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}", lpFilePart=0x0) returned 0x67
	[0110.898] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\", lpFilePart=0x0) returned 0x68
	[0110.898] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0110.899] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0110.899] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6996970, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0110.900] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt", lpFilePart=0x0) returned 0x73
	[0110.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0110.900] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0110.900] GetFileType (hFile=0x224) returned 0x1
	[0110.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0110.977] GetFileType (hFile=0x224) returned 0x1
	[0110.978] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0110.978] ReadFile (in: hFile=0x224, lpBuffer=0x2715ae8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2715ae8*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0110.982] CloseHandle (hObject=0x224) returned 1
	[0110.982] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x78
	[0110.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0110.982] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0110.988] GetFileType (hFile=0x224) returned 0x1
	[0110.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0110.988] GetFileType (hFile=0x224) returned 0x1
	[0110.989] WriteFile (in: hFile=0x224, lpBuffer=0x27182a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27182a8*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0110.992] CloseHandle (hObject=0x224) returned 1
	[0110.992] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt", lpFilePart=0x0) returned 0x73
	[0110.993] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\decrypt.txt")) returned 1
	[0110.996] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fd91f9, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fd91f9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x12c4d000, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0xb17190, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpasbase.vdm", cAlternateFileName="")) returned 1
	[0110.997] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fff35a, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x6da22700, ftLastWriteTime.dwHighDateTime=0x1cb8783, nFileSizeHigh=0x0, nFileSizeLow=0x52d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpasdlta.vdm", cAlternateFileName="")) returned 1
	[0110.997] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpengine.dll", cAlternateFileName="")) returned 1
	[0110.998] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0110.998] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0110.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0110.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0110.999] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt", lpFilePart=0x0) returned 0x73
	[0110.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0110.999] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0111.000] GetFileType (hFile=0x220) returned 0x1
	[0111.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0111.000] GetFileType (hFile=0x220) returned 0x1
	[0111.000] WriteFile (in: hFile=0x220, lpBuffer=0x271bb54*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x271bb54*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.003] CloseHandle (hObject=0x220) returned 1
	[0111.003] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.004] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.004] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates", lpFilePart=0x0) returned 0x40
	[0111.005] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\", lpFilePart=0x0) returned 0x41
	[0111.005] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.005] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.006] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x130634d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x130634d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1
	[0111.007] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6996970, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6996970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6996970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.007] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0111.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0111.007] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.008] GetFileType (hFile=0x220) returned 0x1
	[0111.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0111.008] GetFileType (hFile=0x220) returned 0x1
	[0111.008] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0111.008] ReadFile (in: hFile=0x220, lpBuffer=0x271dc5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x271dc5c*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0111.012] CloseHandle (hObject=0x220) returned 1
	[0111.012] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x51
	[0111.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0111.012] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.014] GetFileType (hFile=0x220) returned 0x1
	[0111.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0111.014] GetFileType (hFile=0x220) returned 0x1
	[0111.015] WriteFile (in: hFile=0x220, lpBuffer=0x272037c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x272037c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0111.018] CloseHandle (hObject=0x220) returned 1
	[0111.019] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0111.019] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\decrypt.txt")) returned 1
	[0111.022] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x13089630, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13089630, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 1
	[0111.023] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x131ba130, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x131ba130, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", cAlternateFileName="{D2B0B~1")) returned 1
	[0111.023] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x131ba130, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x131ba130, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", cAlternateFileName="{D2B0B~1")) returned 0
	[0111.024] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.024] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0111.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.025] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0111.025] GetFileType (hFile=0x208) returned 0x1
	[0111.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0111.026] GetFileType (hFile=0x208) returned 0x1
	[0111.026] WriteFile (in: hFile=0x208, lpBuffer=0x2722ef8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2722ef8*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0111.030] CloseHandle (hObject=0x208) returned 1
	[0111.030] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1
	[0111.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.031] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy", lpFilePart=0x0) returned 0x37
	[0111.031] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\", lpFilePart=0x0) returned 0x38
	[0111.031] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.032] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.033] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf69bcad0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.033] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf69bcad0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0111.034] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.034] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy", lpFilePart=0x0) returned 0x37
	[0111.034] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\", lpFilePart=0x0) returned 0x38
	[0111.035] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.035] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.036] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf69bcad0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.036] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0111.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0111.037] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\localcopy\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.037] GetFileType (hFile=0x220) returned 0x1
	[0111.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0111.037] GetFileType (hFile=0x220) returned 0x1
	[0111.037] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0111.038] ReadFile (in: hFile=0x220, lpBuffer=0x27258d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27258d8*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0111.040] CloseHandle (hObject=0x220) returned 1
	[0111.040] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x48
	[0111.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0111.041] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\localcopy\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.041] GetFileType (hFile=0x220) returned 0x1
	[0111.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0111.042] GetFileType (hFile=0x220) returned 0x1
	[0111.042] WriteFile (in: hFile=0x220, lpBuffer=0x2727fd8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2727fd8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0111.049] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0111.049] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\localcopy\\decrypt.txt")) returned 1
	[0111.062] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.062] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.063] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0111.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.063] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\localcopy\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0111.063] GetFileType (hFile=0x208) returned 0x1
	[0111.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0111.064] GetFileType (hFile=0x208) returned 0x1
	[0111.064] WriteFile (in: hFile=0x208, lpBuffer=0x272a6e4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x272a6e4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0111.068] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1
	[0111.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.068] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine", lpFilePart=0x0) returned 0x38
	[0111.068] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\", lpFilePart=0x0) returned 0x39
	[0111.069] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.069] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.070] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf69bcad0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.071] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf69bcad0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0111.071] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.072] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine", lpFilePart=0x0) returned 0x38
	[0111.072] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\", lpFilePart=0x0) returned 0x39
	[0111.072] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.072] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.073] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf69bcad0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf69bcad0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf69bcad0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.073] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0111.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0111.074] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\quarantine\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.074] GetFileType (hFile=0x220) returned 0x1
	[0111.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0111.074] GetFileType (hFile=0x220) returned 0x1
	[0111.074] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0111.075] ReadFile (in: hFile=0x220, lpBuffer=0x272d134, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x272d134*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0111.078] CloseHandle (hObject=0x220) returned 1
	[0111.078] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x49
	[0111.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0111.078] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\quarantine\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.079] GetFileType (hFile=0x220) returned 0x1
	[0111.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0111.079] GetFileType (hFile=0x220) returned 0x1
	[0111.080] WriteFile (in: hFile=0x220, lpBuffer=0x272f834*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x272f834*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0111.082] CloseHandle (hObject=0x220) returned 1
	[0111.082] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0111.082] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\quarantine\\decrypt.txt")) returned 1
	[0111.085] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.086] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.086] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0111.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.087] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\quarantine\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0111.087] GetFileType (hFile=0x208) returned 0x1
	[0111.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0111.088] GetFileType (hFile=0x208) returned 0x1
	[0111.088] WriteFile (in: hFile=0x208, lpBuffer=0x2731f4c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2731f4c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0111.092] CloseHandle (hObject=0x208) returned 1
	[0111.092] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6ac7470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ac7470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scans", cAlternateFileName="")) returned 1
	[0111.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.092] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans", lpFilePart=0x0) returned 0x33
	[0111.092] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\", lpFilePart=0x0) returned 0x34
	[0111.093] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6ac7470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ac7470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.093] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6ac7470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ac7470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.094] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6ac7470, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6ac7470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ac7470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.095] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0111.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.095] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History", lpFilePart=0x0) returned 0x3b
	[0111.095] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\", lpFilePart=0x0) returned 0x3c
	[0111.096] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.096] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.097] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6a08d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a08d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CacheManager", cAlternateFileName="CACHEM~1")) returned 1
	[0111.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.098] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", lpFilePart=0x0) returned 0x48
	[0111.098] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\", lpFilePart=0x0) returned 0x49
	[0111.098] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6a08d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a08d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0111.099] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6a08d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a08d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.099] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6a08d90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6a08d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a2eef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.100] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6a08d90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6a08d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a08d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpSfc.bin.KEKW", cAlternateFileName="MPSFCB~1.KEK")) returned 1
	[0111.100] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6a08d90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6a08d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a08d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpSfc.bin.KEKW", cAlternateFileName="MPSFCB~1.KEK")) returned 0
	[0111.101] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0111.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0111.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0111.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.101] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager", lpFilePart=0x0) returned 0x48
	[0111.101] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\", lpFilePart=0x0) returned 0x49
	[0111.102] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6a08d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a08d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0111.102] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6a08d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a08d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.103] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6a08d90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6a08d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a2eef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.103] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0111.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0111.104] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0111.104] GetFileType (hFile=0x228) returned 0x1
	[0111.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0111.104] GetFileType (hFile=0x228) returned 0x1
	[0111.104] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0111.105] ReadFile (in: hFile=0x228, lpBuffer=0x273657c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x273657c*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0111.108] CloseHandle (hObject=0x228) returned 1
	[0111.108] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x59
	[0111.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0111.108] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0111.114] GetFileType (hFile=0x228) returned 0x1
	[0111.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0111.114] GetFileType (hFile=0x228) returned 0x1
	[0111.115] WriteFile (in: hFile=0x228, lpBuffer=0x2738cbc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2738cbc*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0111.118] CloseHandle (hObject=0x228) returned 1
	[0111.118] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0111.118] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\decrypt.txt")) returned 1
	[0111.122] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6a08d90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6a08d90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a08d90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpSfc.bin.KEKW", cAlternateFileName="MPSFCB~1.KEK")) returned 1
	[0111.123] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.123] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0111.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0111.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0111.123] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt", lpFilePart=0x0) returned 0x54
	[0111.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0111.124] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0111.125] GetFileType (hFile=0x224) returned 0x1
	[0111.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0111.125] GetFileType (hFile=0x224) returned 0x1
	[0111.125] WriteFile (in: hFile=0x224, lpBuffer=0x273b8d0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x273b8d0*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0111.129] CloseHandle (hObject=0x224) returned 1
	[0111.129] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6aa1310, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.129] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6a55050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a55050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Results", cAlternateFileName="")) returned 1
	[0111.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.130] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results", lpFilePart=0x0) returned 0x43
	[0111.130] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\", lpFilePart=0x0) returned 0x44
	[0111.130] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6a55050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a55050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0111.131] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6a55050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a55050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.132] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6a55050, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6a55050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a55050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.132] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xf6a2eef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a2eef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1
	[0111.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0111.133] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource", lpFilePart=0x0) returned 0x4c
	[0111.133] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\", lpFilePart=0x0) returned 0x4d
	[0111.133] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xf6a2eef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a2eef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0111.134] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xf6a2eef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a2eef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.135] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6a2eef0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6a2eef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a55050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.135] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80be8ad0, ftCreationTime.dwHighDateTime=0x1d33740, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x81085570, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", cAlternateFileName="{1D1DB~1")) returned 1
	[0111.136] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80be8ad0, ftCreationTime.dwHighDateTime=0x1d33740, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x81085570, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", cAlternateFileName="{1D1DB~1")) returned 0
	[0111.136] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0111.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0111.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0111.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0111.137] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource", lpFilePart=0x0) returned 0x4c
	[0111.137] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\", lpFilePart=0x0) returned 0x4d
	[0111.138] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xf6a2eef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a2eef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0111.138] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xf6a2eef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a2eef0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.139] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6a2eef0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6a2eef0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a55050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.139] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt", lpFilePart=0x0) returned 0x58
	[0111.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0111.140] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\results\\resource\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0111.140] GetFileType (hFile=0x22c) returned 0x1
	[0111.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0111.140] GetFileType (hFile=0x22c) returned 0x1
	[0111.141] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0xa5
	[0111.141] ReadFile (in: hFile=0x22c, lpBuffer=0x273f9d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x273f9d4*, lpNumberOfBytesRead=0x26eca4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.144] CloseHandle (hObject=0x22c) returned 1
	[0111.144] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x5d
	[0111.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0111.144] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\results\\resource\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0111.148] GetFileType (hFile=0x22c) returned 0x1
	[0111.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0111.149] GetFileType (hFile=0x22c) returned 0x1
	[0111.149] WriteFile (in: hFile=0x22c, lpBuffer=0x2742124*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x2742124*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0111.152] CloseHandle (hObject=0x22c) returned 1
	[0111.152] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt", lpFilePart=0x0) returned 0x58
	[0111.152] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\results\\resource\\decrypt.txt")) returned 1
	[0111.157] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80be8ad0, ftCreationTime.dwHighDateTime=0x1d33740, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x81085570, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", cAlternateFileName="{1D1DB~1")) returned 1
	[0111.157] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.157] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0111.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0111.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0111.158] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt", lpFilePart=0x0) returned 0x58
	[0111.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0111.158] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\results\\resource\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0111.159] GetFileType (hFile=0x228) returned 0x1
	[0111.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0111.159] GetFileType (hFile=0x228) returned 0x1
	[0111.159] WriteFile (in: hFile=0x228, lpBuffer=0x2744e54*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2744e54*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0111.163] CloseHandle (hObject=0x228) returned 1
	[0111.163] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.163] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0111.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0111.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0111.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results", lpFilePart=0x0) returned 0x43
	[0111.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\", lpFilePart=0x0) returned 0x44
	[0111.218] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6a55050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a55050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0111.219] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6a55050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a55050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.220] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6a55050, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6a55050, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a55050, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.220] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0111.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0111.220] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\results\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0111.220] GetFileType (hFile=0x228) returned 0x1
	[0111.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0111.221] GetFileType (hFile=0x228) returned 0x1
	[0111.221] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0111.221] ReadFile (in: hFile=0x228, lpBuffer=0x2746e54, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2746e54*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0111.224] CloseHandle (hObject=0x228) returned 1
	[0111.225] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x54
	[0111.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0111.225] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\results\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0111.226] GetFileType (hFile=0x228) returned 0x1
	[0111.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0111.226] GetFileType (hFile=0x228) returned 0x1
	[0111.227] WriteFile (in: hFile=0x228, lpBuffer=0x2749584*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2749584*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0111.230] CloseHandle (hObject=0x228) returned 1
	[0111.230] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0111.230] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\results\\decrypt.txt")) returned 1
	[0111.233] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x13336ef0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13336ef0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1
	[0111.234] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x13336ef0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13336ef0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 0
	[0111.234] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0111.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0111.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0111.235] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0111.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0111.235] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\results\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0111.236] GetFileType (hFile=0x224) returned 0x1
	[0111.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0111.236] GetFileType (hFile=0x224) returned 0x1
	[0111.237] WriteFile (in: hFile=0x224, lpBuffer=0x274be7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x274be7c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0111.240] CloseHandle (hObject=0x224) returned 1
	[0111.241] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6a7b1b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a7b1b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Service", cAlternateFileName="")) returned 1
	[0111.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service", lpFilePart=0x0) returned 0x43
	[0111.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\", lpFilePart=0x0) returned 0x44
	[0111.241] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6a7b1b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a7b1b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0111.242] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6a7b1b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a7b1b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.243] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6a7b1b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6a7b1b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a7b1b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.243] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9820270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7de6c9b0, ftLastWriteTime.dwHighDateTime=0x1d3373d, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.Log", cAlternateFileName="")) returned 1
	[0111.244] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadeed740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xadeed740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x2d1f02a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x1a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unknown.Log", cAlternateFileName="")) returned 1
	[0111.245] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadeed740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xadeed740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x2d1f02a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x1a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unknown.Log", cAlternateFileName="")) returned 0
	[0111.245] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0111.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0111.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0111.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.246] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service", lpFilePart=0x0) returned 0x43
	[0111.246] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\", lpFilePart=0x0) returned 0x44
	[0111.246] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6a7b1b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a7b1b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0111.248] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6a7b1b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a7b1b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.248] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6a7b1b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6a7b1b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6a7b1b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.249] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0111.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0111.249] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0111.249] GetFileType (hFile=0x228) returned 0x1
	[0111.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0111.249] GetFileType (hFile=0x228) returned 0x1
	[0111.250] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0111.250] ReadFile (in: hFile=0x228, lpBuffer=0x274eeb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x274eeb8*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0111.253] CloseHandle (hObject=0x228) returned 1
	[0111.253] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x54
	[0111.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0111.253] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0111.254] GetFileType (hFile=0x228) returned 0x1
	[0111.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0111.254] GetFileType (hFile=0x228) returned 0x1
	[0111.255] WriteFile (in: hFile=0x228, lpBuffer=0x27515e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x27515e8*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0111.258] CloseHandle (hObject=0x228) returned 1
	[0111.259] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0111.259] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\decrypt.txt")) returned 1
	[0111.262] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9820270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7de6c9b0, ftLastWriteTime.dwHighDateTime=0x1d3373d, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.Log", cAlternateFileName="")) returned 1
	[0111.263] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadeed740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xadeed740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x2d1f02a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x1a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unknown.Log", cAlternateFileName="")) returned 1
	[0111.263] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.263] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0111.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0111.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0111.264] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt", lpFilePart=0x0) returned 0x4f
	[0111.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0111.264] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0111.265] GetFileType (hFile=0x224) returned 0x1
	[0111.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0111.265] GetFileType (hFile=0x224) returned 0x1
	[0111.265] WriteFile (in: hFile=0x224, lpBuffer=0x2754544*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2754544*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0111.268] CloseHandle (hObject=0x224) returned 1
	[0111.269] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Store", cAlternateFileName="")) returned 1
	[0111.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.269] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store", lpFilePart=0x0) returned 0x41
	[0111.269] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\", lpFilePart=0x0) returned 0x42
	[0111.270] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0111.270] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.271] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6aa1310, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.272] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6aa1310, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0111.272] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0111.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0111.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0111.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.273] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store", lpFilePart=0x0) returned 0x41
	[0111.273] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\", lpFilePart=0x0) returned 0x42
	[0111.273] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0111.274] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.274] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6aa1310, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.275] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0111.275] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\store\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0111.276] GetFileType (hFile=0x228) returned 0x1
	[0111.276] GetFileType (hFile=0x228) returned 0x1
	[0111.276] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0111.276] ReadFile (in: hFile=0x228, lpBuffer=0x27571cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x27571cc*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0111.280] CloseHandle (hObject=0x228) returned 1
	[0111.280] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x52
	[0111.280] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\store\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0111.281] GetFileType (hFile=0x228) returned 0x1
	[0111.281] GetFileType (hFile=0x228) returned 0x1
	[0111.282] WriteFile (in: hFile=0x228, lpBuffer=0x27598f4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x27598f4*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0111.285] CloseHandle (hObject=0x228) returned 1
	[0111.285] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0111.285] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\store\\decrypt.txt")) returned 1
	[0111.289] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.289] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0111.289] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0111.290] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\store\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0111.290] GetFileType (hFile=0x224) returned 0x1
	[0111.291] GetFileType (hFile=0x224) returned 0x1
	[0111.291] WriteFile (in: hFile=0x224, lpBuffer=0x275c03c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x275c03c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0111.295] CloseHandle (hObject=0x224) returned 1
	[0111.295] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.296] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.296] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History", lpFilePart=0x0) returned 0x3b
	[0111.296] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\", lpFilePart=0x0) returned 0x3c
	[0111.297] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.297] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.298] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x132eac30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x132eac30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CacheManager", cAlternateFileName="CACHEM~1")) returned 1
	[0111.298] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6aa1310, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6aa1310, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aa1310, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.299] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0111.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0111.299] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.299] GetFileType (hFile=0x224) returned 0x1
	[0111.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0111.299] GetFileType (hFile=0x224) returned 0x1
	[0111.299] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0111.300] ReadFile (in: hFile=0x224, lpBuffer=0x275e0a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x275e0a8*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.302] CloseHandle (hObject=0x224) returned 1
	[0111.303] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x4c
	[0111.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0111.303] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.308] GetFileType (hFile=0x224) returned 0x1
	[0111.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0111.309] GetFileType (hFile=0x224) returned 0x1
	[0111.309] WriteFile (in: hFile=0x224, lpBuffer=0x27607b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27607b8*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0111.315] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0111.315] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\decrypt.txt")) returned 1
	[0111.318] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x133f55d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x133f55d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Results", cAlternateFileName="")) returned 1
	[0111.319] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x13441890, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13441890, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Service", cAlternateFileName="")) returned 1
	[0111.319] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x134679f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x134679f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Store", cAlternateFileName="")) returned 1
	[0111.320] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x134679f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x134679f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Store", cAlternateFileName="")) returned 0
	[0111.320] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.321] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0111.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0111.321] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0111.321] GetFileType (hFile=0x220) returned 0x1
	[0111.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0111.322] GetFileType (hFile=0x220) returned 0x1
	[0111.322] WriteFile (in: hFile=0x220, lpBuffer=0x27632f0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27632f0*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.325] CloseHandle (hObject=0x220) returned 1
	[0111.326] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.326] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.327] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans", lpFilePart=0x0) returned 0x33
	[0111.327] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\", lpFilePart=0x0) returned 0x34
	[0111.327] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6ac7470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ac7470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.328] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6ac7470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ac7470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.328] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6ac7470, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6ac7470, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ac7470, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.328] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0111.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0111.329] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.329] GetFileType (hFile=0x220) returned 0x1
	[0111.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0111.329] GetFileType (hFile=0x220) returned 0x1
	[0111.330] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0111.330] ReadFile (in: hFile=0x220, lpBuffer=0x2765090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2765090*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0111.333] CloseHandle (hObject=0x220) returned 1
	[0111.333] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x44
	[0111.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0111.333] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.334] GetFileType (hFile=0x220) returned 0x1
	[0111.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0111.335] GetFileType (hFile=0x220) returned 0x1
	[0111.335] WriteFile (in: hFile=0x220, lpBuffer=0x2767780*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2767780*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0111.338] CloseHandle (hObject=0x220) returned 1
	[0111.338] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0111.338] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\decrypt.txt")) returned 1
	[0111.343] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x134b3cb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x134b3cb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0111.343] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x134b3cb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x134b3cb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 0
	[0111.343] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.344] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0111.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.344] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0111.345] GetFileType (hFile=0x208) returned 0x1
	[0111.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0111.345] GetFileType (hFile=0x208) returned 0x1
	[0111.345] WriteFile (in: hFile=0x208, lpBuffer=0x2769fc8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2769fc8*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0111.349] CloseHandle (hObject=0x208) returned 1
	[0111.349] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 1
	[0111.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.349] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support", lpFilePart=0x0) returned 0x35
	[0111.350] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\", lpFilePart=0x0) returned 0x36
	[0111.350] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.350] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.351] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6aed5d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.352] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x798d48a0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x30ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 1
	[0111.352] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x798d48a0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x30ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 0
	[0111.353] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.354] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support", lpFilePart=0x0) returned 0x35
	[0111.354] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\", lpFilePart=0x0) returned 0x36
	[0111.354] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.355] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.356] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6aed5d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.357] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0111.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0111.357] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.357] GetFileType (hFile=0x220) returned 0x1
	[0111.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0111.357] GetFileType (hFile=0x220) returned 0x1
	[0111.357] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0111.358] ReadFile (in: hFile=0x220, lpBuffer=0x276cb0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x276cb0c*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0111.361] CloseHandle (hObject=0x220) returned 1
	[0111.361] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x46
	[0111.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0111.362] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.362] GetFileType (hFile=0x220) returned 0x1
	[0111.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0111.363] GetFileType (hFile=0x220) returned 0x1
	[0111.363] WriteFile (in: hFile=0x220, lpBuffer=0x276f204*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x276f204*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0111.366] CloseHandle (hObject=0x220) returned 1
	[0111.366] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0111.367] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\decrypt.txt")) returned 1
	[0111.370] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x798d48a0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x30ada, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 1
	[0111.371] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.371] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.372] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0111.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.372] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0111.373] GetFileType (hFile=0x208) returned 0x1
	[0111.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0111.373] GetFileType (hFile=0x208) returned 0x1
	[0111.373] WriteFile (in: hFile=0x208, lpBuffer=0x2771d4c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2771d4c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0111.377] CloseHandle (hObject=0x208) returned 1
	[0111.377] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.377] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0111.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0111.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0111.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0111.378] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender", lpFilePart=0x0) returned 0x2d
	[0111.378] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\", lpFilePart=0x0) returned 0x2e
	[0111.379] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0111.379] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6aed5d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.380] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6aed5d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6aed5d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b13730, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.380] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0111.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0111.380] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0111.381] GetFileType (hFile=0x208) returned 0x1
	[0111.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0111.381] GetFileType (hFile=0x208) returned 0x1
	[0111.381] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0111.381] ReadFile (in: hFile=0x208, lpBuffer=0x2773a08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2773a08*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0111.384] CloseHandle (hObject=0x208) returned 1
	[0111.384] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3e
	[0111.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0111.384] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0111.385] GetFileType (hFile=0x208) returned 0x1
	[0111.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0111.385] GetFileType (hFile=0x208) returned 0x1
	[0111.386] WriteFile (in: hFile=0x208, lpBuffer=0x27760e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27760e0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0111.389] CloseHandle (hObject=0x208) returned 1
	[0111.390] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0111.390] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\decrypt.txt")) returned 1
	[0111.393] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x131e0290, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x131e0290, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1
	[0111.393] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x132526b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x132526b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1
	[0111.394] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x13278810, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13278810, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1
	[0111.395] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x134fff70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x134fff70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scans", cAlternateFileName="")) returned 1
	[0111.395] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1354c230, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1354c230, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 1
	[0111.396] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1354c230, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1354c230, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 0
	[0111.396] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0111.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0111.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0111.397] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0111.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.397] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0111.398] GetFileType (hFile=0x204) returned 0x1
	[0111.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0111.398] GetFileType (hFile=0x204) returned 0x1
	[0111.398] WriteFile (in: hFile=0x204, lpBuffer=0x2778e2c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2778e2c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0111.401] CloseHandle (hObject=0x204) returned 1
	[0111.402] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d28a70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d28a70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1
	[0111.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0111.402] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT", lpFilePart=0x0) returned 0x27
	[0111.403] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\", lpFilePart=0x0) returned 0x28
	[0111.403] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d28a70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d28a70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0111.404] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d28a70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d28a70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.405] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6d28a70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6d28a70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d28a70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.405] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6c1e0d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6c1e0d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1
	[0111.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.406] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax", lpFilePart=0x0) returned 0x2d
	[0111.406] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\", lpFilePart=0x0) returned 0x2e
	[0111.406] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6c1e0d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6c1e0d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.407] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6c1e0d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6c1e0d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.407] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b39890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b39890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivityLog", cAlternateFileName="ACTIVI~1")) returned 1
	[0111.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.408] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog", lpFilePart=0x0) returned 0x39
	[0111.408] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\", lpFilePart=0x0) returned 0x3a
	[0111.408] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b39890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b39890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.409] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b39890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b39890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.410] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b39890, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6b39890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b39890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.410] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b39890, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6b39890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b39890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0111.411] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.411] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog", lpFilePart=0x0) returned 0x39
	[0111.412] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\", lpFilePart=0x0) returned 0x3a
	[0111.412] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b39890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b39890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.412] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b39890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b39890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.413] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b39890, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6b39890, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b39890, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.413] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0111.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0111.414] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\activitylog\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.414] GetFileType (hFile=0x224) returned 0x1
	[0111.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0111.414] GetFileType (hFile=0x224) returned 0x1
	[0111.414] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0111.415] ReadFile (in: hFile=0x224, lpBuffer=0x277cad8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x277cad8*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.418] CloseHandle (hObject=0x224) returned 1
	[0111.418] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x4a
	[0111.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0111.419] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\activitylog\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.420] GetFileType (hFile=0x224) returned 0x1
	[0111.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0111.421] GetFileType (hFile=0x224) returned 0x1
	[0111.421] WriteFile (in: hFile=0x224, lpBuffer=0x277f1e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x277f1e0*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0111.424] CloseHandle (hObject=0x224) returned 1
	[0111.425] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0111.425] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\activitylog\\decrypt.txt")) returned 1
	[0111.428] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.428] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.429] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0111.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0111.429] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\activitylog\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0111.430] GetFileType (hFile=0x220) returned 0x1
	[0111.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0111.431] GetFileType (hFile=0x220) returned 0x1
	[0111.431] WriteFile (in: hFile=0x220, lpBuffer=0x27818f8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27818f8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.435] CloseHandle (hObject=0x220) returned 1
	[0111.435] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Coverpages", cAlternateFileName="COMMON~1")) returned 1
	[0111.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.436] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages", lpFilePart=0x0) returned 0x3f
	[0111.436] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\", lpFilePart=0x0) returned 0x40
	[0111.436] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.437] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.438] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b85b50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.438] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6b5f9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b5f9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0111.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.439] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US", lpFilePart=0x0) returned 0x45
	[0111.439] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\", lpFilePart=0x0) returned 0x46
	[0111.439] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6b5f9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b5f9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0111.440] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6b5f9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b5f9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.441] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="confident.cov", cAlternateFileName="")) returned 1
	[0111.441] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b5f9f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6b5f9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b5f9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.442] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x0, dwReserved1=0x0, cFileName="fyi.cov", cAlternateFileName="")) returned 1
	[0111.442] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="generic.cov", cAlternateFileName="")) returned 1
	[0111.443] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 1
	[0111.443] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 0
	[0111.444] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0111.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0111.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0111.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.445] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US", lpFilePart=0x0) returned 0x45
	[0111.445] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\", lpFilePart=0x0) returned 0x46
	[0111.445] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6b5f9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b5f9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0111.446] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6b5f9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b5f9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.446] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="confident.cov", cAlternateFileName="")) returned 1
	[0111.447] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b5f9f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6b5f9f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b5f9f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.447] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0111.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0111.448] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0111.448] GetFileType (hFile=0x228) returned 0x1
	[0111.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0111.448] GetFileType (hFile=0x228) returned 0x1
	[0111.448] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0111.449] ReadFile (in: hFile=0x228, lpBuffer=0x2785dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x2785dc8*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0111.452] CloseHandle (hObject=0x228) returned 1
	[0111.452] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x56
	[0111.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0111.453] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0111.459] GetFileType (hFile=0x228) returned 0x1
	[0111.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0111.459] GetFileType (hFile=0x228) returned 0x1
	[0111.459] WriteFile (in: hFile=0x228, lpBuffer=0x2788500*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2788500*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0111.462] CloseHandle (hObject=0x228) returned 1
	[0111.463] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0111.463] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\decrypt.txt")) returned 1
	[0111.489] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x0, dwReserved1=0x0, cFileName="fyi.cov", cAlternateFileName="")) returned 1
	[0111.489] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="generic.cov", cAlternateFileName="")) returned 1
	[0111.490] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 1
	[0111.490] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.491] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0111.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0111.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0111.491] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0111.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0111.492] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0111.492] GetFileType (hFile=0x224) returned 0x1
	[0111.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0111.492] GetFileType (hFile=0x224) returned 0x1
	[0111.493] WriteFile (in: hFile=0x224, lpBuffer=0x278b874*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x278b874*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0111.496] CloseHandle (hObject=0x224) returned 1
	[0111.497] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.497] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.498] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages", lpFilePart=0x0) returned 0x3f
	[0111.498] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\", lpFilePart=0x0) returned 0x40
	[0111.498] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.499] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.499] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b85b50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.500] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0111.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0111.500] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.500] GetFileType (hFile=0x224) returned 0x1
	[0111.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0111.501] GetFileType (hFile=0x224) returned 0x1
	[0111.501] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0111.501] ReadFile (in: hFile=0x224, lpBuffer=0x278d7dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x278d7dc*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.504] CloseHandle (hObject=0x224) returned 1
	[0111.504] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x50
	[0111.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0111.504] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.505] GetFileType (hFile=0x224) returned 0x1
	[0111.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0111.505] GetFileType (hFile=0x224) returned 0x1
	[0111.506] WriteFile (in: hFile=0x224, lpBuffer=0x278fefc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x278fefc*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0111.512] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0111.512] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\decrypt.txt")) returned 1
	[0111.516] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x13656bd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13656bd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0111.516] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x13656bd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13656bd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0111.517] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.517] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0111.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0111.517] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0111.518] GetFileType (hFile=0x220) returned 0x1
	[0111.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0111.518] GetFileType (hFile=0x220) returned 0x1
	[0111.518] WriteFile (in: hFile=0x220, lpBuffer=0x27927ac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27927ac*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.521] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6c1e0d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6c1e0d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6c1e0d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.522] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Inbox", cAlternateFileName="")) returned 1
	[0111.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.522] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox", lpFilePart=0x0) returned 0x33
	[0111.522] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\", lpFilePart=0x0) returned 0x34
	[0111.523] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.523] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.524] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b85b50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6babcb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.524] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b85b50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6babcb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0111.525] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.525] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox", lpFilePart=0x0) returned 0x33
	[0111.526] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\", lpFilePart=0x0) returned 0x34
	[0111.526] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.526] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6b85b50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.527] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6b85b50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6b85b50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6babcb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.528] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0111.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0111.528] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\inbox\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.528] GetFileType (hFile=0x224) returned 0x1
	[0111.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0111.529] GetFileType (hFile=0x224) returned 0x1
	[0111.529] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0111.529] ReadFile (in: hFile=0x224, lpBuffer=0x279517c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x279517c*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.532] CloseHandle (hObject=0x224) returned 1
	[0111.532] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x44
	[0111.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0111.532] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\inbox\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.533] GetFileType (hFile=0x224) returned 0x1
	[0111.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0111.533] GetFileType (hFile=0x224) returned 0x1
	[0111.534] WriteFile (in: hFile=0x224, lpBuffer=0x279786c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x279786c*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0111.537] CloseHandle (hObject=0x224) returned 1
	[0111.537] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0111.537] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\inbox\\decrypt.txt")) returned 1
	[0111.541] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.541] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.542] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0111.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0111.542] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\inbox\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0111.543] GetFileType (hFile=0x220) returned 0x1
	[0111.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0111.544] GetFileType (hFile=0x220) returned 0x1
	[0111.544] WriteFile (in: hFile=0x220, lpBuffer=0x2799f60*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2799f60*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.548] CloseHandle (hObject=0x220) returned 1
	[0111.548] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6babcb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6babcb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Queue", cAlternateFileName="")) returned 1
	[0111.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.548] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue", lpFilePart=0x0) returned 0x33
	[0111.549] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\", lpFilePart=0x0) returned 0x34
	[0111.549] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6babcb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6babcb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.550] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6babcb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6babcb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.550] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6babcb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6babcb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6babcb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.551] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6babcb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6babcb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6babcb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0111.551] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.552] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue", lpFilePart=0x0) returned 0x33
	[0111.552] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\", lpFilePart=0x0) returned 0x34
	[0111.552] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6babcb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6babcb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.553] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6babcb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6babcb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.554] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6babcb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6babcb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6babcb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.554] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0111.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0111.554] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\queue\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.554] GetFileType (hFile=0x224) returned 0x1
	[0111.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0111.555] GetFileType (hFile=0x224) returned 0x1
	[0111.555] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0111.555] ReadFile (in: hFile=0x224, lpBuffer=0x279c7f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x279c7f8*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.558] CloseHandle (hObject=0x224) returned 1
	[0111.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x44
	[0111.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0111.558] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\queue\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.570] GetFileType (hFile=0x224) returned 0x1
	[0111.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0111.570] GetFileType (hFile=0x224) returned 0x1
	[0111.571] WriteFile (in: hFile=0x224, lpBuffer=0x279eee8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x279eee8*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0111.578] CloseHandle (hObject=0x224) returned 1
	[0111.578] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0111.579] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\queue\\decrypt.txt")) returned 1
	[0111.582] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.582] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.583] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt", lpFilePart=0x0) returned 0x3f
	[0111.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0111.583] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\queue\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0111.584] GetFileType (hFile=0x220) returned 0x1
	[0111.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0111.584] GetFileType (hFile=0x220) returned 0x1
	[0111.584] WriteFile (in: hFile=0x220, lpBuffer=0x27a15dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27a15dc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.587] CloseHandle (hObject=0x220) returned 1
	[0111.587] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6bd1e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bd1e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SentItems", cAlternateFileName="SENTIT~1")) returned 1
	[0111.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.588] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems", lpFilePart=0x0) returned 0x37
	[0111.588] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\", lpFilePart=0x0) returned 0x38
	[0111.588] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6bd1e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bd1e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.589] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6bd1e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bd1e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.590] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6bd1e10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6bd1e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bd1e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.590] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6bd1e10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6bd1e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bd1e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0111.591] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.592] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems", lpFilePart=0x0) returned 0x37
	[0111.592] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\", lpFilePart=0x0) returned 0x38
	[0111.592] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6bd1e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bd1e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.592] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6bd1e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bd1e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.593] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6bd1e10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6bd1e10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bd1e10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.594] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0111.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0111.594] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\sentitems\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.594] GetFileType (hFile=0x224) returned 0x1
	[0111.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0111.594] GetFileType (hFile=0x224) returned 0x1
	[0111.594] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0111.595] ReadFile (in: hFile=0x224, lpBuffer=0x27a3fbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27a3fbc*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.598] CloseHandle (hObject=0x224) returned 1
	[0111.598] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x48
	[0111.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0111.598] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\sentitems\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.599] GetFileType (hFile=0x224) returned 0x1
	[0111.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0111.599] GetFileType (hFile=0x224) returned 0x1
	[0111.599] WriteFile (in: hFile=0x224, lpBuffer=0x27a66bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27a66bc*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0111.603] CloseHandle (hObject=0x224) returned 1
	[0111.603] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0111.603] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\sentitems\\decrypt.txt")) returned 1
	[0111.620] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.620] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.621] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0111.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0111.621] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\sentitems\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0111.622] GetFileType (hFile=0x220) returned 0x1
	[0111.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0111.622] GetFileType (hFile=0x220) returned 0x1
	[0111.622] WriteFile (in: hFile=0x220, lpBuffer=0x27a8dc8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27a8dc8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.626] CloseHandle (hObject=0x220) returned 1
	[0111.626] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 1
	[0111.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.627] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox", lpFilePart=0x0) returned 0x3a
	[0111.627] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\", lpFilePart=0x0) returned 0x3b
	[0111.627] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.628] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.628] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6bf7f70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.629] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0111.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.629] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US", lpFilePart=0x0) returned 0x40
	[0111.629] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\", lpFilePart=0x0) returned 0x41
	[0111.630] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0111.630] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.631] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6bf7f70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.631] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 1
	[0111.632] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0
	[0111.632] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0111.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0111.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0111.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.633] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US", lpFilePart=0x0) returned 0x40
	[0111.633] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\", lpFilePart=0x0) returned 0x41
	[0111.633] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0111.634] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.634] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6bf7f70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.635] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0111.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0111.635] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0111.635] GetFileType (hFile=0x228) returned 0x1
	[0111.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0111.636] GetFileType (hFile=0x228) returned 0x1
	[0111.636] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0111.636] ReadFile (in: hFile=0x228, lpBuffer=0x27ac7d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x27ac7d0*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0111.639] CloseHandle (hObject=0x228) returned 1
	[0111.640] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x51
	[0111.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0111.640] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0111.642] GetFileType (hFile=0x228) returned 0x1
	[0111.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0111.642] GetFileType (hFile=0x228) returned 0x1
	[0111.642] WriteFile (in: hFile=0x228, lpBuffer=0x27aeef0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x27aeef0*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0111.645] CloseHandle (hObject=0x228) returned 1
	[0111.646] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0111.646] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\decrypt.txt")) returned 1
	[0111.649] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 1
	[0111.649] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.649] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0111.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0111.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0111.650] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0111.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0111.650] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0111.651] GetFileType (hFile=0x224) returned 0x1
	[0111.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0111.651] GetFileType (hFile=0x224) returned 0x1
	[0111.651] WriteFile (in: hFile=0x224, lpBuffer=0x27b1a44*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27b1a44*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0111.669] CloseHandle (hObject=0x224) returned 1
	[0111.670] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.670] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.671] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox", lpFilePart=0x0) returned 0x3a
	[0111.671] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\", lpFilePart=0x0) returned 0x3b
	[0111.671] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0111.672] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.672] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6bf7f70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6bf7f70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6bf7f70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.672] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0111.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0111.673] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.673] GetFileType (hFile=0x224) returned 0x1
	[0111.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0111.673] GetFileType (hFile=0x224) returned 0x1
	[0111.673] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0111.674] ReadFile (in: hFile=0x224, lpBuffer=0x27b3900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27b3900*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.676] CloseHandle (hObject=0x224) returned 1
	[0111.676] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x4b
	[0111.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0111.677] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0111.677] GetFileType (hFile=0x224) returned 0x1
	[0111.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0111.678] GetFileType (hFile=0x224) returned 0x1
	[0111.678] WriteFile (in: hFile=0x224, lpBuffer=0x27b6008*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27b6008*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0111.681] CloseHandle (hObject=0x224) returned 1
	[0111.681] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0111.681] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\decrypt.txt")) returned 1
	[0111.685] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x137d3990, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x137d3990, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0111.685] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x137d3990, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x137d3990, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0111.686] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0111.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0111.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0111.686] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0111.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0111.686] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0111.687] GetFileType (hFile=0x220) returned 0x1
	[0111.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0111.687] GetFileType (hFile=0x220) returned 0x1
	[0111.687] WriteFile (in: hFile=0x220, lpBuffer=0x27b8890*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27b8890*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0111.691] CloseHandle (hObject=0x220) returned 1
	[0111.691] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.691] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.692] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax", lpFilePart=0x0) returned 0x2d
	[0111.692] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\", lpFilePart=0x0) returned 0x2e
	[0111.692] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6c1e0d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6c1e0d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.693] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6c1e0d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6c1e0d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.694] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x135be650, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x135be650, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivityLog", cAlternateFileName="ACTIVI~1")) returned 1
	[0111.694] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x136a2e90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x136a2e90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Coverpages", cAlternateFileName="COMMON~1")) returned 1
	[0111.695] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6c1e0d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6c1e0d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6c1e0d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.695] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0111.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0111.695] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.696] GetFileType (hFile=0x220) returned 0x1
	[0111.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0111.696] GetFileType (hFile=0x220) returned 0x1
	[0111.696] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0111.696] ReadFile (in: hFile=0x220, lpBuffer=0x27ba820, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27ba820*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0111.701] CloseHandle (hObject=0x220) returned 1
	[0111.701] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3e
	[0111.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0111.701] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.702] GetFileType (hFile=0x220) returned 0x1
	[0111.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0111.702] GetFileType (hFile=0x220) returned 0x1
	[0111.703] WriteFile (in: hFile=0x220, lpBuffer=0x27bcef8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27bcef8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0111.706] CloseHandle (hObject=0x220) returned 1
	[0111.706] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0111.706] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\decrypt.txt")) returned 1
	[0111.710] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x136c8ff0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x136c8ff0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Inbox", cAlternateFileName="")) returned 1
	[0111.710] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1373b410, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1373b410, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Queue", cAlternateFileName="")) returned 1
	[0111.711] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x137ad830, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x137ad830, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SentItems", cAlternateFileName="SENTIT~1")) returned 1
	[0111.711] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x13845db0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13845db0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 1
	[0111.712] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x13845db0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13845db0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 0
	[0111.712] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.713] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0111.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.713] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0111.714] GetFileType (hFile=0x208) returned 0x1
	[0111.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0111.714] GetFileType (hFile=0x208) returned 0x1
	[0111.715] WriteFile (in: hFile=0x208, lpBuffer=0x27bfae8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27bfae8*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0111.718] CloseHandle (hObject=0x208) returned 1
	[0111.719] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d02910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d02910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1
	[0111.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.719] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan", lpFilePart=0x0) returned 0x2e
	[0111.719] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\", lpFilePart=0x0) returned 0x2f
	[0111.720] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d02910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d02910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.720] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d02910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d02910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.721] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6d02910, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6d02910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d02910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.724] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.725] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan", lpFilePart=0x0) returned 0x2e
	[0111.725] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\", lpFilePart=0x0) returned 0x2f
	[0111.725] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d02910, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d02910, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.727] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0111.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0111.727] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.728] GetFileType (hFile=0x220) returned 0x1
	[0111.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0111.728] GetFileType (hFile=0x220) returned 0x1
	[0111.728] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0111.729] ReadFile (in: hFile=0x220, lpBuffer=0x27c2570, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27c2570*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0111.732] CloseHandle (hObject=0x220) returned 1
	[0111.732] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x3f
	[0111.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0111.733] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.741] GetFileType (hFile=0x220) returned 0x1
	[0111.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0111.741] GetFileType (hFile=0x220) returned 0x1
	[0111.742] WriteFile (in: hFile=0x220, lpBuffer=0x27c4c48*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27c4c48*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0111.746] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0111.747] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\decrypt.txt")) returned 1
	[0111.751] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1
	[0111.752] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", lpFilePart=0x0) returned 0x3e
	[0111.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0111.752] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0111.752] GetFileType (hFile=0x220) returned 0x1
	[0111.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0111.752] GetFileType (hFile=0x220) returned 0x1
	[0111.753] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x7e148
	[0111.758] ReadFile (in: hFile=0x220, lpBuffer=0x37f48f0, nNumberOfBytesToRead=0x7e148, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x37f48f0*, lpNumberOfBytesRead=0x26ee84*=0x7e148, lpOverlapped=0x0) returned 1
	[0111.792] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.KEKW", lpFilePart=0x0) returned 0x43
	[0111.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0111.792] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
	[0111.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc40) returned 1
	[0111.798] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6cdc7b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6cdc7b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6cdc7b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg.KEKW", cAlternateFileName="WELCOM~1.KEK")) returned 1
	[0111.798] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.799] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.799] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0111.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.800] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0111.801] GetFileType (hFile=0x208) returned 0x1
	[0111.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0111.801] GetFileType (hFile=0x208) returned 0x1
	[0111.801] WriteFile (in: hFile=0x208, lpBuffer=0x27c8164*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27c8164*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0111.805] CloseHandle (hObject=0x208) returned 1
	[0111.805] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.806] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0111.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0111.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0111.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0111.806] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT", lpFilePart=0x0) returned 0x27
	[0111.807] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\", lpFilePart=0x0) returned 0x28
	[0111.807] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d28a70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d28a70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0111.808] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d28a70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d28a70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.809] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6d28a70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6d28a70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d28a70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.809] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0111.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0111.809] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0111.810] GetFileType (hFile=0x208) returned 0x1
	[0111.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0111.810] GetFileType (hFile=0x208) returned 0x1
	[0111.810] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0111.811] ReadFile (in: hFile=0x208, lpBuffer=0x27c9d3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27c9d3c*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0111.813] CloseHandle (hObject=0x208) returned 1
	[0111.813] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x38
	[0111.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0111.813] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0111.814] GetFileType (hFile=0x208) returned 0x1
	[0111.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0111.815] GetFileType (hFile=0x208) returned 0x1
	[0111.815] WriteFile (in: hFile=0x208, lpBuffer=0x27cc3fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27cc3fc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0111.818] CloseHandle (hObject=0x208) returned 1
	[0111.818] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0111.818] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\decrypt.txt")) returned 1
	[0111.822] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1386bf10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1386bf10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1
	[0111.822] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x13950750, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13950750, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1
	[0111.823] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x13950750, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13950750, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0
	[0111.823] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0111.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0111.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0111.824] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0111.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0111.824] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0111.837] GetFileType (hFile=0x204) returned 0x1
	[0111.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0111.838] GetFileType (hFile=0x204) returned 0x1
	[0111.838] WriteFile (in: hFile=0x204, lpBuffer=0x27cecc8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27cecc8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0111.842] CloseHandle (hObject=0x204) returned 1
	[0111.843] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d4ebd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d4ebd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1
	[0111.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0111.843] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x24
	[0111.843] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x25
	[0111.844] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d4ebd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d4ebd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0111.844] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d4ebd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d4ebd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.845] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6d4ebd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6d4ebd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d74d30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.846] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0111.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.846] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x2d
	[0111.846] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2e
	[0111.846] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.848] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.848] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0111.848] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0111.849] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x2d
	[0111.849] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2e
	[0111.849] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0111.850] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.850] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0111.851] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0111.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0111.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0111.851] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0111.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0111.852] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\profiles\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff
	[0111.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26dc18) returned 1
	[0111.858] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0111.858] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0111.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0111.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0111.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0111.859] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x24
	[0111.859] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x25
	[0111.859] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d4ebd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d4ebd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0111.860] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf6d4ebd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d4ebd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0111.860] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6d4ebd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6d4ebd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d74d30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0111.861] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0111.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0111.861] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0111.861] GetFileType (hFile=0x208) returned 0x1
	[0111.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0111.862] GetFileType (hFile=0x208) returned 0x1
	[0111.862] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0111.862] ReadFile (in: hFile=0x208, lpBuffer=0x27d28ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27d28ec*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0111.865] CloseHandle (hObject=0x208) returned 1
	[0111.865] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x35
	[0111.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0111.866] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0111.866] GetFileType (hFile=0x208) returned 0x1
	[0111.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0111.866] GetFileType (hFile=0x208) returned 0x1
	[0111.867] WriteFile (in: hFile=0x208, lpBuffer=0x27d4f9c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27d4f9c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0111.870] CloseHandle (hObject=0x208) returned 1
	[0112.058] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0112.059] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\decrypt.txt")) returned 1
	[0112.060] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0112.060] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0
	[0112.061] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0112.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0112.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0112.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0112.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0112.062] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0112.062] GetFileType (hFile=0x204) returned 0x1
	[0112.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0112.063] GetFileType (hFile=0x204) returned 0x1
	[0112.063] WriteFile (in: hFile=0x204, lpBuffer=0x27d7760*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27d7760*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0112.066] CloseHandle (hObject=0x204) returned 1
	[0112.066] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0112.066] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0112.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0112.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0112.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0112.067] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c
	[0112.067] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\", lpFilePart=0x0) returned 0x1d
	[0112.068] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6d9ae90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d9ae90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0112.068] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6d9ae90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6d9ae90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.069] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xfb20890, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfb20890, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1
	[0112.070] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe1a410, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xfe1a410, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0112.070] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6d9ae90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6d9ae90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6de7150, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.070] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0112.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0112.071] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0112.071] GetFileType (hFile=0x204) returned 0x1
	[0112.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0112.071] GetFileType (hFile=0x204) returned 0x1
	[0112.071] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xa5
	[0112.072] ReadFile (in: hFile=0x204, lpBuffer=0x27d9390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x27d9390*, lpNumberOfBytesRead=0x26efc4*=0xa5, lpOverlapped=0x0) returned 1
	[0112.075] CloseHandle (hObject=0x204) returned 1
	[0112.076] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x2d
	[0112.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0112.080] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0112.081] GetFileType (hFile=0x204) returned 0x1
	[0112.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0112.081] GetFileType (hFile=0x204) returned 0x1
	[0112.082] WriteFile (in: hFile=0x204, lpBuffer=0x27dba20*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x27dba20*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0112.085] CloseHandle (hObject=0x204) returned 1
	[0112.085] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0112.085] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\decrypt.txt")) returned 1
	[0112.088] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x103c1850, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x103c1850, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1
	[0112.089] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1040db10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1040db10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1
	[0112.089] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x104a6090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x104a6090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1
	[0112.090] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x105184b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x105184b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1
	[0112.090] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x10622e50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10622e50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0112.091] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1072d7f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1072d7f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1
	[0112.092] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x10753950, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10753950, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0112.092] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x107c5d70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x107c5d70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1
	[0112.093] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10838190, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10838190, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1
	[0112.093] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x108d0710, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x108d0710, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1
	[0112.094] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10a27370, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10a27370, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1
	[0112.094] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x10bf03f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10bf03f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1
	[0112.095] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10caead0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10caead0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1
	[0112.096] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10e519f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x10e519f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1
	[0112.096] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x116a66f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x116a66f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1
	[0112.097] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x11c73c90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11c73c90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1
	[0112.097] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x11cbff50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11cbff50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1
	[0112.098] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x11ce60b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x11ce60b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1
	[0112.099] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x13017210, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13017210, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0112.099] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x13572390, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13572390, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1
	[0112.100] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x139768b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x139768b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1
	[0112.100] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x13bd7eb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13bd7eb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1
	[0112.101] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x13bd7eb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13bd7eb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0
	[0112.101] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0112.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0112.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0112.102] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0112.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0112.102] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0112.103] GetFileType (hFile=0x200) returned 0x1
	[0112.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0112.103] GetFileType (hFile=0x200) returned 0x1
	[0112.103] WriteFile (in: hFile=0x200, lpBuffer=0x27df658*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27df658*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0112.107] CloseHandle (hObject=0x200) returned 1
	[0112.107] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf6f63f10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6f63f10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0112.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0112.108] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help", lpFilePart=0x0) returned 0x21
	[0112.108] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\", lpFilePart=0x0) returned 0x22
	[0112.108] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf6f63f10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6f63f10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0112.109] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf6f63f10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6f63f10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.110] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6f63f10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6f63f10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6f63f10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.110] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x896b9210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x896b9210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.hxn", cAlternateFileName="")) returned 1
	[0112.111] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1
	[0112.111] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn", cAlternateFileName="MSEXCE~2.HXN")) returned 1
	[0112.112] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn", cAlternateFileName="MSGRAP~1.HXN")) returned 1
	[0112.112] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn", cAlternateFileName="MSGROO~1.HXN")) returned 1
	[0112.113] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn", cAlternateFileName="MSINFO~1.HXN")) returned 1
	[0112.114] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn", cAlternateFileName="MSINFO~2.HXN")) returned 1
	[0112.114] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1
	[0112.115] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn", cAlternateFileName="MSMSAC~2.HXN")) returned 1
	[0112.115] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1
	[0112.116] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1
	[0112.117] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn", cAlternateFileName="MSMSPU~2.HXN")) returned 1
	[0112.117] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn", cAlternateFileName="MSMSTO~1.HXN")) returned 1
	[0112.118] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn", cAlternateFileName="MSOIS1~1.HXN")) returned 1
	[0112.119] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1
	[0112.119] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1
	[0112.120] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn", cAlternateFileName="MSOUTL~2.HXN")) returned 1
	[0112.120] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1
	[0112.121] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn", cAlternateFileName="MSPOWE~2.HXN")) returned 1
	[0112.122] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1
	[0112.122] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1
	[0112.123] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1
	[0112.124] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn", cAlternateFileName="MSVISI~4.HXN")) returned 1
	[0112.124] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_PRM.14.1033.hxn", cAlternateFileName="MSE1C9~1.HXN")) returned 1
	[0112.125] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_STD.14.1033.hxn", cAlternateFileName="MSVISI~2.HXN")) returned 1
	[0112.125] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.14.1033.hxn", cAlternateFileName="MSWINP~1.HXN")) returned 1
	[0112.126] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.DEV.14.1033.hxn", cAlternateFileName="MSWINP~2.HXN")) returned 1
	[0112.126] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.14.1033.hxn", cAlternateFileName="MSWINW~1.HXN")) returned 1
	[0112.127] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.DEV.14.1033.hxn", cAlternateFileName="MSWINW~2.HXN")) returned 1
	[0112.128] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 1
	[0112.128] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 0
	[0112.129] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0112.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0112.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0112.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0112.129] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help", lpFilePart=0x0) returned 0x21
	[0112.129] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\", lpFilePart=0x0) returned 0x22
	[0112.138] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf6f63f10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6f63f10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0112.139] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xf6f63f10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6f63f10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.140] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6f63f10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6f63f10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6f63f10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.140] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0112.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0112.140] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft help\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0112.141] GetFileType (hFile=0x204) returned 0x1
	[0112.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0112.141] GetFileType (hFile=0x204) returned 0x1
	[0112.143] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xa5
	[0112.143] ReadFile (in: hFile=0x204, lpBuffer=0x25e5958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x25e5958*, lpNumberOfBytesRead=0x26efc4*=0xa5, lpOverlapped=0x0) returned 1
	[0112.146] CloseHandle (hObject=0x204) returned 1
	[0112.146] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x32
	[0112.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0112.146] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\microsoft help\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0112.150] GetFileType (hFile=0x204) returned 0x1
	[0112.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0112.150] GetFileType (hFile=0x204) returned 0x1
	[0112.153] WriteFile (in: hFile=0x204, lpBuffer=0x25e807c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x25e807c*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0112.155] CloseHandle (hObject=0x204) returned 1
	[0112.155] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0112.156] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft help\\decrypt.txt")) returned 1
	[0112.159] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x896b9210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x896b9210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.hxn", cAlternateFileName="")) returned 1
	[0112.159] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1
	[0112.160] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn", cAlternateFileName="MSEXCE~2.HXN")) returned 1
	[0112.160] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn", cAlternateFileName="MSGRAP~1.HXN")) returned 1
	[0112.161] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn", cAlternateFileName="MSGROO~1.HXN")) returned 1
	[0112.161] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn", cAlternateFileName="MSINFO~1.HXN")) returned 1
	[0112.162] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn", cAlternateFileName="MSINFO~2.HXN")) returned 1
	[0112.162] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1
	[0112.163] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn", cAlternateFileName="MSMSAC~2.HXN")) returned 1
	[0112.163] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1
	[0112.164] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1
	[0112.164] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn", cAlternateFileName="MSMSPU~2.HXN")) returned 1
	[0112.165] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn", cAlternateFileName="MSMSTO~1.HXN")) returned 1
	[0112.165] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn", cAlternateFileName="MSOIS1~1.HXN")) returned 1
	[0112.165] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1
	[0112.166] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1
	[0112.166] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn", cAlternateFileName="MSOUTL~2.HXN")) returned 1
	[0112.167] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1
	[0112.168] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn", cAlternateFileName="MSPOWE~2.HXN")) returned 1
	[0112.168] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1
	[0112.169] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1
	[0112.169] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1
	[0112.169] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn", cAlternateFileName="MSVISI~4.HXN")) returned 1
	[0112.170] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_PRM.14.1033.hxn", cAlternateFileName="MSE1C9~1.HXN")) returned 1
	[0112.170] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_STD.14.1033.hxn", cAlternateFileName="MSVISI~2.HXN")) returned 1
	[0112.171] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.14.1033.hxn", cAlternateFileName="MSWINP~1.HXN")) returned 1
	[0112.171] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.DEV.14.1033.hxn", cAlternateFileName="MSWINP~2.HXN")) returned 1
	[0112.172] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.14.1033.hxn", cAlternateFileName="MSWINW~1.HXN")) returned 1
	[0112.172] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.DEV.14.1033.hxn", cAlternateFileName="MSWINW~2.HXN")) returned 1
	[0112.173] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 1
	[0112.173] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0112.174] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0112.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0112.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0112.174] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0112.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0112.174] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Decrypt.txt" (normalized: "c:\\users\\all users\\microsoft help\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0112.175] GetFileType (hFile=0x200) returned 0x1
	[0112.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0112.175] GetFileType (hFile=0x200) returned 0x1
	[0112.175] WriteFile (in: hFile=0x200, lpBuffer=0x25f12dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25f12dc*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0112.178] CloseHandle (hObject=0x200) returned 1
	[0112.179] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fd6330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fd6330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0112.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0112.179] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla", lpFilePart=0x0) returned 0x1a
	[0112.180] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\", lpFilePart=0x0) returned 0x1b
	[0112.180] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fd6330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fd6330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0112.180] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fd6330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fd6330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.181] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6fd6330, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6fd6330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fd6330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.182] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fb01d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fb01d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1
	[0112.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0112.182] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs", lpFilePart=0x0) returned 0x1f
	[0112.183] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x20
	[0112.183] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fb01d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fb01d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0112.184] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fb01d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fb01d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.184] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6fb01d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6fb01d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fd6330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.185] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 1
	[0112.185] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 0
	[0112.186] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0112.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0112.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0112.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0112.186] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs", lpFilePart=0x0) returned 0x1f
	[0112.186] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x20
	[0112.187] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fb01d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fb01d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0112.187] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fb01d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fb01d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.188] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6fb01d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6fb01d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fd6330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.188] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0112.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0112.188] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Decrypt.txt" (normalized: "c:\\users\\all users\\mozilla\\logs\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0112.189] GetFileType (hFile=0x208) returned 0x1
	[0112.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0112.189] GetFileType (hFile=0x208) returned 0x1
	[0112.189] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0112.189] ReadFile (in: hFile=0x208, lpBuffer=0x25f3f5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x25f3f5c*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0112.192] CloseHandle (hObject=0x208) returned 1
	[0112.192] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x30
	[0112.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0112.192] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\mozilla\\logs\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0112.193] GetFileType (hFile=0x208) returned 0x1
	[0112.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0112.193] GetFileType (hFile=0x208) returned 0x1
	[0112.194] WriteFile (in: hFile=0x208, lpBuffer=0x25f65fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25f65fc*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0112.196] CloseHandle (hObject=0x208) returned 1
	[0112.197] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0112.197] DeleteFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Decrypt.txt" (normalized: "c:\\users\\all users\\mozilla\\logs\\decrypt.txt")) returned 1
	[0112.201] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 1
	[0112.202] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0112.202] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0112.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0112.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0112.203] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Decrypt.txt", lpFilePart=0x0) returned 0x2b
	[0112.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0112.203] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Decrypt.txt" (normalized: "c:\\users\\all users\\mozilla\\logs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0112.204] GetFileType (hFile=0x204) returned 0x1
	[0112.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0112.204] GetFileType (hFile=0x204) returned 0x1
	[0112.204] WriteFile (in: hFile=0x204, lpBuffer=0x25f9028*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x25f9028*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0112.208] CloseHandle (hObject=0x204) returned 1
	[0112.208] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0112.209] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0112.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0112.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0112.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0112.209] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla", lpFilePart=0x0) returned 0x1a
	[0112.209] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\", lpFilePart=0x0) returned 0x1b
	[0112.210] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fd6330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fd6330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0112.210] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf6fd6330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fd6330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.211] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6fd6330, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6fd6330, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6fd6330, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.211] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0112.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0112.212] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Decrypt.txt" (normalized: "c:\\users\\all users\\mozilla\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0112.212] GetFileType (hFile=0x204) returned 0x1
	[0112.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0112.212] GetFileType (hFile=0x204) returned 0x1
	[0112.212] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xa5
	[0112.213] ReadFile (in: hFile=0x204, lpBuffer=0x25faa24, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x25faa24*, lpNumberOfBytesRead=0x26efc4*=0xa5, lpOverlapped=0x0) returned 1
	[0112.215] CloseHandle (hObject=0x204) returned 1
	[0112.215] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x2b
	[0112.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0112.216] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\mozilla\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0112.216] GetFileType (hFile=0x204) returned 0x1
	[0112.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0112.217] GetFileType (hFile=0x204) returned 0x1
	[0112.217] WriteFile (in: hFile=0x204, lpBuffer=0x25fd0ac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x25fd0ac*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0112.220] CloseHandle (hObject=0x204) returned 1
	[0112.220] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0112.220] DeleteFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Decrypt.txt" (normalized: "c:\\users\\all users\\mozilla\\decrypt.txt")) returned 1
	[0112.224] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x13d2eb10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13d2eb10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1
	[0112.225] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x13d2eb10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13d2eb10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0
	[0112.225] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0112.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0112.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0112.226] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0112.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0112.226] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Decrypt.txt" (normalized: "c:\\users\\all users\\mozilla\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0112.226] GetFileType (hFile=0x200) returned 0x1
	[0112.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0112.227] GetFileType (hFile=0x200) returned 0x1
	[0112.227] WriteFile (in: hFile=0x200, lpBuffer=0x25ff7ec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25ff7ec*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0112.230] CloseHandle (hObject=0x200) returned 1
	[0112.231] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf6ffc490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ffc490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1
	[0112.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0112.231] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle", lpFilePart=0x0) returned 0x19
	[0112.231] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\", lpFilePart=0x0) returned 0x1a
	[0112.232] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf6ffc490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ffc490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0112.232] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf6ffc490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ffc490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.233] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6ffc490, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6ffc490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ffc490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.234] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6ffc490, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6ffc490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ffc490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 0
	[0112.234] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0112.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0112.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0112.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0112.234] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle", lpFilePart=0x0) returned 0x19
	[0112.235] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\", lpFilePart=0x0) returned 0x1a
	[0112.235] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf6ffc490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ffc490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0112.235] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf6ffc490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ffc490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.236] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6ffc490, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf6ffc490, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf6ffc490, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.236] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0112.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0112.236] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Decrypt.txt" (normalized: "c:\\users\\all users\\oracle\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0112.237] GetFileType (hFile=0x204) returned 0x1
	[0112.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0112.237] GetFileType (hFile=0x204) returned 0x1
	[0112.237] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xa5
	[0112.238] ReadFile (in: hFile=0x204, lpBuffer=0x2601938, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x2601938*, lpNumberOfBytesRead=0x26efc4*=0xa5, lpOverlapped=0x0) returned 1
	[0112.240] CloseHandle (hObject=0x204) returned 1
	[0112.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x2a
	[0112.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0112.241] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\oracle\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0112.242] GetFileType (hFile=0x204) returned 0x1
	[0112.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0112.242] GetFileType (hFile=0x204) returned 0x1
	[0112.242] WriteFile (in: hFile=0x204, lpBuffer=0x2603fc0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x2603fc0*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0112.265] CloseHandle (hObject=0x204) returned 1
	[0112.266] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0112.266] DeleteFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Decrypt.txt" (normalized: "c:\\users\\all users\\oracle\\decrypt.txt")) returned 1
	[0112.269] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0112.270] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0112.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0112.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0112.270] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0112.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0112.271] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Decrypt.txt" (normalized: "c:\\users\\all users\\oracle\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0112.272] GetFileType (hFile=0x200) returned 0x1
	[0112.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0112.273] GetFileType (hFile=0x200) returned 0x1
	[0112.273] WriteFile (in: hFile=0x200, lpBuffer=0x2606618*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2606618*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0112.276] CloseHandle (hObject=0x200) returned 1
	[0112.277] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1
	[0112.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0112.277] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache", lpFilePart=0x0) returned 0x20
	[0112.277] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\", lpFilePart=0x0) returned 0x21
	[0112.278] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0112.278] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.279] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf72f6010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72f6010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1
	[0112.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0112.279] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpFilePart=0x0) returned 0x49
	[0112.279] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpFilePart=0x0) returned 0x4a
	[0112.280] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf72f6010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72f6010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0112.280] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf72f6010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72f6010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.281] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf72f6010, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf72f6010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72f6010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.281] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf72cfeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72cfeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0112.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0112.282] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", lpFilePart=0x0) returned 0x52
	[0112.282] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", lpFilePart=0x0) returned 0x53
	[0112.282] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf72cfeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72cfeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0112.283] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf72cfeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72cfeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.283] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf72cfeb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf72cfeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72cfeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.284] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7094a10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7094a10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1
	[0112.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0112.284] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", lpFilePart=0x0) returned 0x58
	[0112.284] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", lpFilePart=0x0) returned 0x59
	[0112.285] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7094a10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7094a10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0112.285] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7094a10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7094a10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.286] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7094a10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7094a10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72cfeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.286] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf706e8b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf706e8b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1
	[0112.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0112.287] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x5c
	[0112.287] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x5d
	[0112.287] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf706e8b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf706e8b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0112.288] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf706e8b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf706e8b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.288] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf706e8b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf706e8b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf706e8b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.289] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0112.289] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0
	[0112.290] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0112.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0112.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0112.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0112.290] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x5c
	[0112.290] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x5d
	[0112.291] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf706e8b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf706e8b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0112.291] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf706e8b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf706e8b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.292] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf706e8b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf706e8b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf706e8b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.293] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0112.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0112.293] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0112.294] GetFileType (hFile=0x228) returned 0x1
	[0112.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0112.294] GetFileType (hFile=0x228) returned 0x1
	[0112.294] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0112.294] ReadFile (in: hFile=0x228, lpBuffer=0x260d1b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x260d1b4*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0112.297] CloseHandle (hObject=0x228) returned 1
	[0112.297] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6d
	[0112.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0112.297] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0112.298] GetFileType (hFile=0x228) returned 0x1
	[0112.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0112.298] GetFileType (hFile=0x228) returned 0x1
	[0112.299] WriteFile (in: hFile=0x228, lpBuffer=0x260f944*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x260f944*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0112.301] CloseHandle (hObject=0x228) returned 1
	[0112.301] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0112.302] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\decrypt.txt")) returned 1
	[0112.305] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0112.305] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0112.306] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0112.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0112.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0112.306] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0112.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0112.307] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0112.308] GetFileType (hFile=0x224) returned 0x1
	[0112.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0112.310] GetFileType (hFile=0x224) returned 0x1
	[0112.310] WriteFile (in: hFile=0x224, lpBuffer=0x2612738*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2612738*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0112.315] CloseHandle (hObject=0x224) returned 1
	[0112.315] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0112.316] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0112.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0112.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0112.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0112.316] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", lpFilePart=0x0) returned 0x58
	[0112.316] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", lpFilePart=0x0) returned 0x59
	[0112.316] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7094a10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7094a10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0112.317] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7094a10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7094a10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.318] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7094a10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7094a10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72cfeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.318] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0112.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0112.318] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0112.319] GetFileType (hFile=0x224) returned 0x1
	[0112.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0112.319] GetFileType (hFile=0x224) returned 0x1
	[0112.319] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0112.319] ReadFile (in: hFile=0x224, lpBuffer=0x2614a68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2614a68*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0112.322] CloseHandle (hObject=0x224) returned 1
	[0112.322] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x69
	[0112.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0112.322] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0112.323] GetFileType (hFile=0x224) returned 0x1
	[0112.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0112.323] GetFileType (hFile=0x224) returned 0x1
	[0112.324] WriteFile (in: hFile=0x224, lpBuffer=0x26171e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26171e8*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0112.327] CloseHandle (hObject=0x224) returned 1
	[0112.327] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0112.327] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\decrypt.txt")) returned 1
	[0112.330] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x13e13350, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13e13350, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1
	[0112.331] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x13e13350, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13e13350, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0
	[0112.331] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0112.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0112.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0112.331] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0112.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0112.332] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0112.332] GetFileType (hFile=0x220) returned 0x1
	[0112.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0112.333] GetFileType (hFile=0x220) returned 0x1
	[0112.333] WriteFile (in: hFile=0x220, lpBuffer=0x2619b8c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2619b8c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0112.336] CloseHandle (hObject=0x220) returned 1
	[0112.336] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0112.337] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0112.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0112.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0112.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0112.337] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", lpFilePart=0x0) returned 0x52
	[0112.337] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", lpFilePart=0x0) returned 0x53
	[0112.338] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf72cfeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72cfeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0112.338] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf72cfeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72cfeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.339] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf72cfeb0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf72cfeb0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72cfeb0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.339] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0112.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0112.339] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0112.340] GetFileType (hFile=0x220) returned 0x1
	[0112.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0112.340] GetFileType (hFile=0x220) returned 0x1
	[0112.340] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0112.340] ReadFile (in: hFile=0x220, lpBuffer=0x261bdd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x261bdd8*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0112.343] CloseHandle (hObject=0x220) returned 1
	[0112.343] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x63
	[0112.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0112.344] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0112.344] GetFileType (hFile=0x220) returned 0x1
	[0112.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0112.345] GetFileType (hFile=0x220) returned 0x1
	[0112.345] WriteFile (in: hFile=0x220, lpBuffer=0x261e540*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x261e540*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0112.347] CloseHandle (hObject=0x220) returned 1
	[0112.348] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0112.348] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\decrypt.txt")) returned 1
	[0112.352] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x13e5f610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13e5f610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1
	[0112.352] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x13e5f610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13e5f610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0
	[0112.353] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0112.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0112.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0112.353] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0112.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0112.353] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0112.354] GetFileType (hFile=0x208) returned 0x1
	[0112.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0112.365] GetFileType (hFile=0x208) returned 0x1
	[0112.365] WriteFile (in: hFile=0x208, lpBuffer=0x2620eb8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2620eb8*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0112.370] CloseHandle (hObject=0x208) returned 1
	[0112.370] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0112.371] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0112.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0112.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0112.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0112.372] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpFilePart=0x0) returned 0x49
	[0112.372] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpFilePart=0x0) returned 0x4a
	[0112.372] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf72f6010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72f6010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0112.373] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf72f6010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72f6010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.373] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf72f6010, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf72f6010, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf72f6010, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.374] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0112.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0112.374] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0112.374] GetFileType (hFile=0x208) returned 0x1
	[0112.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0112.375] GetFileType (hFile=0x208) returned 0x1
	[0112.375] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0112.375] ReadFile (in: hFile=0x208, lpBuffer=0x2622f9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2622f9c*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0112.378] CloseHandle (hObject=0x208) returned 1
	[0112.378] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x5a
	[0112.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0112.378] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0112.379] GetFileType (hFile=0x208) returned 0x1
	[0112.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0112.379] GetFileType (hFile=0x208) returned 0x1
	[0112.379] WriteFile (in: hFile=0x208, lpBuffer=0x26256e4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26256e4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0112.382] CloseHandle (hObject=0x208) returned 1
	[0112.383] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0112.383] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\decrypt.txt")) returned 1
	[0112.386] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x13e85770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13e85770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0112.387] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x13e85770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13e85770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0112.387] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0112.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0112.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0112.388] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0112.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0112.388] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0112.389] GetFileType (hFile=0x204) returned 0x1
	[0112.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0112.389] GetFileType (hFile=0x204) returned 0x1
	[0112.389] WriteFile (in: hFile=0x204, lpBuffer=0x2628018*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2628018*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0112.392] CloseHandle (hObject=0x204) returned 1
	[0112.393] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1
	[0112.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0112.393] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpFilePart=0x0) returned 0x49
	[0112.394] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpFilePart=0x0) returned 0x4a
	[0112.394] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0112.395] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.395] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7368430, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf738e590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.396] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0112.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0112.396] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", lpFilePart=0x0) returned 0x52
	[0112.397] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", lpFilePart=0x0) returned 0x53
	[0112.397] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0112.398] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.398] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7368430, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.399] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1
	[0112.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0112.399] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", lpFilePart=0x0) returned 0x58
	[0112.400] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", lpFilePart=0x0) returned 0x59
	[0112.400] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0112.401] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.401] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73422d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.402] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1
	[0112.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0112.402] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x5c
	[0112.403] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x5d
	[0112.403] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0112.404] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.405] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73422d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.405] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0112.406] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0
	[0112.406] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0112.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0112.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0112.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0112.407] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x5c
	[0112.407] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x5d
	[0112.407] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0112.408] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.408] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73422d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.409] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0112.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0112.409] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0112.409] GetFileType (hFile=0x228) returned 0x1
	[0112.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0112.410] GetFileType (hFile=0x228) returned 0x1
	[0112.410] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0xa5
	[0112.410] ReadFile (in: hFile=0x228, lpBuffer=0x262e42c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x262e42c*, lpNumberOfBytesRead=0x26ed44*=0xa5, lpOverlapped=0x0) returned 1
	[0112.413] CloseHandle (hObject=0x228) returned 1
	[0112.413] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6d
	[0112.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0112.413] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0112.414] GetFileType (hFile=0x228) returned 0x1
	[0112.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0112.415] GetFileType (hFile=0x228) returned 0x1
	[0112.415] WriteFile (in: hFile=0x228, lpBuffer=0x2630bbc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2630bbc*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0112.419] CloseHandle (hObject=0x228) returned 1
	[0112.419] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0112.419] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\decrypt.txt")) returned 1
	[0112.422] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0112.423] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0112.423] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0112.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0112.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0112.424] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0112.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0112.424] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0112.425] GetFileType (hFile=0x224) returned 0x1
	[0112.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0112.425] GetFileType (hFile=0x224) returned 0x1
	[0112.425] WriteFile (in: hFile=0x224, lpBuffer=0x26339b0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26339b0*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0112.428] CloseHandle (hObject=0x224) returned 1
	[0112.429] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0112.429] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0112.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0112.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0112.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0112.430] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", lpFilePart=0x0) returned 0x58
	[0112.430] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", lpFilePart=0x0) returned 0x59
	[0112.430] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0112.431] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0112.431] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73422d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf73422d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73422d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0112.432] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0112.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0112.432] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0112.433] GetFileType (hFile=0x224) returned 0x1
	[0112.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0112.433] GetFileType (hFile=0x224) returned 0x1
	[0112.433] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0112.433] ReadFile (in: hFile=0x224, lpBuffer=0x2635ce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2635ce0*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0112.436] CloseHandle (hObject=0x224) returned 1
	[0112.436] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x69
	[0112.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0112.437] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0112.438] GetFileType (hFile=0x224) returned 0x1
	[0112.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0112.438] GetFileType (hFile=0x224) returned 0x1
	[0112.439] WriteFile (in: hFile=0x224, lpBuffer=0x2638460*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2638460*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0112.442] CloseHandle (hObject=0x224) returned 1
	[0112.442] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0112.442] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\decrypt.txt")) returned 1
	[0112.446] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x13f43e50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13f43e50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1
	[0112.446] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x13f43e50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13f43e50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0
	[0112.447] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0112.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0112.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0112.447] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt", lpFilePart=0x0) returned 0x64
	[0112.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0112.447] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0112.627] GetFileType (hFile=0x220) returned 0x1
	[0112.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0112.628] GetFileType (hFile=0x220) returned 0x1
	[0112.628] WriteFile (in: hFile=0x220, lpBuffer=0x263ae04*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x263ae04*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0113.088] CloseHandle (hObject=0x220) returned 1
	[0113.088] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.089] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0113.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0113.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0113.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0113.089] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", lpFilePart=0x0) returned 0x52
	[0113.090] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", lpFilePart=0x0) returned 0x53
	[0113.090] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0113.090] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.091] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7368430, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.091] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0113.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0113.092] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0113.092] GetFileType (hFile=0x220) returned 0x1
	[0113.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0113.092] GetFileType (hFile=0x220) returned 0x1
	[0113.092] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0113.093] ReadFile (in: hFile=0x220, lpBuffer=0x263d050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x263d050*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0113.095] CloseHandle (hObject=0x220) returned 1
	[0113.096] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x63
	[0113.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0113.096] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0113.097] GetFileType (hFile=0x220) returned 0x1
	[0113.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0113.097] GetFileType (hFile=0x220) returned 0x1
	[0113.098] WriteFile (in: hFile=0x220, lpBuffer=0x263f7b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x263f7b8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0113.101] CloseHandle (hObject=0x220) returned 1
	[0113.101] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0113.101] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\decrypt.txt")) returned 1
	[0113.105] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x14133030, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x14133030, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1
	[0113.106] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x14133030, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x14133030, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0
	[0113.106] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0113.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0113.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0113.107] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0113.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0113.107] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0113.107] GetFileType (hFile=0x208) returned 0x1
	[0113.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0113.108] GetFileType (hFile=0x208) returned 0x1
	[0113.108] WriteFile (in: hFile=0x208, lpBuffer=0x2642130*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2642130*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0113.111] CloseHandle (hObject=0x208) returned 1
	[0113.111] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.112] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0113.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0113.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0113.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0113.112] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpFilePart=0x0) returned 0x49
	[0113.113] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpFilePart=0x0) returned 0x4a
	[0113.113] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0113.113] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7368430, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.114] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7368430, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7368430, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf738e590, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.114] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0113.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0113.115] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0113.115] GetFileType (hFile=0x208) returned 0x1
	[0113.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0113.115] GetFileType (hFile=0x208) returned 0x1
	[0113.115] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0113.116] ReadFile (in: hFile=0x208, lpBuffer=0x2644214, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2644214*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0113.155] CloseHandle (hObject=0x208) returned 1
	[0113.155] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x5a
	[0113.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0113.155] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0113.156] GetFileType (hFile=0x208) returned 0x1
	[0113.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0113.157] GetFileType (hFile=0x208) returned 0x1
	[0113.157] WriteFile (in: hFile=0x208, lpBuffer=0x264695c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x264695c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0113.160] CloseHandle (hObject=0x208) returned 1
	[0113.161] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0113.161] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\decrypt.txt")) returned 1
	[0113.164] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x145cfad0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x145cfad0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0113.165] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x145cfad0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x145cfad0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0113.166] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0113.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0113.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0113.166] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0113.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.167] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0113.167] GetFileType (hFile=0x204) returned 0x1
	[0113.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0113.168] GetFileType (hFile=0x204) returned 0x1
	[0113.168] WriteFile (in: hFile=0x204, lpBuffer=0x2649290*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2649290*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0113.171] CloseHandle (hObject=0x204) returned 1
	[0113.171] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7a8c630, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7ab2790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.172] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73da850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1
	[0113.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0113.172] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0113.172] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpFilePart=0x0) returned 0x53
	[0113.173] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73da850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0113.173] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73da850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.174] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73da850, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73da850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.174] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0113.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0113.175] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0113.175] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c
	[0113.175] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0113.176] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.176] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73b46f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.177] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0113.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.178] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70
	[0113.178] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x71
	[0113.178] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0113.178] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.179] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0113.180] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73b46f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.180] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0113.181] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0113.183] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0113.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0113.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0113.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.184] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70
	[0113.184] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x71
	[0113.184] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0113.185] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.185] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0113.185] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73b46f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.186] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7c
	[0113.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0113.186] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0113.186] GetFileType (hFile=0x224) returned 0x1
	[0113.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0113.187] GetFileType (hFile=0x224) returned 0x1
	[0113.187] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0113.187] ReadFile (in: hFile=0x224, lpBuffer=0x264f890, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x264f890*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0113.190] CloseHandle (hObject=0x224) returned 1
	[0113.190] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x81
	[0113.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0113.191] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0113.196] GetFileType (hFile=0x224) returned 0x1
	[0113.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0113.197] GetFileType (hFile=0x224) returned 0x1
	[0113.197] WriteFile (in: hFile=0x224, lpBuffer=0x2652070*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2652070*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0113.200] CloseHandle (hObject=0x224) returned 1
	[0113.200] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7c
	[0113.201] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\decrypt.txt")) returned 1
	[0113.204] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0113.205] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.205] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0113.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0113.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0113.206] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7c
	[0113.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0113.206] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0113.207] GetFileType (hFile=0x220) returned 0x1
	[0113.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0113.207] GetFileType (hFile=0x220) returned 0x1
	[0113.207] WriteFile (in: hFile=0x220, lpBuffer=0x2654f94*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2654f94*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0113.210] CloseHandle (hObject=0x220) returned 1
	[0113.210] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.211] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0113.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0113.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0113.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0113.211] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0113.211] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c
	[0113.212] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0113.213] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.213] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73b46f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf73b46f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73b46f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.214] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0113.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0113.214] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0113.214] GetFileType (hFile=0x220) returned 0x1
	[0113.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0113.215] GetFileType (hFile=0x220) returned 0x1
	[0113.215] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0113.215] ReadFile (in: hFile=0x220, lpBuffer=0x2657348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2657348*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0113.218] CloseHandle (hObject=0x220) returned 1
	[0113.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6c
	[0113.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0113.218] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0113.219] GetFileType (hFile=0x220) returned 0x1
	[0113.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0113.219] GetFileType (hFile=0x220) returned 0x1
	[0113.219] WriteFile (in: hFile=0x220, lpBuffer=0x2659ad8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2659ad8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0113.222] CloseHandle (hObject=0x220) returned 1
	[0113.223] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0113.223] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\decrypt.txt")) returned 1
	[0113.226] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x146b4310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x146b4310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0113.226] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x146b4310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x146b4310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0113.227] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0113.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0113.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0113.227] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0113.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0113.239] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0113.239] GetFileType (hFile=0x208) returned 0x1
	[0113.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0113.240] GetFileType (hFile=0x208) returned 0x1
	[0113.240] WriteFile (in: hFile=0x208, lpBuffer=0x265c560*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x265c560*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0113.243] CloseHandle (hObject=0x208) returned 1
	[0113.243] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.244] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0113.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0113.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0113.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0113.244] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0113.245] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpFilePart=0x0) returned 0x53
	[0113.245] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73da850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0113.245] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73da850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.246] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73da850, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73da850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.246] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0113.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0113.247] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0113.247] GetFileType (hFile=0x208) returned 0x1
	[0113.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0113.247] GetFileType (hFile=0x208) returned 0x1
	[0113.247] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0113.247] ReadFile (in: hFile=0x208, lpBuffer=0x265e7cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x265e7cc*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0113.250] CloseHandle (hObject=0x208) returned 1
	[0113.251] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x63
	[0113.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0113.251] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0113.252] GetFileType (hFile=0x208) returned 0x1
	[0113.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0113.252] GetFileType (hFile=0x208) returned 0x1
	[0113.252] WriteFile (in: hFile=0x208, lpBuffer=0x2660f34*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2660f34*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0113.255] CloseHandle (hObject=0x208) returned 1
	[0113.256] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0113.256] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\decrypt.txt")) returned 1
	[0113.259] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x147005d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x147005d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0113.260] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x147005d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x147005d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0113.260] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0113.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0113.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0113.260] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0113.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.261] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0113.261] GetFileType (hFile=0x204) returned 0x1
	[0113.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0113.261] GetFileType (hFile=0x204) returned 0x1
	[0113.262] WriteFile (in: hFile=0x204, lpBuffer=0x26638c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26638c4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0113.265] CloseHandle (hObject=0x204) returned 1
	[0113.265] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73da850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1
	[0113.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0113.266] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x47
	[0113.266] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpFilePart=0x0) returned 0x48
	[0113.266] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73da850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0113.267] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73da850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.267] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73da850, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74009b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.268] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd314a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf08b3aa0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0113.269] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0113.269] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0113.270] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0113.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0113.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0113.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0113.270] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x47
	[0113.270] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpFilePart=0x0) returned 0x48
	[0113.271] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73da850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0113.271] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf73da850, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.272] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73da850, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf73da850, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74009b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.272] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0113.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0113.272] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0113.273] GetFileType (hFile=0x208) returned 0x1
	[0113.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0113.273] GetFileType (hFile=0x208) returned 0x1
	[0113.273] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0113.273] ReadFile (in: hFile=0x208, lpBuffer=0x2666b14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2666b14*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0113.277] CloseHandle (hObject=0x208) returned 1
	[0113.278] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x58
	[0113.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0113.278] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0113.324] GetFileType (hFile=0x208) returned 0x1
	[0113.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0113.324] GetFileType (hFile=0x208) returned 0x1
	[0113.325] WriteFile (in: hFile=0x208, lpBuffer=0x2669254*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2669254*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0113.328] CloseHandle (hObject=0x208) returned 1
	[0113.328] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0113.328] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\decrypt.txt")) returned 1
	[0113.332] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd314a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf08b3aa0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0113.332] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0113.333] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.333] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0113.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0113.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0113.334] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0113.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.334] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0113.335] GetFileType (hFile=0x204) returned 0x1
	[0113.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0113.335] GetFileType (hFile=0x204) returned 0x1
	[0113.335] WriteFile (in: hFile=0x204, lpBuffer=0x266c26c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x266c26c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0113.339] CloseHandle (hObject=0x204) returned 1
	[0113.339] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf744cc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf744cc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1
	[0113.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0113.340] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0113.340] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpFilePart=0x0) returned 0x53
	[0113.340] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf744cc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf744cc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0113.341] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf744cc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf744cc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.341] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf744cc70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf744cc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf744cc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.342] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0113.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0113.342] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0113.342] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c
	[0113.343] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0113.343] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.344] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7426b10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf744cc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.345] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0113.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.345] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x75
	[0113.345] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x76
	[0113.345] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0113.346] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.347] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87bcb00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0xa87bcb00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0xa87bcb00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0113.347] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7426b10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.348] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0113.348] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0113.349] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0113.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0113.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0113.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.349] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x75
	[0113.350] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x76
	[0113.350] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0113.350] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.351] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87bcb00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0xa87bcb00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0xa87bcb00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0113.351] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7426b10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.352] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x81
	[0113.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0113.352] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0113.361] GetFileType (hFile=0x224) returned 0x1
	[0113.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0113.362] GetFileType (hFile=0x224) returned 0x1
	[0113.362] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0113.362] ReadFile (in: hFile=0x224, lpBuffer=0x2672930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2672930*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0113.365] CloseHandle (hObject=0x224) returned 1
	[0113.365] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x86
	[0113.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0113.365] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0113.380] GetFileType (hFile=0x224) returned 0x1
	[0113.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0113.380] GetFileType (hFile=0x224) returned 0x1
	[0113.381] WriteFile (in: hFile=0x224, lpBuffer=0x2675128*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2675128*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0113.384] CloseHandle (hObject=0x224) returned 1
	[0113.384] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x81
	[0113.384] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\decrypt.txt")) returned 1
	[0113.387] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0113.388] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.388] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0113.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0113.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0113.388] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x81
	[0113.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0113.389] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0113.389] GetFileType (hFile=0x220) returned 0x1
	[0113.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0113.390] GetFileType (hFile=0x220) returned 0x1
	[0113.390] WriteFile (in: hFile=0x220, lpBuffer=0x26780bc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26780bc*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0113.393] CloseHandle (hObject=0x220) returned 1
	[0113.393] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.394] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0113.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0113.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0113.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0113.394] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0113.394] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c
	[0113.395] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0113.395] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7426b10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.396] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7426b10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7426b10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf744cc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.396] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0113.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0113.396] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0113.397] GetFileType (hFile=0x220) returned 0x1
	[0113.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0113.397] GetFileType (hFile=0x220) returned 0x1
	[0113.397] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0113.397] ReadFile (in: hFile=0x220, lpBuffer=0x267a470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x267a470*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0113.400] CloseHandle (hObject=0x220) returned 1
	[0113.400] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6c
	[0113.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0113.400] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0113.401] GetFileType (hFile=0x220) returned 0x1
	[0113.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0113.401] GetFileType (hFile=0x220) returned 0x1
	[0113.402] WriteFile (in: hFile=0x220, lpBuffer=0x267cc00*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x267cc00*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0113.405] CloseHandle (hObject=0x220) returned 1
	[0113.405] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0113.405] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\decrypt.txt")) returned 1
	[0113.408] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x1487d390, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1487d390, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0113.409] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x1487d390, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1487d390, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0113.409] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0113.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0113.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0113.410] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0113.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0113.410] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0113.410] GetFileType (hFile=0x208) returned 0x1
	[0113.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0113.411] GetFileType (hFile=0x208) returned 0x1
	[0113.411] WriteFile (in: hFile=0x208, lpBuffer=0x267f6a8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x267f6a8*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0113.414] CloseHandle (hObject=0x208) returned 1
	[0113.414] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.423] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0113.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0113.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0113.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0113.424] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0113.424] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpFilePart=0x0) returned 0x53
	[0113.424] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf744cc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf744cc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0113.425] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf744cc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf744cc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.426] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf744cc70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf744cc70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf744cc70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.426] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0113.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0113.426] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0113.427] GetFileType (hFile=0x208) returned 0x1
	[0113.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0113.427] GetFileType (hFile=0x208) returned 0x1
	[0113.427] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0113.427] ReadFile (in: hFile=0x208, lpBuffer=0x2681914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2681914*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0113.430] CloseHandle (hObject=0x208) returned 1
	[0113.430] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x63
	[0113.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0113.431] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0113.432] GetFileType (hFile=0x208) returned 0x1
	[0113.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0113.432] GetFileType (hFile=0x208) returned 0x1
	[0113.432] WriteFile (in: hFile=0x208, lpBuffer=0x268407c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x268407c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0113.435] CloseHandle (hObject=0x208) returned 1
	[0113.436] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0113.436] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\decrypt.txt")) returned 1
	[0113.439] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x148a34f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x148a34f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0113.440] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x148a34f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x148a34f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0113.440] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0113.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0113.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0113.440] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0113.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.441] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0113.441] GetFileType (hFile=0x204) returned 0x1
	[0113.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0113.441] GetFileType (hFile=0x204) returned 0x1
	[0113.442] WriteFile (in: hFile=0x204, lpBuffer=0x2686a0c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2686a0c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0113.448] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7472dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7472dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1
	[0113.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0113.449] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpFilePart=0x0) returned 0x47
	[0113.449] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpFilePart=0x0) returned 0x48
	[0113.449] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7472dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7472dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0113.450] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7472dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7472dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.450] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7472dd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7472dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7472dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.451] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a127460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1c821ca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0113.451] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0113.452] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0113.452] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0113.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0113.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0113.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0113.453] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpFilePart=0x0) returned 0x47
	[0113.453] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpFilePart=0x0) returned 0x48
	[0113.453] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7472dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7472dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0113.453] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7472dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7472dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.454] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7472dd0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7472dd0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7472dd0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.454] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0113.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0113.455] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0113.455] GetFileType (hFile=0x208) returned 0x1
	[0113.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0113.455] GetFileType (hFile=0x208) returned 0x1
	[0113.455] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0113.455] ReadFile (in: hFile=0x208, lpBuffer=0x2689c5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2689c5c*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0113.458] CloseHandle (hObject=0x208) returned 1
	[0113.458] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x58
	[0113.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0113.458] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0113.493] GetFileType (hFile=0x208) returned 0x1
	[0113.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0113.493] GetFileType (hFile=0x208) returned 0x1
	[0113.494] WriteFile (in: hFile=0x208, lpBuffer=0x268c39c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x268c39c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0113.497] CloseHandle (hObject=0x208) returned 1
	[0113.497] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0113.497] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\decrypt.txt")) returned 1
	[0113.500] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a127460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1c821ca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0113.500] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0113.501] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.501] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0113.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0113.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0113.502] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0113.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.502] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0113.503] GetFileType (hFile=0x204) returned 0x1
	[0113.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0113.503] GetFileType (hFile=0x204) returned 0x1
	[0113.503] WriteFile (in: hFile=0x204, lpBuffer=0x268f3b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x268f3b4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0113.506] CloseHandle (hObject=0x204) returned 1
	[0113.506] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1
	[0113.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0113.507] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0113.507] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpFilePart=0x0) returned 0x54
	[0113.507] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0113.508] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.508] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74bf090, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.509] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0113.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0113.509] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0113.510] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d
	[0113.510] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0113.510] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.511] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74bf090, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.512] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf7498f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7498f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0113.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.512] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x71
	[0113.512] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x72
	[0113.513] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf7498f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7498f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0113.513] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf7498f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7498f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.514] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15e8b00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd15e8b00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd15e8b00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0113.514] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7498f30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7498f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7498f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.515] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0113.515] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0113.516] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0113.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0113.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0113.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.517] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x71
	[0113.517] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x72
	[0113.517] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf7498f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7498f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0113.518] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf7498f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7498f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.518] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15e8b00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd15e8b00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd15e8b00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0113.519] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7498f30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7498f30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7498f30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.519] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7d
	[0113.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0113.519] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0113.519] GetFileType (hFile=0x224) returned 0x1
	[0113.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0113.520] GetFileType (hFile=0x224) returned 0x1
	[0113.520] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0113.520] ReadFile (in: hFile=0x224, lpBuffer=0x2695934, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2695934*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0113.523] CloseHandle (hObject=0x224) returned 1
	[0113.523] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x82
	[0113.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0113.523] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0113.714] GetFileType (hFile=0x224) returned 0x1
	[0113.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0113.716] GetFileType (hFile=0x224) returned 0x1
	[0113.716] WriteFile (in: hFile=0x224, lpBuffer=0x269811c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x269811c*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0113.719] CloseHandle (hObject=0x224) returned 1
	[0113.719] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7d
	[0113.720] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\decrypt.txt")) returned 1
	[0113.723] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0113.723] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.724] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0113.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0113.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0113.724] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7d
	[0113.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0113.725] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0113.725] GetFileType (hFile=0x220) returned 0x1
	[0113.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0113.726] GetFileType (hFile=0x220) returned 0x1
	[0113.726] WriteFile (in: hFile=0x220, lpBuffer=0x269b048*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x269b048*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0113.730] CloseHandle (hObject=0x220) returned 1
	[0113.730] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.731] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0113.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0113.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0113.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0113.731] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0113.731] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d
	[0113.732] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0113.732] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.733] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74bf090, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.733] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0113.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0113.734] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0113.734] GetFileType (hFile=0x220) returned 0x1
	[0113.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0113.734] GetFileType (hFile=0x220) returned 0x1
	[0113.734] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0113.735] ReadFile (in: hFile=0x220, lpBuffer=0x269d434, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x269d434*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0113.737] CloseHandle (hObject=0x220) returned 1
	[0113.737] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6d
	[0113.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0113.738] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0113.739] GetFileType (hFile=0x220) returned 0x1
	[0113.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0113.739] GetFileType (hFile=0x220) returned 0x1
	[0113.739] WriteFile (in: hFile=0x220, lpBuffer=0x269fbc4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x269fbc4*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0113.763] CloseHandle (hObject=0x220) returned 1
	[0113.764] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0113.764] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\decrypt.txt")) returned 1
	[0113.767] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x14b9d070, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x14b9d070, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0113.768] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x14b9d070, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x14b9d070, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0113.769] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0113.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0113.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0113.772] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0113.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0113.772] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0113.773] GetFileType (hFile=0x208) returned 0x1
	[0113.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0113.773] GetFileType (hFile=0x208) returned 0x1
	[0113.773] WriteFile (in: hFile=0x208, lpBuffer=0x26a2658*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26a2658*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0113.776] CloseHandle (hObject=0x208) returned 1
	[0113.777] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.777] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0113.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0113.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0113.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0113.778] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0113.778] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpFilePart=0x0) returned 0x54
	[0113.778] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0113.779] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.779] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74bf090, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf74bf090, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74bf090, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.780] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0113.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0113.780] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0113.780] GetFileType (hFile=0x208) returned 0x1
	[0113.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0113.780] GetFileType (hFile=0x208) returned 0x1
	[0113.781] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0113.781] ReadFile (in: hFile=0x208, lpBuffer=0x26a48dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26a48dc*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0113.783] CloseHandle (hObject=0x208) returned 1
	[0113.784] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x64
	[0113.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0113.784] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0113.785] GetFileType (hFile=0x208) returned 0x1
	[0113.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0113.785] GetFileType (hFile=0x208) returned 0x1
	[0113.785] WriteFile (in: hFile=0x208, lpBuffer=0x26a704c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26a704c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0113.788] CloseHandle (hObject=0x208) returned 1
	[0113.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0113.789] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\decrypt.txt")) returned 1
	[0113.793] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x14c0f490, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x14c0f490, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0113.793] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x14c0f490, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x14c0f490, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0113.794] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0113.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0113.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0113.794] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0113.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.794] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0113.795] GetFileType (hFile=0x204) returned 0x1
	[0113.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0113.795] GetFileType (hFile=0x204) returned 0x1
	[0113.795] WriteFile (in: hFile=0x204, lpBuffer=0x26a99e4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26a99e4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0113.798] CloseHandle (hObject=0x204) returned 1
	[0113.798] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1
	[0113.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0113.799] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0113.799] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpFilePart=0x0) returned 0x54
	[0113.799] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0113.800] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.801] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf750b350, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf75314b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.801] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0113.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0113.802] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0113.802] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d
	[0113.802] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0113.803] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.803] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf750b350, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.804] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74e51f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74e51f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0113.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.805] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x74
	[0113.811] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x75
	[0113.812] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74e51f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74e51f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0113.812] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74e51f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74e51f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.813] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0113.813] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74e51f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf74e51f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74e51f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.814] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0113.814] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0113.815] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0113.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0113.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0113.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0113.815] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x74
	[0113.815] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x75
	[0113.816] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74e51f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74e51f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0113.816] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf74e51f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74e51f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.817] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0113.818] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74e51f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf74e51f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf74e51f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.818] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x80
	[0113.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0113.818] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0113.819] GetFileType (hFile=0x224) returned 0x1
	[0113.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0113.819] GetFileType (hFile=0x224) returned 0x1
	[0113.819] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0113.820] ReadFile (in: hFile=0x224, lpBuffer=0x26b00ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26b00ac*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0113.823] CloseHandle (hObject=0x224) returned 1
	[0113.823] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x85
	[0113.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0113.823] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0113.867] GetFileType (hFile=0x224) returned 0x1
	[0113.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0113.867] GetFileType (hFile=0x224) returned 0x1
	[0113.870] WriteFile (in: hFile=0x224, lpBuffer=0x26b289c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26b289c*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0113.872] CloseHandle (hObject=0x224) returned 1
	[0113.873] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x80
	[0113.873] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\decrypt.txt")) returned 1
	[0113.876] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0113.877] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.877] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0113.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0113.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0113.878] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x80
	[0113.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0113.878] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0113.879] GetFileType (hFile=0x220) returned 0x1
	[0113.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0113.879] GetFileType (hFile=0x220) returned 0x1
	[0113.879] WriteFile (in: hFile=0x220, lpBuffer=0x26b5824*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26b5824*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0113.882] CloseHandle (hObject=0x220) returned 1
	[0113.882] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0113.883] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0113.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0113.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0113.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0113.883] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0113.884] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d
	[0113.884] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0113.885] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0113.885] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf750b350, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0113.885] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0113.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0113.886] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0113.886] GetFileType (hFile=0x220) returned 0x1
	[0113.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0113.886] GetFileType (hFile=0x220) returned 0x1
	[0113.886] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0113.887] ReadFile (in: hFile=0x220, lpBuffer=0x26b7c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26b7c10*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0113.889] CloseHandle (hObject=0x220) returned 1
	[0113.890] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6d
	[0113.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0113.890] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0113.891] GetFileType (hFile=0x220) returned 0x1
	[0113.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0113.891] GetFileType (hFile=0x220) returned 0x1
	[0113.891] WriteFile (in: hFile=0x220, lpBuffer=0x26ba3a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26ba3a0*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0113.894] CloseHandle (hObject=0x220) returned 1
	[0113.894] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0113.895] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\decrypt.txt")) returned 1
	[0113.898] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x14d19e30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x14d19e30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.193] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x14d19e30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x14d19e30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0114.193] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.194] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0114.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0114.195] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0114.196] GetFileType (hFile=0x208) returned 0x1
	[0114.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0114.196] GetFileType (hFile=0x208) returned 0x1
	[0114.196] WriteFile (in: hFile=0x208, lpBuffer=0x26bce4c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26bce4c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0114.200] CloseHandle (hObject=0x208) returned 1
	[0114.200] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.200] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.201] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0114.201] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpFilePart=0x0) returned 0x54
	[0114.201] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.202] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf750b350, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.202] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf750b350, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf750b350, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf75314b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.203] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0114.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0114.203] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.203] GetFileType (hFile=0x208) returned 0x1
	[0114.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0114.204] GetFileType (hFile=0x208) returned 0x1
	[0114.204] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0114.204] ReadFile (in: hFile=0x208, lpBuffer=0x26bf0d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26bf0d0*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0114.207] CloseHandle (hObject=0x208) returned 1
	[0114.207] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x64
	[0114.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0114.207] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.208] GetFileType (hFile=0x208) returned 0x1
	[0114.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0114.208] GetFileType (hFile=0x208) returned 0x1
	[0114.209] WriteFile (in: hFile=0x208, lpBuffer=0x26c1840*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26c1840*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0114.215] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0114.215] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\decrypt.txt")) returned 1
	[0114.218] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x15039b10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15039b10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.218] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x15039b10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15039b10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0114.219] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.219] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0114.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.220] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0114.220] GetFileType (hFile=0x204) returned 0x1
	[0114.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0114.220] GetFileType (hFile=0x204) returned 0x1
	[0114.221] WriteFile (in: hFile=0x204, lpBuffer=0x26c41d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26c41d8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0114.223] CloseHandle (hObject=0x204) returned 1
	[0114.223] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf76ae270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf76ae270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1
	[0114.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.224] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0114.224] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpFilePart=0x0) returned 0x54
	[0114.224] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf76ae270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf76ae270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.225] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf76ae270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf76ae270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.226] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf76ae270, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf76ae270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf77467f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.231] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7688110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7688110, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.232] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0114.232] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d
	[0114.232] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7688110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7688110, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.233] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7688110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7688110, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.233] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7688110, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7688110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf76ae270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.234] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7557610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7557610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.234] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x73
	[0114.235] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x74
	[0114.235] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7557610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7557610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.236] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7557610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7557610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.236] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.237] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7557610, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7557610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7557610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.237] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.238] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0114.238] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.239] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x73
	[0114.239] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x74
	[0114.239] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7557610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7557610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.240] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7557610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7557610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.240] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.241] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7557610, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7557610, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7557610, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7f
	[0114.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0114.241] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.242] GetFileType (hFile=0x224) returned 0x1
	[0114.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0114.242] GetFileType (hFile=0x224) returned 0x1
	[0114.243] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0114.243] ReadFile (in: hFile=0x224, lpBuffer=0x26ca810, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26ca810*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.245] CloseHandle (hObject=0x224) returned 1
	[0114.246] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x84
	[0114.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0114.246] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.255] GetFileType (hFile=0x224) returned 0x1
	[0114.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0114.255] GetFileType (hFile=0x224) returned 0x1
	[0114.255] WriteFile (in: hFile=0x224, lpBuffer=0x26cd000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26cd000*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0114.258] CloseHandle (hObject=0x224) returned 1
	[0114.258] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7f
	[0114.259] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\decrypt.txt")) returned 1
	[0114.262] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.262] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.263] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.263] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7f
	[0114.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0114.263] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0114.264] GetFileType (hFile=0x220) returned 0x1
	[0114.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0114.264] GetFileType (hFile=0x220) returned 0x1
	[0114.264] WriteFile (in: hFile=0x220, lpBuffer=0x26cff4c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26cff4c*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.267] CloseHandle (hObject=0x220) returned 1
	[0114.268] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.268] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.313] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0114.314] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d
	[0114.314] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7688110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7688110, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.315] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7688110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7688110, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.315] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7688110, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7688110, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf76ae270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.316] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0114.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0114.316] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.316] GetFileType (hFile=0x220) returned 0x1
	[0114.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0114.317] GetFileType (hFile=0x220) returned 0x1
	[0114.317] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0114.317] ReadFile (in: hFile=0x220, lpBuffer=0x26d2338, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26d2338*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0114.320] CloseHandle (hObject=0x220) returned 1
	[0114.321] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6d
	[0114.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0114.321] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.322] GetFileType (hFile=0x220) returned 0x1
	[0114.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0114.322] GetFileType (hFile=0x220) returned 0x1
	[0114.322] WriteFile (in: hFile=0x220, lpBuffer=0x26d4ac8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26d4ac8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0114.325] CloseHandle (hObject=0x220) returned 1
	[0114.325] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0114.326] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\decrypt.txt")) returned 1
	[0114.329] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x150d2090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x150d2090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.329] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x150d2090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x150d2090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0114.330] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.330] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0114.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0114.331] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0114.331] GetFileType (hFile=0x208) returned 0x1
	[0114.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0114.331] GetFileType (hFile=0x208) returned 0x1
	[0114.332] WriteFile (in: hFile=0x208, lpBuffer=0x26d756c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26d756c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0114.334] CloseHandle (hObject=0x208) returned 1
	[0114.335] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.335] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.343] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0114.343] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpFilePart=0x0) returned 0x54
	[0114.344] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf76ae270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf76ae270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.344] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf76ae270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf76ae270, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.345] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf76ae270, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf76ae270, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf77467f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.345] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0114.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0114.345] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.346] GetFileType (hFile=0x208) returned 0x1
	[0114.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0114.346] GetFileType (hFile=0x208) returned 0x1
	[0114.346] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0114.346] ReadFile (in: hFile=0x208, lpBuffer=0x26d97f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26d97f0*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0114.349] CloseHandle (hObject=0x208) returned 1
	[0114.349] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x64
	[0114.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0114.349] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.350] GetFileType (hFile=0x208) returned 0x1
	[0114.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0114.350] GetFileType (hFile=0x208) returned 0x1
	[0114.350] WriteFile (in: hFile=0x208, lpBuffer=0x26dbf60*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26dbf60*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0114.359] CloseHandle (hObject=0x208) returned 1
	[0114.359] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0114.359] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\decrypt.txt")) returned 1
	[0114.362] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x1516a610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1516a610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.363] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x1516a610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1516a610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0114.363] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.364] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0114.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.364] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0114.365] GetFileType (hFile=0x204) returned 0x1
	[0114.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0114.365] GetFileType (hFile=0x204) returned 0x1
	[0114.365] WriteFile (in: hFile=0x204, lpBuffer=0x26de8f8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26de8f8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0114.369] CloseHandle (hObject=0x204) returned 1
	[0114.369] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1
	[0114.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.370] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0114.370] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpFilePart=0x0) returned 0x53
	[0114.370] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.371] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.371] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7792ab0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf77b8c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.372] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.372] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0114.373] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c
	[0114.373] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.373] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.374] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7792ab0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.375] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.375] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x75
	[0114.375] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x76
	[0114.376] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.376] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.376] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9b1b00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7c9b1b00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7c9b1b00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.377] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7792ab0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.377] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.378] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0114.378] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.379] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x75
	[0114.379] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x76
	[0114.379] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.380] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.380] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9b1b00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7c9b1b00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7c9b1b00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.381] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7792ab0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.381] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x81
	[0114.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0114.381] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.381] GetFileType (hFile=0x224) returned 0x1
	[0114.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0114.382] GetFileType (hFile=0x224) returned 0x1
	[0114.382] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0114.382] ReadFile (in: hFile=0x224, lpBuffer=0x26e4fbc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26e4fbc*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.385] CloseHandle (hObject=0x224) returned 1
	[0114.385] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x86
	[0114.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0114.385] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.391] GetFileType (hFile=0x224) returned 0x1
	[0114.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0114.391] GetFileType (hFile=0x224) returned 0x1
	[0114.391] WriteFile (in: hFile=0x224, lpBuffer=0x26e77b4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26e77b4*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0114.394] CloseHandle (hObject=0x224) returned 1
	[0114.394] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x81
	[0114.394] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\decrypt.txt")) returned 1
	[0114.398] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.399] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.399] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.400] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x81
	[0114.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0114.400] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0114.400] GetFileType (hFile=0x220) returned 0x1
	[0114.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0114.401] GetFileType (hFile=0x220) returned 0x1
	[0114.401] WriteFile (in: hFile=0x220, lpBuffer=0x26ea748*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26ea748*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.404] CloseHandle (hObject=0x220) returned 1
	[0114.404] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.404] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.405] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0114.405] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c
	[0114.405] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.406] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.406] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7792ab0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.407] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0114.407] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.408] GetFileType (hFile=0x220) returned 0x1
	[0114.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0114.408] GetFileType (hFile=0x220) returned 0x1
	[0114.408] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0114.408] ReadFile (in: hFile=0x220, lpBuffer=0x26ecafc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x26ecafc*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0114.411] CloseHandle (hObject=0x220) returned 1
	[0114.411] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6c
	[0114.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0114.411] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.412] GetFileType (hFile=0x220) returned 0x1
	[0114.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0114.412] GetFileType (hFile=0x220) returned 0x1
	[0114.413] WriteFile (in: hFile=0x220, lpBuffer=0x26ef28c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x26ef28c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0114.416] CloseHandle (hObject=0x220) returned 1
	[0114.416] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.416] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\decrypt.txt")) returned 1
	[0114.419] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x15228cf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15228cf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.419] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x15228cf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15228cf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0114.420] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.420] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0114.421] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0114.421] GetFileType (hFile=0x208) returned 0x1
	[0114.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0114.421] GetFileType (hFile=0x208) returned 0x1
	[0114.422] WriteFile (in: hFile=0x208, lpBuffer=0x26f1d34*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x26f1d34*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0114.425] CloseHandle (hObject=0x208) returned 1
	[0114.426] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.426] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.427] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0114.427] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpFilePart=0x0) returned 0x53
	[0114.427] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.427] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7792ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.428] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7792ab0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7792ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf77b8c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.428] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0114.429] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.430] GetFileType (hFile=0x208) returned 0x1
	[0114.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0114.430] GetFileType (hFile=0x208) returned 0x1
	[0114.430] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0114.430] ReadFile (in: hFile=0x208, lpBuffer=0x26f3fa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x26f3fa0*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0114.433] CloseHandle (hObject=0x208) returned 1
	[0114.433] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x63
	[0114.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0114.434] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.434] GetFileType (hFile=0x208) returned 0x1
	[0114.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0114.435] GetFileType (hFile=0x208) returned 0x1
	[0114.435] WriteFile (in: hFile=0x208, lpBuffer=0x26f6708*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x26f6708*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0114.438] CloseHandle (hObject=0x208) returned 1
	[0114.438] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.438] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\decrypt.txt")) returned 1
	[0114.442] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1524ee50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1524ee50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.442] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1524ee50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1524ee50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0114.443] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.443] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.443] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0114.444] GetFileType (hFile=0x204) returned 0x1
	[0114.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0114.444] GetFileType (hFile=0x204) returned 0x1
	[0114.445] WriteFile (in: hFile=0x204, lpBuffer=0x26f9098*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26f9098*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0114.451] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1
	[0114.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.452] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0114.452] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", lpFilePart=0x0) returned 0x53
	[0114.452] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.452] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.453] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7851190, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf78772f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.453] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.454] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0114.454] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c
	[0114.454] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.455] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.455] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7851190, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.456] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf77b8c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf77b8c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.456] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x72
	[0114.456] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x73
	[0114.457] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf77b8c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf77b8c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.457] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf77b8c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf77b8c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.458] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b69ee00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7b69ee00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7b69ee00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.458] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf77b8c10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf77b8c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.459] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.459] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0114.460] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.487] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x72
	[0114.487] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x73
	[0114.487] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf77b8c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf77b8c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.488] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf77b8c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf77b8c10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.488] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b69ee00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7b69ee00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7b69ee00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.489] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf77b8c10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf77b8c10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.489] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7e
	[0114.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0114.489] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.490] GetFileType (hFile=0x224) returned 0x1
	[0114.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0114.490] GetFileType (hFile=0x224) returned 0x1
	[0114.490] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0114.490] ReadFile (in: hFile=0x224, lpBuffer=0x26ff648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x26ff648*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.493] CloseHandle (hObject=0x224) returned 1
	[0114.494] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x83
	[0114.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0114.494] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.499] GetFileType (hFile=0x224) returned 0x1
	[0114.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0114.499] GetFileType (hFile=0x224) returned 0x1
	[0114.500] WriteFile (in: hFile=0x224, lpBuffer=0x2701e30*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2701e30*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0114.503] CloseHandle (hObject=0x224) returned 1
	[0114.503] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7e
	[0114.503] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\decrypt.txt")) returned 1
	[0114.506] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.506] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.507] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.507] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7e
	[0114.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0114.508] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0114.508] GetFileType (hFile=0x220) returned 0x1
	[0114.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0114.509] GetFileType (hFile=0x220) returned 0x1
	[0114.509] WriteFile (in: hFile=0x220, lpBuffer=0x2704d74*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2704d74*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.512] CloseHandle (hObject=0x220) returned 1
	[0114.512] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.512] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.513] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0114.513] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c
	[0114.513] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.514] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.514] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7851190, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.515] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0114.515] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.515] GetFileType (hFile=0x220) returned 0x1
	[0114.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0114.516] GetFileType (hFile=0x220) returned 0x1
	[0114.516] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0114.516] ReadFile (in: hFile=0x220, lpBuffer=0x2707128, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2707128*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0114.519] CloseHandle (hObject=0x220) returned 1
	[0114.519] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6c
	[0114.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0114.519] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.520] GetFileType (hFile=0x220) returned 0x1
	[0114.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0114.520] GetFileType (hFile=0x220) returned 0x1
	[0114.521] WriteFile (in: hFile=0x220, lpBuffer=0x27098b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27098b8*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0114.523] CloseHandle (hObject=0x220) returned 1
	[0114.524] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.524] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\decrypt.txt")) returned 1
	[0114.527] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x15333690, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15333690, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.527] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x15333690, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15333690, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0114.528] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.528] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0114.528] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0114.529] GetFileType (hFile=0x208) returned 0x1
	[0114.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0114.529] GetFileType (hFile=0x208) returned 0x1
	[0114.529] WriteFile (in: hFile=0x208, lpBuffer=0x270c350*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x270c350*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0114.532] CloseHandle (hObject=0x208) returned 1
	[0114.533] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.533] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.534] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0114.534] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", lpFilePart=0x0) returned 0x53
	[0114.534] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.535] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7851190, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.535] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7851190, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7851190, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf78772f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.536] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0114.536] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.536] GetFileType (hFile=0x208) returned 0x1
	[0114.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0114.536] GetFileType (hFile=0x208) returned 0x1
	[0114.537] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0114.537] ReadFile (in: hFile=0x208, lpBuffer=0x270e5bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x270e5bc*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0114.540] CloseHandle (hObject=0x208) returned 1
	[0114.540] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x63
	[0114.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0114.540] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.541] GetFileType (hFile=0x208) returned 0x1
	[0114.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0114.541] GetFileType (hFile=0x208) returned 0x1
	[0114.541] WriteFile (in: hFile=0x208, lpBuffer=0x2710d24*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2710d24*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0114.544] CloseHandle (hObject=0x208) returned 1
	[0114.544] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.544] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\decrypt.txt")) returned 1
	[0114.547] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x153597f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x153597f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.548] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x153597f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x153597f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0114.548] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.548] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.549] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0114.549] GetFileType (hFile=0x204) returned 0x1
	[0114.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0114.549] GetFileType (hFile=0x204) returned 0x1
	[0114.550] WriteFile (in: hFile=0x204, lpBuffer=0x27136b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27136b4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0114.553] CloseHandle (hObject=0x204) returned 1
	[0114.553] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1
	[0114.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0114.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpFilePart=0x0) returned 0x53
	[0114.554] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.554] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.558] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79359d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.558] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0114.559] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c
	[0114.559] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.559] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.560] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf790f870, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.560] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.561] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73
	[0114.561] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x74
	[0114.561] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.562] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.563] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aae6600, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x8aae6600, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x8aae6600, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.563] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf790f870, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.564] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.564] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0114.564] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.565] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73
	[0114.565] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x74
	[0114.565] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.566] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.566] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aae6600, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x8aae6600, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x8aae6600, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.567] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf790f870, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.567] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7f
	[0114.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0114.567] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.567] GetFileType (hFile=0x224) returned 0x1
	[0114.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0114.568] GetFileType (hFile=0x224) returned 0x1
	[0114.568] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0114.568] ReadFile (in: hFile=0x224, lpBuffer=0x2719cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x2719cc0*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.571] CloseHandle (hObject=0x224) returned 1
	[0114.571] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x84
	[0114.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0114.571] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.576] GetFileType (hFile=0x224) returned 0x1
	[0114.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0114.577] GetFileType (hFile=0x224) returned 0x1
	[0114.577] WriteFile (in: hFile=0x224, lpBuffer=0x271c4b0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x271c4b0*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0114.580] CloseHandle (hObject=0x224) returned 1
	[0114.580] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7f
	[0114.581] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\decrypt.txt")) returned 1
	[0114.584] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.584] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.584] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.585] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7f
	[0114.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0114.585] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0114.586] GetFileType (hFile=0x220) returned 0x1
	[0114.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0114.586] GetFileType (hFile=0x220) returned 0x1
	[0114.586] WriteFile (in: hFile=0x220, lpBuffer=0x271f424*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x271f424*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.589] CloseHandle (hObject=0x220) returned 1
	[0114.590] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.590] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.591] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0114.591] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c
	[0114.591] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.592] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.592] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf790f870, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf790f870, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf790f870, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.593] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0114.593] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.593] GetFileType (hFile=0x220) returned 0x1
	[0114.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0114.594] GetFileType (hFile=0x220) returned 0x1
	[0114.594] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0114.594] ReadFile (in: hFile=0x220, lpBuffer=0x27217d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27217d8*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0114.597] CloseHandle (hObject=0x220) returned 1
	[0114.597] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6c
	[0114.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0114.597] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.598] GetFileType (hFile=0x220) returned 0x1
	[0114.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0114.598] GetFileType (hFile=0x220) returned 0x1
	[0114.599] WriteFile (in: hFile=0x220, lpBuffer=0x2723f68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2723f68*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0114.602] CloseHandle (hObject=0x220) returned 1
	[0114.603] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.603] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\decrypt.txt")) returned 1
	[0114.606] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x153f1d70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x153f1d70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.607] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x153f1d70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x153f1d70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0114.607] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.608] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0114.608] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0114.609] GetFileType (hFile=0x208) returned 0x1
	[0114.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0114.609] GetFileType (hFile=0x208) returned 0x1
	[0114.609] WriteFile (in: hFile=0x208, lpBuffer=0x2726a00*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2726a00*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0114.612] CloseHandle (hObject=0x208) returned 1
	[0114.612] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.612] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.613] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0114.613] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpFilePart=0x0) returned 0x53
	[0114.613] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.614] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.615] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79359d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.615] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0114.615] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.615] GetFileType (hFile=0x208) returned 0x1
	[0114.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0114.616] GetFileType (hFile=0x208) returned 0x1
	[0114.616] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0114.617] ReadFile (in: hFile=0x208, lpBuffer=0x2728c6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2728c6c*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0114.619] CloseHandle (hObject=0x208) returned 1
	[0114.619] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x63
	[0114.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0114.620] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.620] GetFileType (hFile=0x208) returned 0x1
	[0114.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0114.621] GetFileType (hFile=0x208) returned 0x1
	[0114.621] WriteFile (in: hFile=0x208, lpBuffer=0x272b3d4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x272b3d4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0114.633] CloseHandle (hObject=0x208) returned 1
	[0114.633] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.634] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\decrypt.txt")) returned 1
	[0114.637] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x15417ed0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15417ed0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.637] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x15417ed0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15417ed0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0114.638] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.638] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.638] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0114.639] GetFileType (hFile=0x204) returned 0x1
	[0114.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0114.639] GetFileType (hFile=0x204) returned 0x1
	[0114.639] WriteFile (in: hFile=0x204, lpBuffer=0x272dd64*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x272dd64*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0114.642] CloseHandle (hObject=0x204) returned 1
	[0114.643] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1
	[0114.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.643] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0114.643] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpFilePart=0x0) returned 0x53
	[0114.644] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.644] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.645] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf795bb30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7981c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.645] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.646] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0114.646] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c
	[0114.646] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.648] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.648] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf795bb30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.649] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.649] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70
	[0114.650] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x71
	[0114.650] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.650] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.651] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884c0c00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x884c0c00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x884c0c00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.652] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79359d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.652] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.653] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0114.653] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.653] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70
	[0114.654] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x71
	[0114.654] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.654] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79359d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.655] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884c0c00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x884c0c00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x884c0c00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.655] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79359d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf79359d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.656] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7c
	[0114.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0114.656] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.656] GetFileType (hFile=0x224) returned 0x1
	[0114.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0114.657] GetFileType (hFile=0x224) returned 0x1
	[0114.657] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0114.657] ReadFile (in: hFile=0x224, lpBuffer=0x273425c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x273425c*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.660] CloseHandle (hObject=0x224) returned 1
	[0114.660] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x81
	[0114.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0114.660] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.666] GetFileType (hFile=0x224) returned 0x1
	[0114.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0114.666] GetFileType (hFile=0x224) returned 0x1
	[0114.666] WriteFile (in: hFile=0x224, lpBuffer=0x2736a3c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2736a3c*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0114.672] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7c
	[0114.672] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\decrypt.txt")) returned 1
	[0114.675] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.676] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.676] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.676] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7c
	[0114.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0114.677] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0114.677] GetFileType (hFile=0x220) returned 0x1
	[0114.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0114.677] GetFileType (hFile=0x220) returned 0x1
	[0114.678] WriteFile (in: hFile=0x220, lpBuffer=0x2739960*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2739960*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.682] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.682] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.683] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0114.683] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c
	[0114.683] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.684] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.684] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf795bb30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.685] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0114.685] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.686] GetFileType (hFile=0x220) returned 0x1
	[0114.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0114.686] GetFileType (hFile=0x220) returned 0x1
	[0114.686] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0114.686] ReadFile (in: hFile=0x220, lpBuffer=0x273bd14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x273bd14*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0114.688] CloseHandle (hObject=0x220) returned 1
	[0114.689] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6c
	[0114.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0114.689] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.690] GetFileType (hFile=0x220) returned 0x1
	[0114.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0114.690] GetFileType (hFile=0x220) returned 0x1
	[0114.690] WriteFile (in: hFile=0x220, lpBuffer=0x273e4a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x273e4a4*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0114.693] CloseHandle (hObject=0x220) returned 1
	[0114.693] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.694] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\decrypt.txt")) returned 1
	[0114.697] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x154b0450, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x154b0450, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.698] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x154b0450, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x154b0450, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0114.698] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.699] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0114.699] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0114.699] GetFileType (hFile=0x208) returned 0x1
	[0114.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0114.700] GetFileType (hFile=0x208) returned 0x1
	[0114.700] WriteFile (in: hFile=0x208, lpBuffer=0x2740f2c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2740f2c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0114.703] CloseHandle (hObject=0x208) returned 1
	[0114.703] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.704] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.704] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0114.704] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpFilePart=0x0) returned 0x53
	[0114.705] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.705] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf795bb30, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.706] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf795bb30, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf795bb30, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7981c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.706] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0114.706] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.706] GetFileType (hFile=0x208) returned 0x1
	[0114.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0114.707] GetFileType (hFile=0x208) returned 0x1
	[0114.707] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0114.707] ReadFile (in: hFile=0x208, lpBuffer=0x2743198, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2743198*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0114.710] CloseHandle (hObject=0x208) returned 1
	[0114.710] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x63
	[0114.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0114.710] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.711] GetFileType (hFile=0x208) returned 0x1
	[0114.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0114.711] GetFileType (hFile=0x208) returned 0x1
	[0114.711] WriteFile (in: hFile=0x208, lpBuffer=0x2745900*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2745900*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0114.714] CloseHandle (hObject=0x208) returned 1
	[0114.715] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.715] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\decrypt.txt")) returned 1
	[0114.718] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x154fc710, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x154fc710, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.719] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x154fc710, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x154fc710, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0114.719] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.719] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.720] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0114.720] GetFileType (hFile=0x204) returned 0x1
	[0114.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0114.720] GetFileType (hFile=0x204) returned 0x1
	[0114.721] WriteFile (in: hFile=0x204, lpBuffer=0x2748290*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2748290*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0114.723] CloseHandle (hObject=0x204) returned 1
	[0114.724] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7981c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7981c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1
	[0114.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.724] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpFilePart=0x0) returned 0x47
	[0114.724] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", lpFilePart=0x0) returned 0x48
	[0114.725] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7981c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7981c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.725] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7981c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7981c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.726] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7981c90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7981c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7981c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.726] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfe3882c0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0114.727] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0114.727] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0114.728] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.728] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpFilePart=0x0) returned 0x47
	[0114.728] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", lpFilePart=0x0) returned 0x48
	[0114.729] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7981c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7981c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.729] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7981c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7981c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.730] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7981c90, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7981c90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7981c90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.730] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0114.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0114.731] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.731] GetFileType (hFile=0x208) returned 0x1
	[0114.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0114.731] GetFileType (hFile=0x208) returned 0x1
	[0114.731] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0114.731] ReadFile (in: hFile=0x208, lpBuffer=0x274b4e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x274b4e0*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0114.734] CloseHandle (hObject=0x208) returned 1
	[0114.734] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x58
	[0114.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0114.734] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.740] GetFileType (hFile=0x208) returned 0x1
	[0114.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0114.740] GetFileType (hFile=0x208) returned 0x1
	[0114.740] WriteFile (in: hFile=0x208, lpBuffer=0x274dc20*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x274dc20*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0114.744] CloseHandle (hObject=0x208) returned 1
	[0114.744] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0114.744] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\decrypt.txt")) returned 1
	[0114.747] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfe3882c0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0114.749] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0114.749] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.750] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.750] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0114.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.750] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0114.751] GetFileType (hFile=0x204) returned 0x1
	[0114.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0114.751] GetFileType (hFile=0x204) returned 0x1
	[0114.751] WriteFile (in: hFile=0x204, lpBuffer=0x2750c38*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2750c38*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0114.755] CloseHandle (hObject=0x204) returned 1
	[0114.755] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1
	[0114.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.756] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0114.756] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", lpFilePart=0x0) returned 0x53
	[0114.756] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.757] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.757] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79f40b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.758] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79cdf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.758] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0114.758] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c
	[0114.759] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79cdf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.759] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79cdf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.760] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79cdf50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.760] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79cdf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.761] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x72
	[0114.761] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x73
	[0114.761] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79cdf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.762] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79cdf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.762] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969a2800, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x969a2800, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x969a2800, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.763] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79cdf50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79cdf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.763] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.763] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0114.764] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.765] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x72
	[0114.765] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x73
	[0114.765] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79cdf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.766] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79cdf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.766] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969a2800, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x969a2800, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x969a2800, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.767] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79cdf50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79cdf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.767] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7e
	[0114.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0114.767] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.768] GetFileType (hFile=0x224) returned 0x1
	[0114.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0114.768] GetFileType (hFile=0x224) returned 0x1
	[0114.768] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0114.768] ReadFile (in: hFile=0x224, lpBuffer=0x27571e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27571e8*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.771] CloseHandle (hObject=0x224) returned 1
	[0114.771] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x83
	[0114.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0114.771] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.777] GetFileType (hFile=0x224) returned 0x1
	[0114.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0114.777] GetFileType (hFile=0x224) returned 0x1
	[0114.777] WriteFile (in: hFile=0x224, lpBuffer=0x27599d0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27599d0*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0114.780] CloseHandle (hObject=0x224) returned 1
	[0114.780] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7e
	[0114.780] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\decrypt.txt")) returned 1
	[0114.784] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.784] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.785] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.785] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x7e
	[0114.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0114.786] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0114.786] GetFileType (hFile=0x220) returned 0x1
	[0114.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0114.787] GetFileType (hFile=0x220) returned 0x1
	[0114.787] WriteFile (in: hFile=0x220, lpBuffer=0x275c914*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x275c914*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.790] CloseHandle (hObject=0x220) returned 1
	[0114.790] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.790] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.791] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b
	[0114.791] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c
	[0114.791] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79cdf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.792] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79cdf50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.792] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79cdf50, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf79cdf50, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.793] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0114.793] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.793] GetFileType (hFile=0x220) returned 0x1
	[0114.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0114.794] GetFileType (hFile=0x220) returned 0x1
	[0114.794] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0114.794] ReadFile (in: hFile=0x220, lpBuffer=0x275ecc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x275ecc8*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0114.797] CloseHandle (hObject=0x220) returned 1
	[0114.797] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6c
	[0114.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0114.797] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.798] GetFileType (hFile=0x220) returned 0x1
	[0114.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0114.798] GetFileType (hFile=0x220) returned 0x1
	[0114.799] WriteFile (in: hFile=0x220, lpBuffer=0x2761458*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2761458*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0114.802] CloseHandle (hObject=0x220) returned 1
	[0114.802] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.802] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\decrypt.txt")) returned 1
	[0114.806] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x155badf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x155badf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.807] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x155badf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x155badf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0114.808] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.808] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0114.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0114.808] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0114.809] GetFileType (hFile=0x208) returned 0x1
	[0114.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0114.809] GetFileType (hFile=0x208) returned 0x1
	[0114.810] WriteFile (in: hFile=0x208, lpBuffer=0x2763ef0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2763ef0*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0114.812] CloseHandle (hObject=0x208) returned 1
	[0114.813] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.813] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.814] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpFilePart=0x0) returned 0x52
	[0114.814] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", lpFilePart=0x0) returned 0x53
	[0114.814] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.814] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.815] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79f40b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.815] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0114.815] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.816] GetFileType (hFile=0x208) returned 0x1
	[0114.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0114.816] GetFileType (hFile=0x208) returned 0x1
	[0114.816] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0114.816] ReadFile (in: hFile=0x208, lpBuffer=0x276615c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x276615c*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0114.819] CloseHandle (hObject=0x208) returned 1
	[0114.820] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x63
	[0114.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0114.820] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.821] GetFileType (hFile=0x208) returned 0x1
	[0114.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0114.821] GetFileType (hFile=0x208) returned 0x1
	[0114.821] WriteFile (in: hFile=0x208, lpBuffer=0x27688c4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27688c4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0114.824] CloseHandle (hObject=0x208) returned 1
	[0114.825] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.825] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\decrypt.txt")) returned 1
	[0114.828] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x156070b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x156070b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.829] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x156070b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x156070b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0114.829] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.830] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0114.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.830] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0114.831] GetFileType (hFile=0x204) returned 0x1
	[0114.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0114.831] GetFileType (hFile=0x204) returned 0x1
	[0114.831] WriteFile (in: hFile=0x204, lpBuffer=0x276b254*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x276b254*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0114.835] CloseHandle (hObject=0x204) returned 1
	[0114.835] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1
	[0114.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0114.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", lpFilePart=0x0) returned 0x54
	[0114.836] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.837] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.837] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a1a210, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.838] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0114.839] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0114.839] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d
	[0114.839] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.840] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.840] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a1a210, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.841] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x76
	[0114.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x77
	[0114.842] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.843] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.843] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7f300, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xdae7f300, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xdae7f300, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.844] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79f40b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.844] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.845] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0114.845] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0114.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0114.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.846] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x76
	[0114.846] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x77
	[0114.846] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0114.847] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf79f40b0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.847] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7f300, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xdae7f300, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xdae7f300, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0114.848] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf79f40b0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf79f40b0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.848] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x82
	[0114.848] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.849] GetFileType (hFile=0x224) returned 0x1
	[0114.849] GetFileType (hFile=0x224) returned 0x1
	[0114.849] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0114.849] ReadFile (in: hFile=0x224, lpBuffer=0x27719d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27719d4*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.852] CloseHandle (hObject=0x224) returned 1
	[0114.853] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x87
	[0114.853] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0114.858] GetFileType (hFile=0x224) returned 0x1
	[0114.858] GetFileType (hFile=0x224) returned 0x1
	[0114.859] WriteFile (in: hFile=0x224, lpBuffer=0x27741cc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27741cc*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0114.861] CloseHandle (hObject=0x224) returned 1
	[0114.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x82
	[0114.862] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\decrypt.txt")) returned 1
	[0114.865] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0114.867] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.867] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0114.867] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt", lpFilePart=0x0) returned 0x82
	[0114.868] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0114.868] GetFileType (hFile=0x220) returned 0x1
	[0114.868] GetFileType (hFile=0x220) returned 0x1
	[0114.869] WriteFile (in: hFile=0x220, lpBuffer=0x2777174*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2777174*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0114.872] CloseHandle (hObject=0x220) returned 1
	[0114.872] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.872] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.873] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c
	[0114.873] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d
	[0114.873] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0114.874] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.874] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a1a210, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.875] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0114.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0114.875] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.875] GetFileType (hFile=0x220) returned 0x1
	[0114.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0114.876] GetFileType (hFile=0x220) returned 0x1
	[0114.876] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0114.876] ReadFile (in: hFile=0x220, lpBuffer=0x2779560, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x2779560*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0114.879] CloseHandle (hObject=0x220) returned 1
	[0114.879] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6d
	[0114.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0114.880] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0114.880] GetFileType (hFile=0x220) returned 0x1
	[0114.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0114.881] GetFileType (hFile=0x220) returned 0x1
	[0114.881] WriteFile (in: hFile=0x220, lpBuffer=0x277bcf0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x277bcf0*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0114.885] CloseHandle (hObject=0x220) returned 1
	[0114.885] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0114.885] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\decrypt.txt")) returned 1
	[0114.888] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x1569f630, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1569f630, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1
	[0114.889] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x1569f630, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1569f630, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0
	[0114.889] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0114.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0114.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0114.890] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x68
	[0114.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0114.890] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0114.891] GetFileType (hFile=0x208) returned 0x1
	[0114.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0114.891] GetFileType (hFile=0x208) returned 0x1
	[0114.891] WriteFile (in: hFile=0x208, lpBuffer=0x277e7ac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x277e7ac*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0114.894] CloseHandle (hObject=0x208) returned 1
	[0114.894] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.895] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.896] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpFilePart=0x0) returned 0x53
	[0114.896] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", lpFilePart=0x0) returned 0x54
	[0114.896] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.896] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a1a210, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.898] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a1a210, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a1a210, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.898] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0114.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0114.898] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.899] GetFileType (hFile=0x208) returned 0x1
	[0114.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0114.899] GetFileType (hFile=0x208) returned 0x1
	[0114.899] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0114.900] ReadFile (in: hFile=0x208, lpBuffer=0x2780a30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2780a30*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0114.902] CloseHandle (hObject=0x208) returned 1
	[0114.902] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x64
	[0114.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0114.902] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.903] GetFileType (hFile=0x208) returned 0x1
	[0114.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0114.904] GetFileType (hFile=0x208) returned 0x1
	[0114.904] WriteFile (in: hFile=0x208, lpBuffer=0x27831a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27831a0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0114.907] CloseHandle (hObject=0x208) returned 1
	[0114.907] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0114.907] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\decrypt.txt")) returned 1
	[0114.910] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x156c5790, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x156c5790, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0114.911] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x156c5790, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x156c5790, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0114.911] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.912] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0114.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.912] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0114.913] GetFileType (hFile=0x204) returned 0x1
	[0114.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0114.913] GetFileType (hFile=0x204) returned 0x1
	[0114.913] WriteFile (in: hFile=0x204, lpBuffer=0x2785b38*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2785b38*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0114.916] CloseHandle (hObject=0x204) returned 1
	[0114.916] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1
	[0114.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.917] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", lpFilePart=0x0) returned 0x47
	[0114.917] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\", lpFilePart=0x0) returned 0x48
	[0114.917] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.918] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.919] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a40370, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.919] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xe9f9cff0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0114.920] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1
	[0114.920] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0
	[0114.921] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.921] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", lpFilePart=0x0) returned 0x47
	[0114.921] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\", lpFilePart=0x0) returned 0x48
	[0114.922] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.922] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.923] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a40370, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.923] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0114.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0114.923] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.924] GetFileType (hFile=0x208) returned 0x1
	[0114.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0114.924] GetFileType (hFile=0x208) returned 0x1
	[0114.924] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0114.924] ReadFile (in: hFile=0x208, lpBuffer=0x2788d88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2788d88*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0114.927] CloseHandle (hObject=0x208) returned 1
	[0114.927] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x58
	[0114.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0114.928] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.942] GetFileType (hFile=0x208) returned 0x1
	[0114.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0114.942] GetFileType (hFile=0x208) returned 0x1
	[0114.942] WriteFile (in: hFile=0x208, lpBuffer=0x278b4c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x278b4c8*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0114.946] CloseHandle (hObject=0x208) returned 1
	[0114.946] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0114.946] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\decrypt.txt")) returned 1
	[0114.949] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xe9f9cff0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0114.950] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1
	[0114.950] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0114.950] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.951] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0114.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0114.951] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0114.952] GetFileType (hFile=0x204) returned 0x1
	[0114.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0114.952] GetFileType (hFile=0x204) returned 0x1
	[0114.952] WriteFile (in: hFile=0x204, lpBuffer=0x278e4f4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x278e4f4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0114.956] CloseHandle (hObject=0x204) returned 1
	[0114.956] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1
	[0114.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.956] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x47
	[0114.957] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpFilePart=0x0) returned 0x48
	[0114.957] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.958] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.958] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a40370, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.959] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad7040, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x105e7220, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0114.959] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0114.960] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0
	[0114.961] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0114.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0114.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0114.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0114.961] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x47
	[0114.962] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpFilePart=0x0) returned 0x48
	[0114.962] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0114.962] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a40370, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0114.963] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a40370, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a40370, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0114.963] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0114.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0114.964] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.964] GetFileType (hFile=0x208) returned 0x1
	[0114.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0114.964] GetFileType (hFile=0x208) returned 0x1
	[0114.964] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0114.965] ReadFile (in: hFile=0x208, lpBuffer=0x2791744, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x2791744*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0114.968] CloseHandle (hObject=0x208) returned 1
	[0114.968] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x58
	[0114.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0114.968] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0114.990] GetFileType (hFile=0x208) returned 0x1
	[0114.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0114.991] GetFileType (hFile=0x208) returned 0x1
	[0114.992] WriteFile (in: hFile=0x208, lpBuffer=0x2793e84*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2793e84*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0114.995] CloseHandle (hObject=0x208) returned 1
	[0114.995] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0114.995] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\decrypt.txt")) returned 1
	[0114.999] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad7040, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x105e7220, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0115.000] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1
	[0115.000] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.000] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0115.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0115.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0115.001] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0115.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.001] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0115.002] GetFileType (hFile=0x204) returned 0x1
	[0115.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0115.002] GetFileType (hFile=0x204) returned 0x1
	[0115.003] WriteFile (in: hFile=0x204, lpBuffer=0x2796e9c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2796e9c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0115.063] CloseHandle (hObject=0x204) returned 1
	[0115.064] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1
	[0115.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0115.064] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x47
	[0115.065] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpFilePart=0x0) returned 0x48
	[0115.065] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0115.066] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.067] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a664d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.068] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93efac0, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6601040, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0115.069] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1
	[0115.070] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0
	[0115.071] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0115.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0115.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0115.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0115.072] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x47
	[0115.072] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpFilePart=0x0) returned 0x48
	[0115.072] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0115.073] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.074] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a664d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.074] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0115.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0115.074] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0115.075] GetFileType (hFile=0x208) returned 0x1
	[0115.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0115.075] GetFileType (hFile=0x208) returned 0x1
	[0115.075] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0115.076] ReadFile (in: hFile=0x208, lpBuffer=0x279a0ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x279a0ec*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0115.080] CloseHandle (hObject=0x208) returned 1
	[0115.080] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x58
	[0115.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0115.080] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0115.086] GetFileType (hFile=0x208) returned 0x1
	[0115.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0115.087] GetFileType (hFile=0x208) returned 0x1
	[0115.087] WriteFile (in: hFile=0x208, lpBuffer=0x279c82c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x279c82c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0115.091] CloseHandle (hObject=0x208) returned 1
	[0115.091] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0115.092] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\decrypt.txt")) returned 1
	[0115.096] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93efac0, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6601040, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1
	[0115.096] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1
	[0115.097] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.097] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0115.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0115.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0115.098] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt", lpFilePart=0x0) returned 0x53
	[0115.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.098] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0115.099] GetFileType (hFile=0x204) returned 0x1
	[0115.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0115.101] GetFileType (hFile=0x204) returned 0x1
	[0115.101] WriteFile (in: hFile=0x204, lpBuffer=0x279f858*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x279f858*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0115.105] CloseHandle (hObject=0x204) returned 1
	[0115.105] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1
	[0115.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0115.106] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0115.106] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpFilePart=0x0) returned 0x53
	[0115.107] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0115.107] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.108] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a8c630, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.109] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0115.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0115.109] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0115.109] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c
	[0115.110] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0115.110] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.111] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a8c630, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.112] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0115.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.112] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73
	[0115.113] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x74
	[0115.113] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0115.114] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.114] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x532ebf00, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x532ebf00, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x532ebf00, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0115.116] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a664d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.116] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0115.117] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0
	[0115.118] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0115.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0115.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0115.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.118] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73
	[0115.119] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x74
	[0115.119] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0115.120] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a664d0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.121] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x532ebf00, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x532ebf00, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x532ebf00, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1
	[0115.121] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a664d0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a664d0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.122] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7f
	[0115.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0115.122] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0115.122] GetFileType (hFile=0x224) returned 0x1
	[0115.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0115.123] GetFileType (hFile=0x224) returned 0x1
	[0115.123] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0xa5
	[0115.123] ReadFile (in: hFile=0x224, lpBuffer=0x27a5e64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x27a5e64*, lpNumberOfBytesRead=0x26ede4*=0xa5, lpOverlapped=0x0) returned 1
	[0115.126] CloseHandle (hObject=0x224) returned 1
	[0115.126] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x84
	[0115.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0115.127] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0115.155] GetFileType (hFile=0x224) returned 0x1
	[0115.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0115.155] GetFileType (hFile=0x224) returned 0x1
	[0115.156] WriteFile (in: hFile=0x224, lpBuffer=0x27a8654*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x27a8654*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0115.161] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7f
	[0115.161] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\decrypt.txt")) returned 1
	[0115.193] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1
	[0115.194] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.194] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0115.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0115.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0115.195] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt", lpFilePart=0x0) returned 0x7f
	[0115.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0115.195] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0115.196] GetFileType (hFile=0x220) returned 0x1
	[0115.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0115.196] GetFileType (hFile=0x220) returned 0x1
	[0115.196] WriteFile (in: hFile=0x220, lpBuffer=0x27ab5c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27ab5c8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0115.199] CloseHandle (hObject=0x220) returned 1
	[0115.199] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.199] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0115.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0115.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0115.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0115.200] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b
	[0115.200] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c
	[0115.200] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0115.201] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.201] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a8c630, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.201] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0115.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0115.202] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0115.231] GetFileType (hFile=0x220) returned 0x1
	[0115.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0115.231] GetFileType (hFile=0x220) returned 0x1
	[0115.232] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0115.232] ReadFile (in: hFile=0x220, lpBuffer=0x27ad97c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27ad97c*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0115.235] CloseHandle (hObject=0x220) returned 1
	[0115.235] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x6c
	[0115.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0115.236] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0115.237] GetFileType (hFile=0x220) returned 0x1
	[0115.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0115.237] GetFileType (hFile=0x220) returned 0x1
	[0115.238] WriteFile (in: hFile=0x220, lpBuffer=0x27b010c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27b010c*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0115.242] CloseHandle (hObject=0x220) returned 1
	[0115.242] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0115.242] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\decrypt.txt")) returned 1
	[0115.261] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x159bf310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x159bf310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1
	[0115.262] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x159bf310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x159bf310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0
	[0115.263] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0115.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0115.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0115.263] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0115.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.264] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0115.264] GetFileType (hFile=0x208) returned 0x1
	[0115.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0115.265] GetFileType (hFile=0x208) returned 0x1
	[0115.265] WriteFile (in: hFile=0x208, lpBuffer=0x27b2ba4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27b2ba4*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0115.300] CloseHandle (hObject=0x208) returned 1
	[0115.301] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.301] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0115.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0115.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0115.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0115.302] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x52
	[0115.302] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpFilePart=0x0) returned 0x53
	[0115.302] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0115.303] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.304] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a8c630, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.304] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0115.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0115.304] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0115.305] GetFileType (hFile=0x208) returned 0x1
	[0115.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0115.305] GetFileType (hFile=0x208) returned 0x1
	[0115.305] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0115.306] ReadFile (in: hFile=0x208, lpBuffer=0x27b4e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27b4e10*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0115.309] CloseHandle (hObject=0x208) returned 1
	[0115.309] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x63
	[0115.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0115.309] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0115.310] GetFileType (hFile=0x208) returned 0x1
	[0115.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0115.311] GetFileType (hFile=0x208) returned 0x1
	[0115.311] WriteFile (in: hFile=0x208, lpBuffer=0x27b7578*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27b7578*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0115.314] CloseHandle (hObject=0x208) returned 1
	[0115.314] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0115.315] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\decrypt.txt")) returned 1
	[0115.318] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x15a31730, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15a31730, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1
	[0115.318] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x15a31730, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15a31730, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0
	[0115.319] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0115.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0115.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0115.319] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0115.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.320] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0115.320] GetFileType (hFile=0x204) returned 0x1
	[0115.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0115.320] GetFileType (hFile=0x204) returned 0x1
	[0115.321] WriteFile (in: hFile=0x204, lpBuffer=0x27b9f08*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27b9f08*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0115.324] CloseHandle (hObject=0x204) returned 1
	[0115.324] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.324] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0115.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0115.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0115.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0115.325] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache", lpFilePart=0x0) returned 0x20
	[0115.325] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\", lpFilePart=0x0) returned 0x21
	[0115.325] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0115.326] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7a8c630, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.327] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x13ef7b90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13ef7b90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1
	[0115.327] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x14668050, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x14668050, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1
	[0115.328] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7a8c630, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7a8c630, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7ab2790, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.328] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0115.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0115.329] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0115.329] GetFileType (hFile=0x204) returned 0x1
	[0115.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0115.329] GetFileType (hFile=0x204) returned 0x1
	[0115.329] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xa5
	[0115.330] ReadFile (in: hFile=0x204, lpBuffer=0x27bbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x27bbd90*, lpNumberOfBytesRead=0x26efc4*=0xa5, lpOverlapped=0x0) returned 1
	[0115.333] CloseHandle (hObject=0x204) returned 1
	[0115.333] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x31
	[0115.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0115.335] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\package cache\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0115.336] GetFileType (hFile=0x204) returned 0x1
	[0115.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0115.337] GetFileType (hFile=0x204) returned 0x1
	[0115.337] WriteFile (in: hFile=0x204, lpBuffer=0x27be430*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x27be430*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0115.341] CloseHandle (hObject=0x204) returned 1
	[0115.342] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0115.342] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\decrypt.txt")) returned 1
	[0115.346] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1474c890, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1474c890, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1
	[0115.346] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x147e4e10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x147e4e10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1
	[0115.347] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x148ef7b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x148ef7b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1
	[0115.348] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x14987d30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x14987d30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1
	[0115.348] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x14c5b750, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x14c5b750, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1
	[0115.349] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x1505fc70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1505fc70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1
	[0115.349] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x151b68d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x151b68d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1
	[0115.350] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x15274fb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15274fb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1
	[0115.351] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1537f950, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1537f950, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1
	[0115.351] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x15464190, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15464190, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1
	[0115.352] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x15522870, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15522870, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1
	[0115.352] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x1556eb30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1556eb30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1
	[0115.353] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x1562d210, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1562d210, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1
	[0115.353] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x156eb8f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x156eb8f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1
	[0115.353] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0x1575dd10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1575dd10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1
	[0115.354] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x157d0130, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x157d0130, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1
	[0115.354] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0x158b4970, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x158b4970, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1
	[0115.355] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x15aa3b50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15aa3b50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1
	[0115.355] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x15aa3b50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15aa3b50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0
	[0115.356] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0115.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0115.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0115.356] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0115.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0115.356] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\Decrypt.txt" (normalized: "c:\\users\\all users\\package cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0115.357] GetFileType (hFile=0x200) returned 0x1
	[0115.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0115.357] GetFileType (hFile=0x200) returned 0x1
	[0115.357] WriteFile (in: hFile=0x200, lpBuffer=0x27c2f00*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27c2f00*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0115.360] CloseHandle (hObject=0x200) returned 1
	[0115.360] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0115.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0115.360] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Start Menu", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Start Menu", lpFilePart=0x0) returned 0x1d
	[0115.360] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Start Menu\\", lpFilePart=0x0) returned 0x1e
	[0115.361] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0115.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0115.364] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b70e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b70e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1
	[0115.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0115.365] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun", lpFilePart=0x0) returned 0x16
	[0115.365] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\", lpFilePart=0x0) returned 0x17
	[0115.365] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b70e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b70e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0115.366] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b70e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b70e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.366] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7b70e70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7b70e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b70e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.367] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b4ad10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b4ad10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0115.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0115.367] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java", lpFilePart=0x0) returned 0x1b
	[0115.367] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\", lpFilePart=0x0) returned 0x1c
	[0115.367] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b4ad10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b4ad10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0115.368] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b4ad10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b4ad10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.368] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7b4ad10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7b4ad10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b4ad10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.369] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7ad88f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7ad88f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1
	[0115.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0115.369] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x27
	[0115.370] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x28
	[0115.370] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7ad88f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7ad88f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0115.371] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7ad88f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7ad88f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.371] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad88f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7ad88f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7afea50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.372] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureglist.xml", cAlternateFileName="JAUREG~1.XML")) returned 1
	[0115.372] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureglist.xml", cAlternateFileName="JAUREG~1.XML")) returned 0
	[0115.373] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0115.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0115.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0115.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0115.374] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x27
	[0115.374] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x28
	[0115.374] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7ad88f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7ad88f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0115.375] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7ad88f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7ad88f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.375] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad88f0, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7ad88f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7afea50, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.376] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0115.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0115.376] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Decrypt.txt" (normalized: "c:\\users\\all users\\sun\\java\\java update\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0115.376] GetFileType (hFile=0x220) returned 0x1
	[0115.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0115.376] GetFileType (hFile=0x220) returned 0x1
	[0115.377] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0xa5
	[0115.377] ReadFile (in: hFile=0x220, lpBuffer=0x27c6d40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ee84, lpOverlapped=0x0 | out: lpBuffer=0x27c6d40*, lpNumberOfBytesRead=0x26ee84*=0xa5, lpOverlapped=0x0) returned 1
	[0115.379] CloseHandle (hObject=0x220) returned 1
	[0115.379] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x38
	[0115.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0115.380] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\sun\\java\\java update\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0115.381] GetFileType (hFile=0x220) returned 0x1
	[0115.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0115.381] GetFileType (hFile=0x220) returned 0x1
	[0115.382] WriteFile (in: hFile=0x220, lpBuffer=0x27c9400*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x27c9400*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0115.384] CloseHandle (hObject=0x220) returned 1
	[0115.384] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0115.385] DeleteFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Decrypt.txt" (normalized: "c:\\users\\all users\\sun\\java\\java update\\decrypt.txt")) returned 1
	[0115.387] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureglist.xml", cAlternateFileName="JAUREG~1.XML")) returned 1
	[0115.388] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.388] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0115.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0115.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0115.388] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0115.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.389] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\Decrypt.txt" (normalized: "c:\\users\\all users\\sun\\java\\java update\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0115.389] GetFileType (hFile=0x208) returned 0x1
	[0115.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0115.389] GetFileType (hFile=0x208) returned 0x1
	[0115.390] WriteFile (in: hFile=0x208, lpBuffer=0x27cbdec*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27cbdec*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0115.392] CloseHandle (hObject=0x208) returned 1
	[0115.393] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.393] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0115.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0115.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0115.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0115.393] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java", lpFilePart=0x0) returned 0x1b
	[0115.394] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\", lpFilePart=0x0) returned 0x1c
	[0115.394] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b4ad10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b4ad10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0115.394] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b4ad10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b4ad10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.395] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7b4ad10, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7b4ad10, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b4ad10, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.395] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Decrypt.txt", lpFilePart=0x0) returned 0x27
	[0115.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0115.395] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Decrypt.txt" (normalized: "c:\\users\\all users\\sun\\java\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0115.396] GetFileType (hFile=0x208) returned 0x1
	[0115.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0115.396] GetFileType (hFile=0x208) returned 0x1
	[0115.396] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xa5
	[0115.396] ReadFile (in: hFile=0x208, lpBuffer=0x27cd7fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x27cd7fc*, lpNumberOfBytesRead=0x26ef24*=0xa5, lpOverlapped=0x0) returned 1
	[0115.399] CloseHandle (hObject=0x208) returned 1
	[0115.399] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x2c
	[0115.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0115.399] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\sun\\java\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0115.400] GetFileType (hFile=0x208) returned 0x1
	[0115.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0115.401] GetFileType (hFile=0x208) returned 0x1
	[0115.401] WriteFile (in: hFile=0x208, lpBuffer=0x27cfe8c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x27cfe8c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0115.405] CloseHandle (hObject=0x208) returned 1
	[0115.406] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Decrypt.txt", lpFilePart=0x0) returned 0x27
	[0115.406] DeleteFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Decrypt.txt" (normalized: "c:\\users\\all users\\sun\\java\\decrypt.txt")) returned 1
	[0115.409] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x15b3c0d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15b3c0d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1
	[0115.410] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x15b3c0d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15b3c0d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0
	[0115.411] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0115.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0115.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0115.411] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Decrypt.txt", lpFilePart=0x0) returned 0x27
	[0115.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.412] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Decrypt.txt" (normalized: "c:\\users\\all users\\sun\\java\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0115.412] GetFileType (hFile=0x204) returned 0x1
	[0115.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0115.413] GetFileType (hFile=0x204) returned 0x1
	[0115.413] WriteFile (in: hFile=0x204, lpBuffer=0x27d2644*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27d2644*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0115.416] CloseHandle (hObject=0x204) returned 1
	[0115.416] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.416] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0115.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0115.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0115.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0115.417] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun", lpFilePart=0x0) returned 0x16
	[0115.417] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\", lpFilePart=0x0) returned 0x17
	[0115.417] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b70e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b70e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0115.417] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xf7b70e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b70e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.418] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7b70e70, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7b70e70, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7b70e70, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.418] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0115.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef10) returned 1
	[0115.418] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Decrypt.txt" (normalized: "c:\\users\\all users\\sun\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0115.419] GetFileType (hFile=0x204) returned 0x1
	[0115.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef0c) returned 1
	[0115.419] GetFileType (hFile=0x204) returned 0x1
	[0115.419] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x26f018 | out: lpFileSizeHigh=0x26f018*=0x0) returned 0xa5
	[0115.419] ReadFile (in: hFile=0x204, lpBuffer=0x27d3fa8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26efc4, lpOverlapped=0x0 | out: lpBuffer=0x27d3fa8*, lpNumberOfBytesRead=0x26efc4*=0xa5, lpOverlapped=0x0) returned 1
	[0115.421] CloseHandle (hObject=0x204) returned 1
	[0115.422] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26ea50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x27
	[0115.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef44) returned 1
	[0115.422] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\sun\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
	[0115.423] GetFileType (hFile=0x204) returned 0x1
	[0115.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef40) returned 1
	[0115.423] GetFileType (hFile=0x204) returned 0x1
	[0115.423] WriteFile (in: hFile=0x204, lpBuffer=0x27d6620*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ef68, lpOverlapped=0x0 | out: lpBuffer=0x27d6620*, lpNumberOfBytesWritten=0x26ef68*=0x10, lpOverlapped=0x0) returned 1
	[0115.425] CloseHandle (hObject=0x204) returned 1
	[0115.425] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0115.425] DeleteFileW (lpFileName="C:\\Users\\All Users\\Sun\\Decrypt.txt" (normalized: "c:\\users\\all users\\sun\\decrypt.txt")) returned 1
	[0115.428] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x15b88390, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15b88390, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1
	[0115.428] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x15b88390, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15b88390, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0
	[0115.429] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0115.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0115.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0115.429] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0115.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0115.429] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Decrypt.txt" (normalized: "c:\\users\\all users\\sun\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0115.430] GetFileType (hFile=0x200) returned 0x1
	[0115.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0115.430] GetFileType (hFile=0x200) returned 0x1
	[0115.431] WriteFile (in: hFile=0x200, lpBuffer=0x27d8d38*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x27d8d38*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0115.434] CloseHandle (hObject=0x200) returned 1
	[0115.434] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0115.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0115.434] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates", lpFilePart=0x0) returned 0x1c
	[0115.435] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates\\", lpFilePart=0x0) returned 0x1d
	[0115.435] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0115.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0115.439] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.440] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0115.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0115.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0115.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0115.440] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12
	[0115.440] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\", lpFilePart=0x0) returned 0x13
	[0115.441] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf7bbd130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7bbd130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0115.441] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf7bbd130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7bbd130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.442] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf9efd90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf9efd90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0115.443] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0115.443] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7bbd130, ftCreationTime.dwHighDateTime=0x1d60298, ftLastAccessTime.dwLowDateTime=0xf7bbd130, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7bbd130, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Decrypt.txt", cAlternateFileName="")) returned 1
	[0115.444] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eabc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Decrypt.txt", lpFilePart=0x0) returned 0x1e
	[0115.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb0) returned 1
	[0115.444] CreateFileW (lpFileName="C:\\Users\\All Users\\Decrypt.txt" (normalized: "c:\\users\\all users\\decrypt.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x200
	[0115.445] GetFileType (hFile=0x200) returned 0x1
	[0115.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efac) returned 1
	[0115.445] GetFileType (hFile=0x200) returned 0x1
	[0115.445] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x26f0b8 | out: lpFileSizeHigh=0x26f0b8*=0x0) returned 0xa5
	[0115.445] ReadFile (in: hFile=0x200, lpBuffer=0x27db050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26f064, lpOverlapped=0x0 | out: lpBuffer=0x27db050*, lpNumberOfBytesRead=0x26f064*=0xa5, lpOverlapped=0x0) returned 1
	[0115.448] CloseHandle (hObject=0x200) returned 1
	[0115.449] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Decrypt.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Decrypt.txt.KEKW", lpFilePart=0x0) returned 0x23
	[0115.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efe4) returned 1
	[0115.449] CreateFileW (lpFileName="C:\\Users\\All Users\\Decrypt.txt.KEKW" (normalized: "c:\\users\\all users\\decrypt.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x200
	[0115.450] GetFileType (hFile=0x200) returned 0x1
	[0115.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efe0) returned 1
	[0115.451] GetFileType (hFile=0x200) returned 0x1
	[0115.451] WriteFile (in: hFile=0x200, lpBuffer=0x27dd6b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26f008, lpOverlapped=0x0 | out: lpBuffer=0x27dd6b8*, lpNumberOfBytesWritten=0x26f008*=0x10, lpOverlapped=0x0) returned 1
	[0115.455] CloseHandle (hObject=0x200) returned 1
	[0115.455] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Decrypt.txt", lpFilePart=0x0) returned 0x1e
	[0115.455] DeleteFileW (lpFileName="C:\\Users\\All Users\\Decrypt.txt" (normalized: "c:\\users\\all users\\decrypt.txt")) returned 1
	[0115.461] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0115.462] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0115.462] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0115.463] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x13c24170, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13c24170, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0115.464] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0x13ce2850, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13ce2850, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0115.465] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x13d54c70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13d54c70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0115.465] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x13dc7090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x13dc7090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1
	[0115.466] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x15aefe10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15aefe10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1
	[0115.467] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0115.468] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x15bae4f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15bae4f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1
	[0115.468] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0115.469] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0
	[0115.470] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0115.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0115.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0115.471] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Decrypt.txt", lpFilePart=0x0) returned 0x1e
	[0115.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0115.471] CreateFileW (lpFileName="C:\\Users\\All Users\\Decrypt.txt" (normalized: "c:\\users\\all users\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0115.472] GetFileType (hFile=0x1fc) returned 0x1
	[0115.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0115.472] GetFileType (hFile=0x1fc) returned 0x1
	[0115.472] WriteFile (in: hFile=0x1fc, lpBuffer=0x27e0660*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x27e0660*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0115.477] CloseHandle (hObject=0x1fc) returned 1
	[0115.477] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1
	[0115.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0115.478] GetFullPathNameW (in: lpFileName="C:\\Users\\Default", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default", lpFilePart=0x0) returned 0x10
	[0115.478] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\", lpFilePart=0x0) returned 0x11
	[0115.478] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0115.480] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.480] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0115.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0115.481] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData", lpFilePart=0x0) returned 0x18
	[0115.481] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\", lpFilePart=0x0) returned 0x19
	[0115.481] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0115.482] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.483] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0115.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0115.483] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local", lpFilePart=0x0) returned 0x1e
	[0115.483] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\", lpFilePart=0x0) returned 0x1f
	[0115.483] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0115.486] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.487] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0115.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0115.487] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x2f
	[0115.488] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Application Data\\", lpFilePart=0x0) returned 0x30
	[0115.488] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0115.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eee0) returned 1
	[0115.514] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0115.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0115.514] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\History", lpFilePart=0x0) returned 0x26
	[0115.515] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\History\\", lpFilePart=0x0) returned 0x27
	[0115.515] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0115.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eee0) returned 1
	[0115.520] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x66b2700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xddd35f67, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xbd7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0115.522] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0115.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0115.522] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x28
	[0115.523] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x29
	[0115.523] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0115.528] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.528] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0115.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.529] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x34
	[0115.529] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x35
	[0115.529] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0115.532] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.533] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0115.533] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0115.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0115.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0115.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.537] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x34
	[0115.537] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x35
	[0115.538] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0115.538] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.539] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0115.539] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0115.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0115.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0115.540] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0115.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0115.540] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\credentials\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0115.541] GetFileType (hFile=0x220) returned 0x1
	[0115.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0115.541] GetFileType (hFile=0x220) returned 0x1
	[0115.542] WriteFile (in: hFile=0x220, lpBuffer=0x25e7654*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25e7654*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0115.545] CloseHandle (hObject=0x220) returned 1
	[0115.545] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0115.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.545] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x2e
	[0115.546] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x2f
	[0115.546] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0115.551] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.551] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff107f92, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1
	[0115.552] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1
	[0115.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.552] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f
	[0115.555] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x3f
	[0115.555] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f
	[0115.556] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e8b0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40
	[0115.558] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40
	[0115.560] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x40
	[0115.560] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40
	[0115.566] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.570] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.571] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1
	[0115.571] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1
	[0115.572] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1
	[0115.572] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0
	[0115.573] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.575] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f
	[0115.577] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x3f
	[0115.577] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f
	[0115.579] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e8b0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40
	[0115.580] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40
	[0115.582] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x40
	[0115.582] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40
	[0115.588] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.591] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.591] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1
	[0115.592] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1
	[0115.592] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1
	[0115.593] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.593] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.596] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x26e794, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40
	[0115.597] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0115.598] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Decrypt.txt", lpszLongPath=0x26e794, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0
	[0115.600] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x26e754, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f
	[0115.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0115.605] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0115.608] GetFileType (hFile=0x224) returned 0x1
	[0115.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0115.608] GetFileType (hFile=0x224) returned 0x1
	[0115.608] WriteFile (in: hFile=0x224, lpBuffer=0x25ed2d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x25ed2d8*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0115.611] CloseHandle (hObject=0x224) returned 1
	[0115.611] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1
	[0115.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.612] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56
	[0115.614] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x56
	[0115.614] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56
	[0115.616] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e8b0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.617] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.618] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x57
	[0115.619] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.623] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.624] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.624] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1
	[0115.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0115.625] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e830, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.626] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x26e830, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61
	[0115.628] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x61
	[0115.628] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x26e830, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61
	[0115.630] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.632] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62
	[0115.633] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e804, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.635] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e804, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62
	[0115.636] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x62
	[0115.636] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e804, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62
	[0115.641] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0115.642] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.642] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 1
	[0115.643] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0
	[0115.643] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0115.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0115.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0115.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0115.644] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e830, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.645] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x26e830, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61
	[0115.647] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x61
	[0115.647] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x26e830, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61
	[0115.649] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.651] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62
	[0115.652] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e804, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.654] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e804, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62
	[0115.655] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x62
	[0115.656] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e804, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62
	[0115.660] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0115.661] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.661] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 1
	[0115.662] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.662] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0115.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0115.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0115.662] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e6f4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.664] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x26e6f4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62
	[0115.666] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Decrypt.txt", lpFilePart=0x0) returned 0x6d
	[0115.666] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Decrypt.txt", lpszLongPath=0x26e6f4, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0
	[0115.666] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x26e6b4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61
	[0115.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0115.668] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0115.669] GetFileType (hFile=0x228) returned 0x1
	[0115.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0115.669] GetFileType (hFile=0x228) returned 0x1
	[0115.670] WriteFile (in: hFile=0x228, lpBuffer=0x25f3220*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x25f3220*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0115.673] CloseHandle (hObject=0x228) returned 1
	[0115.673] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.673] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.674] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56
	[0115.675] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x56
	[0115.675] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x26e8d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56
	[0115.677] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e8b0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.679] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.681] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x57
	[0115.681] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e8a4, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.686] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.686] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.687] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15de9990, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15de9990, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1
	[0115.687] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15de9990, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15de9990, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 0
	[0115.688] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.688] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x26e794, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57
	[0115.690] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Decrypt.txt", lpFilePart=0x0) returned 0x62
	[0115.690] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Decrypt.txt", lpszLongPath=0x26e794, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0
	[0115.690] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x26e754, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56
	[0115.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0115.692] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0115.702] GetFileType (hFile=0x224) returned 0x1
	[0115.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0115.703] GetFileType (hFile=0x224) returned 0x1
	[0115.703] WriteFile (in: hFile=0x224, lpBuffer=0x25f68dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x25f68dc*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0115.707] CloseHandle (hObject=0x224) returned 1
	[0115.707] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.707] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0115.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0115.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0115.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.711] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x2e
	[0115.711] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x2f
	[0115.711] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0115.712] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.712] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff107f92, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1
	[0115.713] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15d51410, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15d51410, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1
	[0115.713] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15e0faf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15e0faf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1
	[0115.714] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15e0faf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15e0faf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0
	[0115.714] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0115.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0115.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0115.714] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Decrypt.txt", lpFilePart=0x0) returned 0x3a
	[0115.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0115.715] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0115.716] GetFileType (hFile=0x220) returned 0x1
	[0115.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0115.716] GetFileType (hFile=0x220) returned 0x1
	[0115.716] WriteFile (in: hFile=0x220, lpBuffer=0x25f9f14*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25f9f14*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0115.719] CloseHandle (hObject=0x220) returned 1
	[0115.719] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0115.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.720] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x34
	[0115.720] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x35
	[0115.720] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0115.725] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.726] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1
	[0115.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.726] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x3d
	[0115.726] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", lpFilePart=0x0) returned 0x3e
	[0115.727] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.728] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.728] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0115.729] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0115.729] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0115.730] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.731] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x3d
	[0115.731] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", lpFilePart=0x0) returned 0x3e
	[0115.731] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.732] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.732] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0115.733] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0115.733] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.734] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.734] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0115.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0115.734] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0115.735] GetFileType (hFile=0x224) returned 0x1
	[0115.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0115.736] GetFileType (hFile=0x224) returned 0x1
	[0115.736] WriteFile (in: hFile=0x224, lpBuffer=0x25fee64*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x25fee64*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0115.739] CloseHandle (hObject=0x224) returned 1
	[0115.739] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1
	[0115.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.740] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x3d
	[0115.740] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", lpFilePart=0x0) returned 0x3e
	[0115.740] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.741] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.741] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0115.742] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0115.743] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0115.743] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.744] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x3d
	[0115.744] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", lpFilePart=0x0) returned 0x3e
	[0115.744] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.745] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.745] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0115.746] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0115.746] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.746] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.747] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0115.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0115.747] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0115.748] GetFileType (hFile=0x224) returned 0x1
	[0115.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0115.749] GetFileType (hFile=0x224) returned 0x1
	[0115.750] WriteFile (in: hFile=0x224, lpBuffer=0x26033d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26033d8*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0115.752] CloseHandle (hObject=0x224) returned 1
	[0115.753] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1
	[0115.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.753] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x3d
	[0115.753] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", lpFilePart=0x0) returned 0x3e
	[0115.753] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.754] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.754] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0115.755] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0115.756] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0115.757] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.757] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x3d
	[0115.757] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", lpFilePart=0x0) returned 0x3e
	[0115.757] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.758] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.759] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0115.759] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0115.759] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.760] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.760] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0115.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0115.760] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0115.761] GetFileType (hFile=0x224) returned 0x1
	[0115.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0115.762] GetFileType (hFile=0x224) returned 0x1
	[0115.762] WriteFile (in: hFile=0x224, lpBuffer=0x260794c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x260794c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0115.768] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0115.769] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa9d0d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0115.769] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1
	[0115.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.770] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x3d
	[0115.770] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", lpFilePart=0x0) returned 0x3e
	[0115.770] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.774] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.775] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0115.775] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0115.776] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0115.776] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.777] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x3d
	[0115.777] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", lpFilePart=0x0) returned 0x3e
	[0115.777] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.777] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.778] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0115.778] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0115.779] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.779] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.779] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0115.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0115.780] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0115.781] GetFileType (hFile=0x224) returned 0x1
	[0115.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0115.781] GetFileType (hFile=0x224) returned 0x1
	[0115.781] WriteFile (in: hFile=0x224, lpBuffer=0x260c164*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x260c164*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0115.784] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.785] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0115.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0115.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0115.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.785] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x34
	[0115.785] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x35
	[0115.785] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0115.786] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.787] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15e81f10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15e81f10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1
	[0115.787] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15ea8070, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15ea8070, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1
	[0115.788] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15ece1d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15ece1d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1
	[0115.788] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0115.789] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa9d0d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0115.789] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", lpFilePart=0x0) returned 0x3e
	[0115.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0115.789] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0115.791] GetFileType (hFile=0x224) returned 0x1
	[0115.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0115.791] GetFileType (hFile=0x224) returned 0x1
	[0115.791] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x8000
	[0115.792] ReadFile (in: hFile=0x224, lpBuffer=0x260e5a8, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x260e5a8*, lpNumberOfBytesRead=0x26ede4*=0x8000, lpOverlapped=0x0) returned 1
	[0115.796] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.KEKW", lpFilePart=0x0) returned 0x43
	[0115.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0115.796] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0115.797] GetFileType (hFile=0x224) returned 0x1
	[0115.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0115.797] GetFileType (hFile=0x224) returned 0x1
	[0115.798] WriteFile (in: hFile=0x224, lpBuffer=0x2617d08*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2617d08*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0115.802] CloseHandle (hObject=0x224) returned 1
	[0115.802] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", lpFilePart=0x0) returned 0x3e
	[0115.802] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat")) returned 1
	[0115.806] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15ef4330, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15ef4330, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1
	[0115.807] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15ef4330, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15ef4330, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0
	[0115.807] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0115.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0115.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0115.808] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0115.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0115.808] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0115.809] GetFileType (hFile=0x220) returned 0x1
	[0115.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0115.809] GetFileType (hFile=0x220) returned 0x1
	[0115.809] WriteFile (in: hFile=0x220, lpBuffer=0x261a568*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x261a568*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0115.812] CloseHandle (hObject=0x220) returned 1
	[0115.812] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0115.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.813] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3a
	[0115.813] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3b
	[0115.813] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0115.814] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.814] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff12e0f2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.bak", cAlternateFileName="")) returned 1
	[0115.815] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1
	[0115.815] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 0
	[0115.816] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0115.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0115.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0115.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.816] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3a
	[0115.816] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3b
	[0115.817] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0115.818] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.818] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff12e0f2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.bak", cAlternateFileName="")) returned 1
	[0115.818] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1
	[0115.819] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x46
	[0115.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0115.819] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0115.821] GetFileType (hFile=0x224) returned 0x1
	[0115.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0115.821] GetFileType (hFile=0x224) returned 0x1
	[0115.822] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x2fa9
	[0115.822] ReadFile (in: hFile=0x224, lpBuffer=0x261d4c0, nNumberOfBytesToRead=0x2fa9, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x261d4c0*, lpNumberOfBytesRead=0x26ede4*=0x2fa9, lpOverlapped=0x0) returned 1
	[0115.826] CloseHandle (hObject=0x224) returned 1
	[0115.826] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.KEKW", lpFilePart=0x0) returned 0x4b
	[0115.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0115.827] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0115.828] GetFileType (hFile=0x224) returned 0x1
	[0115.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0115.828] GetFileType (hFile=0x224) returned 0x1
	[0115.829] WriteFile (in: hFile=0x224, lpBuffer=0x2621b74*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x2621b74*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0115.832] CloseHandle (hObject=0x224) returned 1
	[0115.832] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x46
	[0115.832] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 1
	[0115.836] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.836] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0115.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0115.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0115.836] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0115.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0115.837] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0115.837] GetFileType (hFile=0x220) returned 0x1
	[0115.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0115.838] GetFileType (hFile=0x220) returned 0x1
	[0115.838] WriteFile (in: hFile=0x220, lpBuffer=0x2624298*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2624298*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0115.841] CloseHandle (hObject=0x220) returned 1
	[0115.841] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0115.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0115.841] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x35
	[0115.842] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x36
	[0115.842] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0115.848] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.849] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8679d27, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1
	[0115.850] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1
	[0115.850] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1
	[0115.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.851] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x44
	[0115.851] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x45
	[0115.851] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.852] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.853] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0115.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0115.853] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x4a
	[0115.853] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x4b
	[0115.853] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0115.854] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.855] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 1
	[0115.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0115.855] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x53
	[0115.855] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", lpFilePart=0x0) returned 0x54
	[0115.856] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0115.860] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.861] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1
	[0115.862] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1
	[0115.862] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1
	[0115.863] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1
	[0115.864] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1
	[0115.864] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1
	[0115.865] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1
	[0115.865] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1
	[0115.866] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1
	[0115.867] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1
	[0115.867] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1
	[0115.868] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1
	[0115.868] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0
	[0115.869] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0115.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0115.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0115.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0115.872] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x53
	[0115.872] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", lpFilePart=0x0) returned 0x54
	[0115.872] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0115.875] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.876] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1
	[0115.876] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1
	[0115.877] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1
	[0115.877] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1
	[0115.878] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1
	[0115.878] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1
	[0115.879] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1
	[0115.879] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1
	[0115.880] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1
	[0115.881] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1
	[0115.881] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1
	[0115.882] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1
	[0115.882] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.882] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0115.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0115.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0115.885] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Decrypt.txt", lpFilePart=0x0) returned 0x5f
	[0115.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0115.885] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0115.889] GetFileType (hFile=0x22c) returned 0x1
	[0115.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0115.889] GetFileType (hFile=0x22c) returned 0x1
	[0115.889] WriteFile (in: hFile=0x22c, lpBuffer=0x2630a04*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2630a04*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0115.892] CloseHandle (hObject=0x22c) returned 1
	[0115.892] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.893] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0115.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0115.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0115.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0115.893] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x4a
	[0115.893] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x4b
	[0115.894] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0115.894] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.895] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15ffecd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15ffecd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 1
	[0115.899] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15ffecd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15ffecd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 0
	[0115.899] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0115.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0115.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0115.900] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Decrypt.txt", lpFilePart=0x0) returned 0x56
	[0115.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0115.900] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0115.901] GetFileType (hFile=0x228) returned 0x1
	[0115.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0115.901] GetFileType (hFile=0x228) returned 0x1
	[0115.902] WriteFile (in: hFile=0x228, lpBuffer=0x2633d58*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2633d58*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0115.904] CloseHandle (hObject=0x228) returned 1
	[0115.905] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0115.905] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0115.906] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x44
	[0115.906] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x45
	[0115.906] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0115.906] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0115.907] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16024e30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16024e30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0115.907] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16024e30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16024e30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0115.908] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0115.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0115.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0115.908] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0115.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0115.908] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0115.909] GetFileType (hFile=0x224) returned 0x1
	[0115.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0115.909] GetFileType (hFile=0x224) returned 0x1
	[0115.910] WriteFile (in: hFile=0x224, lpBuffer=0x2636fc8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2636fc8*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.142] CloseHandle (hObject=0x224) returned 1
	[0116.142] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.143] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.143] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x35
	[0116.143] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x36
	[0116.143] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.144] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.145] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8679d27, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1
	[0116.145] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1
	[0116.146] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16024e30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16024e30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1
	[0116.146] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16024e30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16024e30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 0
	[0116.147] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.147] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0116.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.147] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0116.148] GetFileType (hFile=0x220) returned 0x1
	[0116.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0116.149] GetFileType (hFile=0x220) returned 0x1
	[0116.149] WriteFile (in: hFile=0x220, lpBuffer=0x263a8d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x263a8d8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0116.152] CloseHandle (hObject=0x220) returned 1
	[0116.152] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66d8860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0116.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.153] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x30
	[0116.153] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x31
	[0116.153] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66d8860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.158] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66d8860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.159] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0116.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.159] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x35
	[0116.159] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\", lpFilePart=0x0) returned 0x36
	[0116.160] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.160] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.161] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0116.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.161] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", lpFilePart=0x0) returned 0x3a
	[0116.162] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", lpFilePart=0x0) returned 0x3b
	[0116.162] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.162] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.163] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.163] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0116.164] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.164] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", lpFilePart=0x0) returned 0x3a
	[0116.164] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\", lpFilePart=0x0) returned 0x3b
	[0116.164] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.165] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.166] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.166] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.166] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.167] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0116.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0116.167] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0116.168] GetFileType (hFile=0x228) returned 0x1
	[0116.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0116.168] GetFileType (hFile=0x228) returned 0x1
	[0116.169] WriteFile (in: hFile=0x228, lpBuffer=0x263fb34*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x263fb34*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0116.171] CloseHandle (hObject=0x228) returned 1
	[0116.172] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.172] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.173] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x35
	[0116.173] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\", lpFilePart=0x0) returned 0x36
	[0116.173] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.174] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.174] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x162ac590, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x162ac590, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0116.175] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x162ac590, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x162ac590, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 0
	[0116.175] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.175] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0116.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.176] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.176] GetFileType (hFile=0x224) returned 0x1
	[0116.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.176] GetFileType (hFile=0x224) returned 0x1
	[0116.177] WriteFile (in: hFile=0x224, lpBuffer=0x2642b94*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2642b94*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.180] CloseHandle (hObject=0x224) returned 1
	[0116.181] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1
	[0116.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.181] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x37
	[0116.181] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x38
	[0116.181] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.182] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.182] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.183] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.183] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x37
	[0116.184] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\", lpFilePart=0x0) returned 0x38
	[0116.184] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.185] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.185] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.186] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.186] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\Decrypt.txt", lpFilePart=0x0) returned 0x43
	[0116.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.186] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\caches\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.187] GetFileType (hFile=0x224) returned 0x1
	[0116.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.187] GetFileType (hFile=0x224) returned 0x1
	[0116.187] WriteFile (in: hFile=0x224, lpBuffer=0x264650c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x264650c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.195] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1
	[0116.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.196] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x39
	[0116.196] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", lpFilePart=0x0) returned 0x3a
	[0116.196] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.202] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.202] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4777f11, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1
	[0116.203] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb8291b2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1
	[0116.203] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1
	[0116.204] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_256.db", cAlternateFileName="TH5A2B~1.DB")) returned 1
	[0116.204] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~4.DB")) returned 1
	[0116.205] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1
	[0116.205] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~2.DB")) returned 1
	[0116.206] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 1
	[0116.206] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 0
	[0116.206] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.209] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x39
	[0116.209] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\", lpFilePart=0x0) returned 0x3a
	[0116.210] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.212] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.213] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4777f11, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1
	[0116.213] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb8291b2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1
	[0116.214] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1
	[0116.214] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_256.db", cAlternateFileName="TH5A2B~1.DB")) returned 1
	[0116.215] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~4.DB")) returned 1
	[0116.215] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1
	[0116.215] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~2.DB")) returned 1
	[0116.216] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 1
	[0116.216] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.217] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.219] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0116.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.219] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.222] GetFileType (hFile=0x224) returned 0x1
	[0116.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.222] GetFileType (hFile=0x224) returned 0x1
	[0116.227] WriteFile (in: hFile=0x224, lpBuffer=0x264ce98*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x264ce98*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.230] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0116.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.231] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x3d
	[0116.231] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x3e
	[0116.231] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.232] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.233] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.233] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.233] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x3d
	[0116.233] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\", lpFilePart=0x0) returned 0x3e
	[0116.234] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.234] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.234] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.235] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.235] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0116.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.235] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\gameexplorer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.236] GetFileType (hFile=0x224) returned 0x1
	[0116.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.236] GetFileType (hFile=0x224) returned 0x1
	[0116.237] WriteFile (in: hFile=0x224, lpBuffer=0x26509a4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26509a4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.240] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0116.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.240] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x38
	[0116.240] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\", lpFilePart=0x0) returned 0x39
	[0116.240] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.243] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.243] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.244] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0116.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.244] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", lpFilePart=0x0) returned 0x44
	[0116.244] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", lpFilePart=0x0) returned 0x45
	[0116.244] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.245] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.245] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.246] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0116.246] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0116.246] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.247] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", lpFilePart=0x0) returned 0x44
	[0116.247] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\", lpFilePart=0x0) returned 0x45
	[0116.247] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.248] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.248] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.248] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0116.249] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", lpFilePart=0x0) returned 0x4e
	[0116.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0116.249] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0116.251] GetFileType (hFile=0x22c) returned 0x1
	[0116.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0116.251] GetFileType (hFile=0x22c) returned 0x1
	[0116.251] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x4000
	[0116.251] ReadFile (in: hFile=0x22c, lpBuffer=0x26547b0, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x26547b0*, lpNumberOfBytesRead=0x26eca4*=0x4000, lpOverlapped=0x0) returned 1
	[0116.256] CloseHandle (hObject=0x22c) returned 1
	[0116.256] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.KEKW", lpFilePart=0x0) returned 0x53
	[0116.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0116.256] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0116.257] GetFileType (hFile=0x22c) returned 0x1
	[0116.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0116.257] GetFileType (hFile=0x22c) returned 0x1
	[0116.258] WriteFile (in: hFile=0x22c, lpBuffer=0x2659ed4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x2659ed4*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0116.260] CloseHandle (hObject=0x22c) returned 1
	[0116.261] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", lpFilePart=0x0) returned 0x4e
	[0116.261] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")) returned 1
	[0116.264] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.265] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.265] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0116.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0116.266] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0116.266] GetFileType (hFile=0x228) returned 0x1
	[0116.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0116.266] GetFileType (hFile=0x228) returned 0x1
	[0116.267] WriteFile (in: hFile=0x228, lpBuffer=0x265c630*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x265c630*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0116.270] CloseHandle (hObject=0x228) returned 1
	[0116.271] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0116.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.271] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low", lpFilePart=0x0) returned 0x3c
	[0116.271] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", lpFilePart=0x0) returned 0x3d
	[0116.271] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.272] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.273] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.273] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.273] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low", lpFilePart=0x0) returned 0x3c
	[0116.274] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\", lpFilePart=0x0) returned 0x3d
	[0116.274] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.274] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.275] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.275] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.276] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0116.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0116.276] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0116.277] GetFileType (hFile=0x228) returned 0x1
	[0116.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0116.277] GetFileType (hFile=0x228) returned 0x1
	[0116.277] WriteFile (in: hFile=0x228, lpBuffer=0x26600e8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26600e8*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0116.280] CloseHandle (hObject=0x228) returned 1
	[0116.280] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.281] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.281] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x38
	[0116.281] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\", lpFilePart=0x0) returned 0x39
	[0116.282] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.282] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.283] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.283] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16390dd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16390dd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0116.284] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x163b6f30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x163b6f30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0116.284] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x163b6f30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x163b6f30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0116.285] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.285] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0116.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.286] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.286] GetFileType (hFile=0x224) returned 0x1
	[0116.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.287] GetFileType (hFile=0x224) returned 0x1
	[0116.287] WriteFile (in: hFile=0x224, lpBuffer=0x26636b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26636b4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.290] CloseHandle (hObject=0x224) returned 1
	[0116.290] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1
	[0116.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.291] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x3a
	[0116.291] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x3b
	[0116.291] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.292] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.292] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.293] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.293] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x3a
	[0116.293] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\", lpFilePart=0x0) returned 0x3b
	[0116.293] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.294] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.294] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.295] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.295] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0116.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.295] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\ringtones\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.296] GetFileType (hFile=0x224) returned 0x1
	[0116.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.297] GetFileType (hFile=0x224) returned 0x1
	[0116.297] WriteFile (in: hFile=0x224, lpBuffer=0x2667120*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2667120*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.300] CloseHandle (hObject=0x224) returned 1
	[0116.300] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7364c0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0116.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.300] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x49
	[0116.301] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x4a
	[0116.301] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7364c0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.306] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7364c0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.307] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0116.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.307] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55
	[0116.308] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x56
	[0116.308] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.313] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.313] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.314] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e3cd240, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0116.314] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1
	[0116.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.315] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS", lpFilePart=0x0) returned 0x5e
	[0116.315] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\", lpFilePart=0x0) returned 0x5f
	[0116.315] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0116.316] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.317] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.317] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0116.318] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0116.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0116.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0116.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.319] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS", lpFilePart=0x0) returned 0x5e
	[0116.319] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\", lpFilePart=0x0) returned 0x5f
	[0116.319] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0116.320] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.320] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.321] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.321] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0116.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0116.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0116.322] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0116.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0116.322] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0116.323] GetFileType (hFile=0x22c) returned 0x1
	[0116.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0116.323] GetFileType (hFile=0x22c) returned 0x1
	[0116.323] WriteFile (in: hFile=0x22c, lpBuffer=0x266d890*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x266d890*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0116.327] CloseHandle (hObject=0x22c) returned 1
	[0116.327] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1
	[0116.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.327] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K", lpFilePart=0x0) returned 0x5e
	[0116.328] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\", lpFilePart=0x0) returned 0x5f
	[0116.328] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0116.329] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.330] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.330] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0116.330] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0116.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0116.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0116.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.331] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K", lpFilePart=0x0) returned 0x5e
	[0116.331] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\", lpFilePart=0x0) returned 0x5f
	[0116.331] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0116.332] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.333] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.333] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.333] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0116.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0116.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0116.334] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0116.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0116.334] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0116.335] GetFileType (hFile=0x22c) returned 0x1
	[0116.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0116.335] GetFileType (hFile=0x22c) returned 0x1
	[0116.336] WriteFile (in: hFile=0x22c, lpBuffer=0x2672270*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2672270*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0116.338] CloseHandle (hObject=0x22c) returned 1
	[0116.339] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1
	[0116.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.339] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C", lpFilePart=0x0) returned 0x5e
	[0116.339] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\", lpFilePart=0x0) returned 0x5f
	[0116.340] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0116.340] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.341] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.341] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0116.342] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0116.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0116.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0116.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.345] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C", lpFilePart=0x0) returned 0x5e
	[0116.345] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\", lpFilePart=0x0) returned 0x5f
	[0116.345] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0116.346] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.346] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.347] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.347] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0116.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0116.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0116.347] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0116.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0116.348] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0116.349] GetFileType (hFile=0x22c) returned 0x1
	[0116.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0116.349] GetFileType (hFile=0x22c) returned 0x1
	[0116.349] WriteFile (in: hFile=0x22c, lpBuffer=0x2676c50*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2676c50*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0116.352] CloseHandle (hObject=0x22c) returned 1
	[0116.352] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 1
	[0116.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.352] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109", lpFilePart=0x0) returned 0x5e
	[0116.353] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\", lpFilePart=0x0) returned 0x5f
	[0116.353] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0116.353] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.354] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.355] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0116.355] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0116.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0116.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0116.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.355] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109", lpFilePart=0x0) returned 0x5e
	[0116.356] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\", lpFilePart=0x0) returned 0x5f
	[0116.356] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0116.356] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.357] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.357] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.357] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0116.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0116.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0116.358] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\Decrypt.txt", lpFilePart=0x0) returned 0x6a
	[0116.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0116.358] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0116.359] GetFileType (hFile=0x22c) returned 0x1
	[0116.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0116.359] GetFileType (hFile=0x22c) returned 0x1
	[0116.359] WriteFile (in: hFile=0x22c, lpBuffer=0x267b630*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x267b630*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0116.362] CloseHandle (hObject=0x22c) returned 1
	[0116.362] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.363] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.364] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5", lpFilePart=0x0) returned 0x55
	[0116.364] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\", lpFilePart=0x0) returned 0x56
	[0116.364] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.365] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.365] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.366] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e3cd240, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0116.366] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", lpFilePart=0x0) returned 0x5f
	[0116.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf0) returned 1
	[0116.366] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0116.367] GetFileType (hFile=0x22c) returned 0x1
	[0116.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebec) returned 1
	[0116.367] GetFileType (hFile=0x22c) returned 0x1
	[0116.367] GetFileSize (in: hFile=0x22c, lpFileSizeHigh=0x26ecf8 | out: lpFileSizeHigh=0x26ecf8*=0x0) returned 0x8000
	[0116.367] ReadFile (in: hFile=0x22c, lpBuffer=0x267dce0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x26eca4, lpOverlapped=0x0 | out: lpBuffer=0x267dce0*, lpNumberOfBytesRead=0x26eca4*=0x8000, lpOverlapped=0x0) returned 1
	[0116.373] CloseHandle (hObject=0x22c) returned 1
	[0116.373] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.KEKW", lpFilePart=0x0) returned 0x64
	[0116.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec24) returned 1
	[0116.373] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x22c
	[0116.374] GetFileType (hFile=0x22c) returned 0x1
	[0116.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec20) returned 1
	[0116.374] GetFileType (hFile=0x22c) returned 0x1
	[0116.374] WriteFile (in: hFile=0x22c, lpBuffer=0x268744c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ec48, lpOverlapped=0x0 | out: lpBuffer=0x268744c*, lpNumberOfBytesWritten=0x26ec48*=0x10, lpOverlapped=0x0) returned 1
	[0116.377] CloseHandle (hObject=0x22c) returned 1
	[0116.377] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", nBufferLength=0x105, lpBuffer=0x26e81c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", lpFilePart=0x0) returned 0x5f
	[0116.378] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")) returned 1
	[0116.381] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16429350, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16429350, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1
	[0116.382] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1644f4b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1644f4b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1
	[0116.382] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16475610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16475610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1
	[0116.383] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16475610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16475610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 1
	[0116.383] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16475610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16475610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 0
	[0116.384] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.384] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0116.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0116.385] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0116.385] GetFileType (hFile=0x228) returned 0x1
	[0116.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0116.386] GetFileType (hFile=0x228) returned 0x1
	[0116.386] WriteFile (in: hFile=0x228, lpBuffer=0x268a358*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x268a358*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0116.388] CloseHandle (hObject=0x228) returned 1
	[0116.389] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.389] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0116.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.390] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", lpFilePart=0x0) returned 0x4d
	[0116.390] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", lpFilePart=0x0) returned 0x4e
	[0116.390] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.391] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.391] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.392] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.392] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low", lpFilePart=0x0) returned 0x4d
	[0116.392] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", lpFilePart=0x0) returned 0x4e
	[0116.393] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.393] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.394] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.394] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.394] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0116.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0116.410] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0116.411] GetFileType (hFile=0x228) returned 0x1
	[0116.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0116.411] GetFileType (hFile=0x228) returned 0x1
	[0116.411] WriteFile (in: hFile=0x228, lpBuffer=0x268e398*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x268e398*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0116.417] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1
	[0116.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.418] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", lpFilePart=0x0) returned 0x55
	[0116.418] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", lpFilePart=0x0) returned 0x56
	[0116.418] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.419] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.419] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.420] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.420] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized", lpFilePart=0x0) returned 0x55
	[0116.420] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", lpFilePart=0x0) returned 0x56
	[0116.420] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.421] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.421] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.422] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.422] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0116.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0116.422] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0116.423] GetFileType (hFile=0x228) returned 0x1
	[0116.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0116.423] GetFileType (hFile=0x228) returned 0x1
	[0116.424] WriteFile (in: hFile=0x228, lpBuffer=0x2692440*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2692440*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0116.427] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.428] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.428] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x49
	[0116.428] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x4a
	[0116.428] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7364c0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.429] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7364c0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.430] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x164c18d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x164c18d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0116.430] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0116.430] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1650db90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1650db90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0116.431] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1650db90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1650db90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1
	[0116.431] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1650db90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1650db90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0
	[0116.432] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.432] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0116.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.432] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.433] GetFileType (hFile=0x224) returned 0x1
	[0116.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.433] GetFileType (hFile=0x224) returned 0x1
	[0116.433] WriteFile (in: hFile=0x224, lpBuffer=0x2695f18*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2695f18*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.436] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x579672e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1
	[0116.436] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x579672e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1
	[0116.437] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65cdec0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65cdec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1
	[0116.437] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65cdec0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65cdec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1
	[0116.438] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6581c00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6581c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1
	[0116.438] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1
	[0116.439] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1
	[0116.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.439] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x34
	[0116.440] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x35
	[0116.440] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.441] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.442] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1
	[0116.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.442] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", lpFilePart=0x0) returned 0x38
	[0116.442] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", lpFilePart=0x0) returned 0x39
	[0116.442] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.443] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.444] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.444] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.444] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC", lpFilePart=0x0) returned 0x38
	[0116.445] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\", lpFilePart=0x0) returned 0x39
	[0116.445] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.445] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.446] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.446] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.446] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0116.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0116.447] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\wer\\erc\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0116.447] GetFileType (hFile=0x228) returned 0x1
	[0116.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0116.448] GetFileType (hFile=0x228) returned 0x1
	[0116.448] WriteFile (in: hFile=0x228, lpBuffer=0x269b044*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x269b044*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0116.451] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1
	[0116.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.451] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x42
	[0116.451] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x43
	[0116.452] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.452] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.453] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.453] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.453] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive", lpFilePart=0x0) returned 0x42
	[0116.453] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\", lpFilePart=0x0) returned 0x43
	[0116.454] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.454] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.455] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.455] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.455] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt", lpFilePart=0x0) returned 0x4e
	[0116.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0116.456] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\wer\\reportarchive\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0116.456] GetFileType (hFile=0x228) returned 0x1
	[0116.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0116.457] GetFileType (hFile=0x228) returned 0x1
	[0116.457] WriteFile (in: hFile=0x228, lpBuffer=0x269ec98*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x269ec98*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0116.460] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.460] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.461] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER", lpFilePart=0x0) returned 0x34
	[0116.461] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\", lpFilePart=0x0) returned 0x35
	[0116.461] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.462] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.462] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16559e50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16559e50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1
	[0116.463] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16559e50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16559e50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1
	[0116.463] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16559e50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16559e50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0
	[0116.463] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.464] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\Decrypt.txt", lpFilePart=0x0) returned 0x40
	[0116.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.464] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\wer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.465] GetFileType (hFile=0x224) returned 0x1
	[0116.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.465] GetFileType (hFile=0x224) returned 0x1
	[0116.465] WriteFile (in: hFile=0x224, lpBuffer=0x26a1e90*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26a1e90*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.468] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.468] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.469] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x30
	[0116.469] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x31
	[0116.469] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66d8860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.469] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66d8860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.470] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x162ac590, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x162ac590, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0116.470] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x162d26f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x162d26f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1
	[0116.471] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1631e9b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1631e9b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1
	[0116.471] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x16344b10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16344b10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0116.471] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x163dd090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x163dd090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0116.472] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x163dd090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x163dd090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1
	[0116.473] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x16533cf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16533cf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0116.473] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x579672e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1
	[0116.473] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", nBufferLength=0x105, lpBuffer=0x26e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", lpFilePart=0x0) returned 0x3d
	[0116.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed30) returned 1
	[0116.474] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0116.474] GetFileType (hFile=0x224) returned 0x1
	[0116.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed2c) returned 1
	[0116.474] GetFileType (hFile=0x224) returned 0x1
	[0116.474] GetFileSize (in: hFile=0x224, lpFileSizeHigh=0x26ee38 | out: lpFileSizeHigh=0x26ee38*=0x0) returned 0x40000
	[0116.477] ReadFile (in: hFile=0x224, lpBuffer=0x3872a58, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x26ede4, lpOverlapped=0x0 | out: lpBuffer=0x3872a58*, lpNumberOfBytesRead=0x26ede4*=0x40000, lpOverlapped=0x0) returned 1
	[0116.522] CloseHandle (hObject=0x224) returned 1
	[0116.523] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.KEKW", lpFilePart=0x0) returned 0x42
	[0116.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed64) returned 1
	[0116.523] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x224
	[0116.524] GetFileType (hFile=0x224) returned 0x1
	[0116.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed60) returned 1
	[0116.524] GetFileType (hFile=0x224) returned 0x1
	[0116.525] WriteFile (in: hFile=0x224, lpBuffer=0x26a5b28*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ed88, lpOverlapped=0x0 | out: lpBuffer=0x26a5b28*, lpNumberOfBytesWritten=0x26ed88*=0x10, lpOverlapped=0x0) returned 1
	[0116.528] CloseHandle (hObject=0x224) returned 1
	[0116.528] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", nBufferLength=0x105, lpBuffer=0x26e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", lpFilePart=0x0) returned 0x3d
	[0116.528] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat")) returned 1
	[0116.535] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x579672e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1
	[0116.536] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65cdec0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65cdec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1
	[0116.536] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65cdec0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65cdec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1
	[0116.537] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6581c00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6581c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1
	[0116.537] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1
	[0116.538] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1657ffb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1657ffb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1
	[0116.538] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1657ffb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1657ffb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 0
	[0116.538] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.539] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0x3c
	[0116.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.539] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0116.540] GetFileType (hFile=0x220) returned 0x1
	[0116.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0116.540] GetFileType (hFile=0x220) returned 0x1
	[0116.540] WriteFile (in: hFile=0x220, lpBuffer=0x26a9fa0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26a9fa0*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0116.543] CloseHandle (hObject=0x220) returned 1
	[0116.544] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1
	[0116.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.544] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail", lpFilePart=0x0) returned 0x35
	[0116.544] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\", lpFilePart=0x0) returned 0x36
	[0116.545] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.549] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.550] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1
	[0116.550] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1
	[0116.551] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1
	[0116.552] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1
	[0116.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.552] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", lpFilePart=0x0) returned 0x3c
	[0116.552] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", lpFilePart=0x0) returned 0x3d
	[0116.552] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.553] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.554] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="new", cAlternateFileName="")) returned 1
	[0116.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.554] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new", lpFilePart=0x0) returned 0x40
	[0116.554] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\", lpFilePart=0x0) returned 0x41
	[0116.554] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.559] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.560] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x650f7e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0116.560] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e9680, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64e9680, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0116.561] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e9680, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64e9680, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0116.563] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.566] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new", lpFilePart=0x0) returned 0x40
	[0116.567] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\", lpFilePart=0x0) returned 0x41
	[0116.567] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0116.572] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0116.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0116.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0116.574] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0116.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0116.575] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0116.578] GetFileType (hFile=0x228) returned 0x1
	[0116.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0116.578] GetFileType (hFile=0x228) returned 0x1
	[0116.579] WriteFile (in: hFile=0x228, lpBuffer=0x26b0a14*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x26b0a14*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0116.581] CloseHandle (hObject=0x228) returned 1
	[0116.583] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.583] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup", lpFilePart=0x0) returned 0x3c
	[0116.583] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", lpFilePart=0x0) returned 0x3d
	[0116.584] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.585] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.586] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0116.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.586] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.587] GetFileType (hFile=0x224) returned 0x1
	[0116.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.587] GetFileType (hFile=0x224) returned 0x1
	[0116.588] WriteFile (in: hFile=0x224, lpBuffer=0x26b3b64*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26b3b64*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.591] CloseHandle (hObject=0x224) returned 1
	[0116.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.594] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", lpFilePart=0x0) returned 0x40
	[0116.594] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpFilePart=0x0) returned 0x41
	[0116.594] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.610] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.613] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery", lpFilePart=0x0) returned 0x40
	[0116.614] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpFilePart=0x0) returned 0x41
	[0116.614] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.617] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.618] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1
	[0116.618] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1
	[0116.619] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFilePart=0x0) returned 0x4a
	[0116.619] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.619] GetFileType (hFile=0x228) returned 0x1
	[0116.620] GetFileType (hFile=0x228) returned 0x1
	[0116.620] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x432
	[0116.620] ReadFile (in: hFile=0x228, lpBuffer=0x26b9848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26b9848*, lpNumberOfBytesRead=0x26ed44*=0x432, lpOverlapped=0x0) returned 1
	[0116.625] CloseHandle (hObject=0x228) returned 1
	[0116.625] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.KEKW", lpFilePart=0x0) returned 0x4f
	[0116.625] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.626] GetFileType (hFile=0x228) returned 0x1
	[0116.626] GetFileType (hFile=0x228) returned 0x1
	[0116.627] WriteFile (in: hFile=0x228, lpBuffer=0x26bbf5c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26bbf5c*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0116.630] CloseHandle (hObject=0x228) returned 1
	[0116.630] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFilePart=0x0) returned 0x4a
	[0116.630] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 1
	[0116.633] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0116.634] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x650f7e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1
	[0116.634] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1
	[0116.634] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFilePart=0x0) returned 0x4b
	[0116.635] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.635] GetFileType (hFile=0x228) returned 0x1
	[0116.635] GetFileType (hFile=0x228) returned 0x1
	[0116.636] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x5d3f
	[0116.636] ReadFile (in: hFile=0x228, lpBuffer=0x26bdcd4, nNumberOfBytesToRead=0x5d3f, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26bdcd4*, lpNumberOfBytesRead=0x26ed44*=0x5d3f, lpOverlapped=0x0) returned 1
	[0116.640] CloseHandle (hObject=0x228) returned 1
	[0116.641] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.KEKW", lpFilePart=0x0) returned 0x50
	[0116.641] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.641] GetFileType (hFile=0x228) returned 0x1
	[0116.642] GetFileType (hFile=0x228) returned 0x1
	[0116.642] WriteFile (in: hFile=0x228, lpBuffer=0x26c5130*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26c5130*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0116.645] CloseHandle (hObject=0x228) returned 1
	[0116.645] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFilePart=0x0) returned 0x4b
	[0116.646] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 1
	[0116.650] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1
	[0116.650] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1
	[0116.651] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFilePart=0x0) returned 0x51
	[0116.651] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.653] GetFileType (hFile=0x228) returned 0x1
	[0116.653] GetFileType (hFile=0x228) returned 0x1
	[0116.653] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x1906
	[0116.653] ReadFile (in: hFile=0x228, lpBuffer=0x26c6bc4, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26c6bc4*, lpNumberOfBytesRead=0x26ed44*=0x1906, lpOverlapped=0x0) returned 1
	[0116.658] CloseHandle (hObject=0x228) returned 1
	[0116.658] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.KEKW", lpFilePart=0x0) returned 0x56
	[0116.658] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.659] GetFileType (hFile=0x228) returned 0x1
	[0116.659] GetFileType (hFile=0x228) returned 0x1
	[0116.659] WriteFile (in: hFile=0x228, lpBuffer=0x26c9c0c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26c9c0c*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0116.662] CloseHandle (hObject=0x228) returned 1
	[0116.662] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFilePart=0x0) returned 0x51
	[0116.662] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 1
	[0116.665] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1
	[0116.666] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1
	[0116.666] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFilePart=0x0) returned 0x4f
	[0116.666] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.667] GetFileType (hFile=0x228) returned 0x1
	[0116.667] GetFileType (hFile=0x228) returned 0x1
	[0116.667] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x107e
	[0116.667] ReadFile (in: hFile=0x228, lpBuffer=0x26cb674, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26cb674*, lpNumberOfBytesRead=0x26ed44*=0x107e, lpOverlapped=0x0) returned 1
	[0116.671] CloseHandle (hObject=0x228) returned 1
	[0116.672] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.KEKW", lpFilePart=0x0) returned 0x54
	[0116.672] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.672] GetFileType (hFile=0x228) returned 0x1
	[0116.673] GetFileType (hFile=0x228) returned 0x1
	[0116.673] WriteFile (in: hFile=0x228, lpBuffer=0x26cde28*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26cde28*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0116.676] CloseHandle (hObject=0x228) returned 1
	[0116.676] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFilePart=0x0) returned 0x4f
	[0116.676] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 1
	[0116.679] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1
	[0116.680] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1
	[0116.680] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFilePart=0x0) returned 0x52
	[0116.681] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.681] GetFileType (hFile=0x228) returned 0x1
	[0116.681] GetFileType (hFile=0x228) returned 0x1
	[0116.681] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x18ed
	[0116.682] ReadFile (in: hFile=0x228, lpBuffer=0x26cf8e0, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26cf8e0*, lpNumberOfBytesRead=0x26ed44*=0x18ed, lpOverlapped=0x0) returned 1
	[0116.686] CloseHandle (hObject=0x228) returned 1
	[0116.686] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.KEKW", lpFilePart=0x0) returned 0x57
	[0116.686] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.687] GetFileType (hFile=0x228) returned 0x1
	[0116.687] GetFileType (hFile=0x228) returned 0x1
	[0116.687] WriteFile (in: hFile=0x228, lpBuffer=0x26d2914*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26d2914*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0116.690] CloseHandle (hObject=0x228) returned 1
	[0116.690] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFilePart=0x0) returned 0x52
	[0116.691] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 1
	[0116.694] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1
	[0116.694] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1
	[0116.695] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFilePart=0x0) returned 0x4c
	[0116.695] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.695] GetFileType (hFile=0x228) returned 0x1
	[0116.696] GetFileType (hFile=0x228) returned 0x1
	[0116.696] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x13fb
	[0116.696] ReadFile (in: hFile=0x228, lpBuffer=0x26d42d4, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26d42d4*, lpNumberOfBytesRead=0x26ed44*=0x13fb, lpOverlapped=0x0) returned 1
	[0116.711] CloseHandle (hObject=0x228) returned 1
	[0116.711] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.KEKW", lpFilePart=0x0) returned 0x51
	[0116.711] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.712] GetFileType (hFile=0x228) returned 0x1
	[0116.712] GetFileType (hFile=0x228) returned 0x1
	[0116.713] WriteFile (in: hFile=0x228, lpBuffer=0x26d6df0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26d6df0*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0116.716] CloseHandle (hObject=0x228) returned 1
	[0116.716] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFilePart=0x0) returned 0x4c
	[0116.716] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 1
	[0116.719] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1
	[0116.720] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1
	[0116.720] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFilePart=0x0) returned 0x4a
	[0116.721] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.721] GetFileType (hFile=0x228) returned 0x1
	[0116.721] GetFileType (hFile=0x228) returned 0x1
	[0116.721] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x780
	[0116.722] ReadFile (in: hFile=0x228, lpBuffer=0x26d8ef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26d8ef8*, lpNumberOfBytesRead=0x26ed44*=0x780, lpOverlapped=0x0) returned 1
	[0116.726] CloseHandle (hObject=0x228) returned 1
	[0116.726] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.KEKW", lpFilePart=0x0) returned 0x4f
	[0116.727] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.727] GetFileType (hFile=0x228) returned 0x1
	[0116.727] GetFileType (hFile=0x228) returned 0x1
	[0116.728] WriteFile (in: hFile=0x228, lpBuffer=0x26db60c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26db60c*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0116.730] CloseHandle (hObject=0x228) returned 1
	[0116.731] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFilePart=0x0) returned 0x4a
	[0116.731] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 1
	[0116.734] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1
	[0116.734] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1
	[0116.735] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFilePart=0x0) returned 0x51
	[0116.735] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.736] GetFileType (hFile=0x228) returned 0x1
	[0116.737] GetFileType (hFile=0x228) returned 0x1
	[0116.737] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x127e
	[0116.737] ReadFile (in: hFile=0x228, lpBuffer=0x26dd0a8, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26dd0a8*, lpNumberOfBytesRead=0x26ed44*=0x127e, lpOverlapped=0x0) returned 1
	[0116.743] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.KEKW", lpFilePart=0x0) returned 0x56
	[0116.743] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.745] GetFileType (hFile=0x228) returned 0x1
	[0116.746] GetFileType (hFile=0x228) returned 0x1
	[0116.746] WriteFile (in: hFile=0x228, lpBuffer=0x26dfa68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26dfa68*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0116.750] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFilePart=0x0) returned 0x51
	[0116.751] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 1
	[0116.754] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6477260, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1
	[0116.755] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e9680, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64e9680, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1
	[0116.755] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFilePart=0x0) returned 0x4d
	[0116.755] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.757] GetFileType (hFile=0x228) returned 0x1
	[0116.757] GetFileType (hFile=0x228) returned 0x1
	[0116.757] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x2949
	[0116.757] ReadFile (in: hFile=0x228, lpBuffer=0x26e1470, nNumberOfBytesToRead=0x2949, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26e1470*, lpNumberOfBytesRead=0x26ed44*=0x2949, lpOverlapped=0x0) returned 1
	[0116.761] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.KEKW", lpFilePart=0x0) returned 0x52
	[0116.761] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.762] GetFileType (hFile=0x228) returned 0x1
	[0116.762] GetFileType (hFile=0x228) returned 0x1
	[0116.763] WriteFile (in: hFile=0x228, lpBuffer=0x26e54e4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26e54e4*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0116.765] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFilePart=0x0) returned 0x4d
	[0116.765] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 1
	[0116.768] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1
	[0116.769] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6477260, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1
	[0116.769] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFilePart=0x0) returned 0x4a
	[0116.769] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.770] GetFileType (hFile=0x228) returned 0x1
	[0116.770] GetFileType (hFile=0x228) returned 0x1
	[0116.770] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x1d51
	[0116.770] ReadFile (in: hFile=0x228, lpBuffer=0x26e6e60, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x26e6e60*, lpNumberOfBytesRead=0x26ed44*=0x1d51, lpOverlapped=0x0) returned 1
	[0116.774] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.KEKW", lpFilePart=0x0) returned 0x4f
	[0116.774] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0116.775] GetFileType (hFile=0x228) returned 0x1
	[0116.775] GetFileType (hFile=0x228) returned 0x1
	[0116.776] WriteFile (in: hFile=0x228, lpBuffer=0x26ea2c8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x26ea2c8*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0116.778] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFilePart=0x0) returned 0x4a
	[0116.779] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 1
	[0116.782] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.782] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.783] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0116.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.783] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.783] GetFileType (hFile=0x224) returned 0x1
	[0116.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.784] GetFileType (hFile=0x224) returned 0x1
	[0116.784] WriteFile (in: hFile=0x224, lpBuffer=0x26eca0c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26eca0c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.787] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd7b05332, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0116.788] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0116.788] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0
	[0116.789] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.789] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail", lpFilePart=0x0) returned 0x35
	[0116.790] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\", lpFilePart=0x0) returned 0x36
	[0116.790] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.790] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.791] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1
	[0116.791] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1
	[0116.792] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1
	[0116.792] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x166b0ab0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x166b0ab0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1
	[0116.793] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd7bc3a13, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1
	[0116.793] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd7bc3a13, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1
	[0116.794] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0116.794] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1
	[0116.794] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1
	[0116.795] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeold.xml", cAlternateFileName="")) returned 1
	[0116.795] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16879b30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16879b30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0116.796] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd7b05332, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0116.796] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0116.797] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.797] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.798] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0116.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.798] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0116.799] GetFileType (hFile=0x220) returned 0x1
	[0116.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0116.799] GetFileType (hFile=0x220) returned 0x1
	[0116.799] WriteFile (in: hFile=0x220, lpBuffer=0x26f2e38*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26f2e38*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0116.802] CloseHandle (hObject=0x220) returned 1
	[0116.803] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1
	[0116.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.803] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media", lpFilePart=0x0) returned 0x36
	[0116.803] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\", lpFilePart=0x0) returned 0x37
	[0116.803] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.804] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.805] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1
	[0116.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.805] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0", lpFilePart=0x0) returned 0x3b
	[0116.805] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpFilePart=0x0) returned 0x3c
	[0116.805] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.806] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.807] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1
	[0116.807] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1
	[0116.808] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0
	[0116.808] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.809] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0", lpFilePart=0x0) returned 0x3b
	[0116.809] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpFilePart=0x0) returned 0x3c
	[0116.809] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.809] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.810] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1
	[0116.810] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1
	[0116.811] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.811] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.811] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0116.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.812] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.812] GetFileType (hFile=0x224) returned 0x1
	[0116.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.813] GetFileType (hFile=0x224) returned 0x1
	[0116.813] WriteFile (in: hFile=0x224, lpBuffer=0x26f7d1c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26f7d1c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.816] CloseHandle (hObject=0x224) returned 1
	[0116.816] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.817] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.817] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media", lpFilePart=0x0) returned 0x36
	[0116.818] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\", lpFilePart=0x0) returned 0x37
	[0116.818] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.818] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.819] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x168c5df0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x168c5df0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1
	[0116.819] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x168c5df0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x168c5df0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 0
	[0116.820] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.820] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\Decrypt.txt", lpFilePart=0x0) returned 0x42
	[0116.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.820] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0116.821] GetFileType (hFile=0x220) returned 0x1
	[0116.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0116.821] GetFileType (hFile=0x220) returned 0x1
	[0116.821] WriteFile (in: hFile=0x220, lpBuffer=0x26fada8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x26fada8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0116.824] CloseHandle (hObject=0x220) returned 1
	[0116.824] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0116.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.825] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x38
	[0116.825] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpFilePart=0x0) returned 0x39
	[0116.825] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.827] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.828] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0116.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.829] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x40
	[0116.829] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", lpFilePart=0x0) returned 0x41
	[0116.829] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.830] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.830] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.830] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.831] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x40
	[0116.831] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\", lpFilePart=0x0) returned 0x41
	[0116.831] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.832] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.832] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.832] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.833] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0116.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.833] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\gadgets\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.834] GetFileType (hFile=0x224) returned 0x1
	[0116.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.834] GetFileType (hFile=0x224) returned 0x1
	[0116.834] WriteFile (in: hFile=0x224, lpBuffer=0x26ff3b4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x26ff3b4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.837] CloseHandle (hObject=0x224) returned 1
	[0116.837] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 1
	[0116.837] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 0
	[0116.837] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.838] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x38
	[0116.838] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpFilePart=0x0) returned 0x39
	[0116.838] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.839] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.839] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x169120b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x169120b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0116.839] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 1
	[0116.840] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.840] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.840] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Decrypt.txt", lpFilePart=0x0) returned 0x44
	[0116.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.840] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0116.841] GetFileType (hFile=0x220) returned 0x1
	[0116.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0116.841] GetFileType (hFile=0x220) returned 0x1
	[0116.841] WriteFile (in: hFile=0x220, lpBuffer=0x27029b8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27029b8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0116.844] CloseHandle (hObject=0x220) returned 1
	[0116.844] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.845] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0116.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0116.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0116.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0116.845] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x28
	[0116.845] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x29
	[0116.846] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0116.846] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.846] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15cb8e90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15cb8e90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0116.847] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15e5bdb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15e5bdb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0116.847] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15f405f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15f405f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0116.848] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x15f8c8b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15f8c8b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0116.848] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16286430, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16286430, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0116.849] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1663e690, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1663e690, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0116.850] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1689fc90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1689fc90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1
	[0116.850] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x168ebf50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x168ebf50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1
	[0116.851] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x169120b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x169120b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0116.851] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x169120b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x169120b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0
	[0116.851] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0116.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0116.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0116.852] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0116.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.852] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0116.853] GetFileType (hFile=0x208) returned 0x1
	[0116.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0116.853] GetFileType (hFile=0x208) returned 0x1
	[0116.854] WriteFile (in: hFile=0x208, lpBuffer=0x27062fc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x27062fc*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0116.856] CloseHandle (hObject=0x208) returned 1
	[0116.857] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0116.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0116.857] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x23
	[0116.857] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x24
	[0116.857] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0116.858] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.859] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1
	[0116.859] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0
	[0116.860] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0116.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0116.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0116.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0116.860] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x23
	[0116.860] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x24
	[0116.860] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0116.861] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.862] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1
	[0116.862] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x26e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x3a
	[0116.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd0) returned 1
	[0116.862] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0116.863] GetFileType (hFile=0x220) returned 0x1
	[0116.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edcc) returned 1
	[0116.863] GetFileType (hFile=0x220) returned 0x1
	[0116.863] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x26eed8 | out: lpFileSizeHigh=0x26eed8*=0x0) returned 0x0
	[0116.863] CloseHandle (hObject=0x220) returned 1
	[0116.863] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.KEKW", nBufferLength=0x105, lpBuffer=0x26e910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.KEKW", lpFilePart=0x0) returned 0x3f
	[0116.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee04) returned 1
	[0116.864] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.KEKW" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
	[0116.864] GetFileType (hFile=0x220) returned 0x1
	[0116.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee00) returned 1
	[0116.865] GetFileType (hFile=0x220) returned 0x1
	[0116.865] WriteFile (in: hFile=0x220, lpBuffer=0x2709ee0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ee28, lpOverlapped=0x0 | out: lpBuffer=0x2709ee0*, lpNumberOfBytesWritten=0x26ee28*=0x10, lpOverlapped=0x0) returned 1
	[0116.867] CloseHandle (hObject=0x220) returned 1
	[0116.868] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x26e9fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x3a
	[0116.868] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 1
	[0116.869] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.869] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0116.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0116.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0116.869] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp\\Decrypt.txt", lpFilePart=0x0) returned 0x2f
	[0116.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.869] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0116.870] GetFileType (hFile=0x208) returned 0x1
	[0116.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0116.870] GetFileType (hFile=0x208) returned 0x1
	[0116.871] WriteFile (in: hFile=0x208, lpBuffer=0x270c58c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x270c58c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0116.874] CloseHandle (hObject=0x208) returned 1
	[0116.874] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0116.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0116.875] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x37
	[0116.875] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x38
	[0116.875] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0116.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eee0) returned 1
	[0116.879] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.880] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0116.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0116.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0116.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0116.880] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local", lpFilePart=0x0) returned 0x1e
	[0116.880] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\", lpFilePart=0x0) returned 0x1f
	[0116.880] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0116.881] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.882] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0116.882] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0116.883] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x66b2700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xddd35f67, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xbd7f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0116.883] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x16938210, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16938210, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0116.884] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1695e370, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1695e370, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0116.884] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0116.885] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0
	[0116.885] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0116.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0116.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0116.886] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Decrypt.txt", lpFilePart=0x0) returned 0x2a
	[0116.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.886] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Local\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\local\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0116.887] GetFileType (hFile=0x204) returned 0x1
	[0116.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0116.887] GetFileType (hFile=0x204) returned 0x1
	[0116.887] WriteFile (in: hFile=0x204, lpBuffer=0x27105c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x27105c8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0116.890] CloseHandle (hObject=0x204) returned 1
	[0116.891] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1
	[0116.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0116.891] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow", lpFilePart=0x0) returned 0x21
	[0116.891] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x22
	[0116.892] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0116.895] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.895] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0116.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0116.896] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft", lpFilePart=0x0) returned 0x2b
	[0116.896] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\", lpFilePart=0x0) returned 0x2c
	[0116.896] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0116.897] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.897] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1
	[0116.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.898] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", lpFilePart=0x0) returned 0x3c
	[0116.898] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpFilePart=0x0) returned 0x3d
	[0116.898] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.899] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.899] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1
	[0116.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.900] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", lpFilePart=0x0) returned 0x44
	[0116.900] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpFilePart=0x0) returned 0x45
	[0116.900] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.901] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.902] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1
	[0116.902] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1
	[0116.903] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 0
	[0116.903] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.904] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", lpFilePart=0x0) returned 0x44
	[0116.904] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpFilePart=0x0) returned 0x45
	[0116.904] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.905] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.906] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1
	[0116.906] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1
	[0116.907] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.907] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.908] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0116.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.908] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.909] GetFileType (hFile=0x224) returned 0x1
	[0116.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.909] GetFileType (hFile=0x224) returned 0x1
	[0116.910] WriteFile (in: hFile=0x224, lpBuffer=0x2716c2c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2716c2c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.913] CloseHandle (hObject=0x224) returned 1
	[0116.913] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 1
	[0116.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.913] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", lpFilePart=0x0) returned 0x45
	[0116.914] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpFilePart=0x0) returned 0x46
	[0116.914] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.915] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.915] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1
	[0116.916] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1
	[0116.916] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 0
	[0116.917] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.917] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", lpFilePart=0x0) returned 0x45
	[0116.917] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpFilePart=0x0) returned 0x46
	[0116.918] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.918] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.919] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1
	[0116.919] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1
	[0116.920] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.920] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0116.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0116.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0116.920] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0116.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0116.921] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0116.922] GetFileType (hFile=0x224) returned 0x1
	[0116.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0116.922] GetFileType (hFile=0x224) returned 0x1
	[0116.922] WriteFile (in: hFile=0x224, lpBuffer=0x271b7e0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x271b7e0*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0116.925] CloseHandle (hObject=0x224) returned 1
	[0116.925] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.925] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.926] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", lpFilePart=0x0) returned 0x3c
	[0116.926] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpFilePart=0x0) returned 0x3d
	[0116.926] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.927] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.927] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x169aa630, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x169aa630, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1
	[0116.928] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x169d0790, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x169d0790, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 1
	[0116.928] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x169d0790, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x169d0790, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 0
	[0116.929] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.929] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0116.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.930] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0116.930] GetFileType (hFile=0x220) returned 0x1
	[0116.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0116.931] GetFileType (hFile=0x220) returned 0x1
	[0116.931] WriteFile (in: hFile=0x220, lpBuffer=0x271eab8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x271eab8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0116.934] CloseHandle (hObject=0x220) returned 1
	[0116.934] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.934] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0116.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0116.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0116.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0116.935] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft", lpFilePart=0x0) returned 0x2b
	[0116.935] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\", lpFilePart=0x0) returned 0x2c
	[0116.935] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0116.936] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.936] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x169f68f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x169f68f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1
	[0116.937] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x169f68f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x169f68f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 0
	[0116.937] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0116.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0116.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0116.938] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0116.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.938] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0116.939] GetFileType (hFile=0x208) returned 0x1
	[0116.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0116.939] GetFileType (hFile=0x208) returned 0x1
	[0116.939] WriteFile (in: hFile=0x208, lpBuffer=0x2721a64*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x2721a64*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0116.943] CloseHandle (hObject=0x208) returned 1
	[0116.944] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.944] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0116.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0116.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0116.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0116.945] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow", lpFilePart=0x0) returned 0x21
	[0116.945] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x22
	[0116.945] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0116.946] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.946] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x169f68f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x169f68f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0116.947] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x169f68f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x169f68f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0
	[0116.947] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0116.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0116.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0116.948] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\LocalLow\\Decrypt.txt", lpFilePart=0x0) returned 0x2d
	[0116.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.948] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\locallow\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0116.949] GetFileType (hFile=0x204) returned 0x1
	[0116.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0116.949] GetFileType (hFile=0x204) returned 0x1
	[0116.949] WriteFile (in: hFile=0x204, lpBuffer=0x272487c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x272487c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0116.952] CloseHandle (hObject=0x204) returned 1
	[0116.952] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1
	[0116.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0116.953] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming", lpFilePart=0x0) returned 0x20
	[0116.953] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x21
	[0116.953] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0116.954] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.954] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1
	[0116.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0116.955] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2b
	[0116.955] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x2c
	[0116.955] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0116.957] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.958] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1
	[0116.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.958] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x52
	[0116.958] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpFilePart=0x0) returned 0x53
	[0116.959] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.959] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.960] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.960] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.961] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x52
	[0116.961] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpFilePart=0x0) returned 0x53
	[0116.961] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.962] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.962] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.963] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.963] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0116.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.964] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0116.964] GetFileType (hFile=0x220) returned 0x1
	[0116.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0116.965] GetFileType (hFile=0x220) returned 0x1
	[0116.965] WriteFile (in: hFile=0x220, lpBuffer=0x27298e0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x27298e0*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0116.967] CloseHandle (hObject=0x220) returned 1
	[0116.967] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0116.968] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0116.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0116.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0116.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0116.968] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2b
	[0116.968] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x2c
	[0116.969] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0116.969] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.970] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16a42bb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16a42bb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1
	[0116.970] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16a42bb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16a42bb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0
	[0116.971] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0116.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0116.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0116.971] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Identities\\Decrypt.txt", lpFilePart=0x0) returned 0x37
	[0116.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.972] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\identities\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0116.972] GetFileType (hFile=0x208) returned 0x1
	[0116.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0116.972] GetFileType (hFile=0x208) returned 0x1
	[0116.973] WriteFile (in: hFile=0x208, lpBuffer=0x272c93c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x272c93c*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0116.975] CloseHandle (hObject=0x208) returned 1
	[0116.976] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0116.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0116.976] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2a
	[0116.976] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x2b
	[0116.977] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0116.983] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.984] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0116.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.984] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x36
	[0116.984] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x37
	[0116.984] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.985] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.986] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.986] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.987] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x36
	[0116.987] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x37
	[0116.988] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.988] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.989] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0116.989] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0116.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0116.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0116.990] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\Decrypt.txt", lpFilePart=0x0) returned 0x42
	[0116.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0116.990] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\credentials\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0116.991] GetFileType (hFile=0x220) returned 0x1
	[0116.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0116.991] GetFileType (hFile=0x220) returned 0x1
	[0116.991] WriteFile (in: hFile=0x220, lpBuffer=0x2730b68*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2730b68*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0116.994] CloseHandle (hObject=0x220) returned 1
	[0116.995] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0116.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0116.995] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x31
	[0116.995] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x32
	[0116.995] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0116.996] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.997] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0116.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0116.997] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x35
	[0116.998] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x36
	[0116.998] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0116.999] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0116.999] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.000] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.000] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x35
	[0117.001] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x36
	[0117.001] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.001] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.002] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.002] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.003] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Decrypt.txt", lpFilePart=0x0) returned 0x41
	[0117.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.004] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\crypto\\rsa\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.004] GetFileType (hFile=0x224) returned 0x1
	[0117.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0117.004] GetFileType (hFile=0x224) returned 0x1
	[0117.005] WriteFile (in: hFile=0x224, lpBuffer=0x2734dac*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2734dac*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.011] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.011] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0117.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0117.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0117.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0117.012] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x31
	[0117.012] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x32
	[0117.012] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0117.012] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.013] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16ab4fd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16ab4fd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1
	[0117.013] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16ab4fd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16ab4fd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0
	[0117.014] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0117.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0117.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0117.014] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\Decrypt.txt", lpFilePart=0x0) returned 0x3d
	[0117.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.014] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\crypto\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0117.015] GetFileType (hFile=0x220) returned 0x1
	[0117.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0117.015] GetFileType (hFile=0x220) returned 0x1
	[0117.016] WriteFile (in: hFile=0x220, lpBuffer=0x2737d74*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2737d74*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.020] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0117.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0117.020] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3c
	[0117.020] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3d
	[0117.020] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0117.021] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.022] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1
	[0117.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.022] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x49
	[0117.022] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x4a
	[0117.022] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.027] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.028] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de4960a, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e1692f0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.028] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de234aa, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1
	[0117.029] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1
	[0117.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.029] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x55
	[0117.029] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x56
	[0117.030] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.031] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.031] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1
	[0117.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.032] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6a
	[0117.032] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x6b
	[0117.032] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0117.033] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.033] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.034] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0117.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0117.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0117.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.034] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6a
	[0117.034] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x6b
	[0117.035] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0117.035] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.036] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.036] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0117.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0117.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0117.037] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Decrypt.txt", lpFilePart=0x0) returned 0x76
	[0117.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0117.037] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0117.038] GetFileType (hFile=0x22c) returned 0x1
	[0117.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0117.038] GetFileType (hFile=0x22c) returned 0x1
	[0117.039] WriteFile (in: hFile=0x22c, lpBuffer=0x273eba0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x273eba0*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.042] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 1
	[0117.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.042] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5d
	[0117.042] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x5e
	[0117.043] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0117.048] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.049] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.049] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1
	[0117.051] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0117.051] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0117.052] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0
	[0117.052] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0117.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0117.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0117.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.055] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5d
	[0117.055] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x5e
	[0117.056] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0117.058] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.059] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.059] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1
	[0117.059] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1
	[0117.060] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0117.060] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.060] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0117.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0117.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0117.063] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Decrypt.txt", lpFilePart=0x0) returned 0x69
	[0117.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0117.064] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0117.068] GetFileType (hFile=0x22c) returned 0x1
	[0117.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0117.069] GetFileType (hFile=0x22c) returned 0x1
	[0117.069] WriteFile (in: hFile=0x22c, lpBuffer=0x2744d8c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x2744d8c*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.076] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.076] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.076] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x55
	[0117.077] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x56
	[0117.077] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.077] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.078] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16b01290, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16b01290, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1
	[0117.078] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16b4d550, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16b4d550, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 1
	[0117.079] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16b4d550, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16b4d550, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 0
	[0117.079] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.079] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Decrypt.txt", lpFilePart=0x0) returned 0x61
	[0117.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0117.080] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0117.081] GetFileType (hFile=0x228) returned 0x1
	[0117.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0117.081] GetFileType (hFile=0x228) returned 0x1
	[0117.081] WriteFile (in: hFile=0x228, lpBuffer=0x2748470*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2748470*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0117.085] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de6f76b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0117.085] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de6f76b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0
	[0117.086] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.086] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x49
	[0117.086] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\", lpFilePart=0x0) returned 0x4a
	[0117.086] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.087] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.087] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de4960a, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e1692f0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.088] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de234aa, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1
	[0117.088] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16b4d550, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16b4d550, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1
	[0117.088] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de6f76b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0117.089] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.089] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.089] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Decrypt.txt", lpFilePart=0x0) returned 0x55
	[0117.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.090] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.091] GetFileType (hFile=0x224) returned 0x1
	[0117.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0117.091] GetFileType (hFile=0x224) returned 0x1
	[0117.091] WriteFile (in: hFile=0x224, lpBuffer=0x274c7b8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x274c7b8*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.094] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.095] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0117.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0117.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0117.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0117.095] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3c
	[0117.095] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x3d
	[0117.096] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0117.096] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.097] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x16b736b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16b736b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1
	[0117.097] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x16b736b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16b736b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 0
	[0117.098] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0117.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0117.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0117.098] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0117.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.098] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0117.099] GetFileType (hFile=0x220) returned 0x1
	[0117.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0117.099] GetFileType (hFile=0x220) returned 0x1
	[0117.099] WriteFile (in: hFile=0x220, lpBuffer=0x274f990*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x274f990*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.102] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1
	[0117.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0117.103] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x32
	[0117.103] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x33
	[0117.103] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0117.104] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.104] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1
	[0117.105] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1
	[0117.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.105] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x60
	[0117.105] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpFilePart=0x0) returned 0x61
	[0117.106] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.110] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.110] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1
	[0117.111] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1
	[0117.111] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0
	[0117.112] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.115] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x60
	[0117.115] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpFilePart=0x0) returned 0x61
	[0117.115] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.118] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.118] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1
	[0117.119] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1
	[0117.119] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.119] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.122] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0117.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.122] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.126] GetFileType (hFile=0x224) returned 0x1
	[0117.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0117.126] GetFileType (hFile=0x224) returned 0x1
	[0117.126] WriteFile (in: hFile=0x224, lpBuffer=0x2755830*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x2755830*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.130] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.130] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0117.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0117.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0117.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0117.131] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x32
	[0117.131] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x33
	[0117.131] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0117.131] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.132] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1
	[0117.132] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16bbf970, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16bbf970, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1
	[0117.133] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16bbf970, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16bbf970, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 0
	[0117.133] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0117.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0117.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0117.134] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0117.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.134] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0117.135] GetFileType (hFile=0x220) returned 0x1
	[0117.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0117.135] GetFileType (hFile=0x220) returned 0x1
	[0117.135] WriteFile (in: hFile=0x220, lpBuffer=0x2758cd0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x2758cd0*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.139] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1
	[0117.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0117.139] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x3d
	[0117.139] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x3e
	[0117.139] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0117.140] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.140] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 1
	[0117.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.141] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x40
	[0117.141] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpFilePart=0x0) returned 0x41
	[0117.141] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.142] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.143] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1
	[0117.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.143] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x4d
	[0117.144] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpFilePart=0x0) returned 0x4e
	[0117.144] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.146] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.146] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.146] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.147] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x4d
	[0117.147] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpFilePart=0x0) returned 0x4e
	[0117.147] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.148] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.148] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.148] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.149] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Decrypt.txt", lpFilePart=0x0) returned 0x59
	[0117.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0117.149] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0117.150] GetFileType (hFile=0x228) returned 0x1
	[0117.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0117.150] GetFileType (hFile=0x228) returned 0x1
	[0117.153] WriteFile (in: hFile=0x228, lpBuffer=0x275e19c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x275e19c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0117.156] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLs", cAlternateFileName="")) returned 1
	[0117.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.156] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x45
	[0117.156] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpFilePart=0x0) returned 0x46
	[0117.157] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.157] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.158] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.158] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.159] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x45
	[0117.159] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpFilePart=0x0) returned 0x46
	[0117.159] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.160] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.160] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.160] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.161] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0117.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0117.161] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0117.162] GetFileType (hFile=0x228) returned 0x1
	[0117.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0117.162] GetFileType (hFile=0x228) returned 0x1
	[0117.162] WriteFile (in: hFile=0x228, lpBuffer=0x2761e58*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2761e58*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0117.165] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 1
	[0117.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.166] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x45
	[0117.166] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpFilePart=0x0) returned 0x46
	[0117.166] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.167] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.167] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.168] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.168] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x45
	[0117.168] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpFilePart=0x0) returned 0x46
	[0117.169] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.169] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.169] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.170] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.170] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Decrypt.txt", lpFilePart=0x0) returned 0x51
	[0117.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0117.170] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0117.171] GetFileType (hFile=0x228) returned 0x1
	[0117.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0117.171] GetFileType (hFile=0x228) returned 0x1
	[0117.171] WriteFile (in: hFile=0x228, lpBuffer=0x2765b14*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x2765b14*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0117.180] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.180] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.181] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x40
	[0117.181] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpFilePart=0x0) returned 0x41
	[0117.181] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.181] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.182] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16c0bc30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16c0bc30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1
	[0117.182] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16c31d90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16c31d90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLs", cAlternateFileName="")) returned 1
	[0117.182] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16c31d90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16c31d90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 1
	[0117.183] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16c31d90, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16c31d90, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 0
	[0117.183] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.183] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0117.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.184] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.184] GetFileType (hFile=0x224) returned 0x1
	[0117.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0117.185] GetFileType (hFile=0x224) returned 0x1
	[0117.190] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.190] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0117.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0117.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0117.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0117.192] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x3d
	[0117.192] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x3e
	[0117.192] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0117.192] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.192] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16c57ef0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16c57ef0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 1
	[0117.193] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16c57ef0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16c57ef0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 0
	[0117.193] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0117.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0117.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0117.193] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0117.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.194] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0117.195] GetFileType (hFile=0x220) returned 0x1
	[0117.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0117.195] GetFileType (hFile=0x220) returned 0x1
	[0117.198] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0117.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0117.198] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x32
	[0117.198] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x33
	[0117.198] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0117.206] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.206] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7f4ba2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0117.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.206] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x3a
	[0117.207] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpFilePart=0x0) returned 0x3b
	[0117.207] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7f4ba2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.207] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7f4ba2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.207] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0117.208] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0117.208] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.208] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x3a
	[0117.208] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\", lpFilePart=0x0) returned 0x3b
	[0117.209] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7f4ba2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.209] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7f4ba2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.209] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0117.209] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", lpFilePart=0x0) returned 0x44
	[0117.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0117.209] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0117.210] GetFileType (hFile=0x228) returned 0x1
	[0117.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0117.210] GetFileType (hFile=0x228) returned 0x1
	[0117.210] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x4000
	[0117.211] ReadFile (in: hFile=0x228, lpBuffer=0x276f4a8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x276f4a8*, lpNumberOfBytesRead=0x26ed44*=0x4000, lpOverlapped=0x0) returned 1
	[0117.215] CloseHandle (hObject=0x228) returned 1
	[0117.215] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.KEKW", lpFilePart=0x0) returned 0x49
	[0117.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0117.216] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.KEKW" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0117.217] GetFileType (hFile=0x228) returned 0x1
	[0117.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0117.217] GetFileType (hFile=0x228) returned 0x1
	[0117.217] WriteFile (in: hFile=0x228, lpBuffer=0x2774ba4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x2774ba4*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0117.220] CloseHandle (hObject=0x228) returned 1
	[0117.220] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", lpFilePart=0x0) returned 0x44
	[0117.221] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")) returned 1
	[0117.224] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.225] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.225] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Decrypt.txt", lpFilePart=0x0) returned 0x46
	[0117.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.226] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.226] GetFileType (hFile=0x224) returned 0x1
	[0117.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0117.227] GetFileType (hFile=0x224) returned 0x1
	[0117.227] WriteFile (in: hFile=0x224, lpBuffer=0x27772c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27772c4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.230] CloseHandle (hObject=0x224) returned 1
	[0117.230] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1
	[0117.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.231] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x40
	[0117.231] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", lpFilePart=0x0) returned 0x41
	[0117.231] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.233] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.234] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0117.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.235] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x44
	[0117.235] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", lpFilePart=0x0) returned 0x45
	[0117.235] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.236] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.236] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.237] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.238] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x44
	[0117.238] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\", lpFilePart=0x0) returned 0x45
	[0117.238] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.239] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.239] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.240] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.240] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0117.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0117.241] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\iecompatcache\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0117.241] GetFileType (hFile=0x228) returned 0x1
	[0117.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0117.242] GetFileType (hFile=0x228) returned 0x1
	[0117.242] WriteFile (in: hFile=0x228, lpBuffer=0x277baa4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x277baa4*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0117.245] CloseHandle (hObject=0x228) returned 1
	[0117.245] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.245] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.246] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x40
	[0117.246] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\", lpFilePart=0x0) returned 0x41
	[0117.247] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.247] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.248] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16cf0470, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16cf0470, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0117.248] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16cf0470, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16cf0470, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0117.249] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.249] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Decrypt.txt", lpFilePart=0x0) returned 0x4c
	[0117.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.249] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\iecompatcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.250] GetFileType (hFile=0x224) returned 0x1
	[0117.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0117.250] GetFileType (hFile=0x224) returned 0x1
	[0117.251] WriteFile (in: hFile=0x224, lpBuffer=0x277ec7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x277ec7c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.256] CloseHandle (hObject=0x224) returned 1
	[0117.257] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1
	[0117.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.257] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x3d
	[0117.257] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", lpFilePart=0x0) returned 0x3e
	[0117.258] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.261] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.262] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe6c3ce0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0117.263] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0117.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.263] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x41
	[0117.263] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", lpFilePart=0x0) returned 0x42
	[0117.264] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.264] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.265] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.265] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.266] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x41
	[0117.266] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\", lpFilePart=0x0) returned 0x42
	[0117.266] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.266] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.267] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.267] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.268] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0x4d
	[0117.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0117.268] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0117.272] GetFileType (hFile=0x228) returned 0x1
	[0117.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0117.273] GetFileType (hFile=0x228) returned 0x1
	[0117.273] WriteFile (in: hFile=0x228, lpBuffer=0x278348c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x278348c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0117.276] CloseHandle (hObject=0x228) returned 1
	[0117.276] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.276] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.277] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x3d
	[0117.277] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\", lpFilePart=0x0) returned 0x3e
	[0117.277] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.278] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.279] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe6c3ce0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0117.279] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", lpFilePart=0x0) returned 0x47
	[0117.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0117.279] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0117.280] GetFileType (hFile=0x228) returned 0x1
	[0117.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0117.280] GetFileType (hFile=0x228) returned 0x1
	[0117.280] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x3c000
	[0117.283] ReadFile (in: hFile=0x228, lpBuffer=0x38b2a78, nNumberOfBytesToRead=0x3c000, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x38b2a78*, lpNumberOfBytesRead=0x26ed44*=0x3c000, lpOverlapped=0x0) returned 1
	[0117.299] CloseHandle (hObject=0x228) returned 1
	[0117.300] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.KEKW", lpFilePart=0x0) returned 0x4c
	[0117.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0117.300] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.KEKW" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0117.302] GetFileType (hFile=0x228) returned 0x1
	[0117.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0117.302] GetFileType (hFile=0x228) returned 0x1
	[0117.302] WriteFile (in: hFile=0x228, lpBuffer=0x27869d4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x27869d4*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0117.305] CloseHandle (hObject=0x228) returned 1
	[0117.305] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", lpFilePart=0x0) returned 0x47
	[0117.305] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat")) returned 1
	[0117.312] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16d165d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16d165d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0117.313] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16d165d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16d165d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0117.313] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.314] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0117.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.314] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.316] GetFileType (hFile=0x224) returned 0x1
	[0117.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0117.316] GetFileType (hFile=0x224) returned 0x1
	[0117.316] WriteFile (in: hFile=0x224, lpBuffer=0x278925c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x278925c*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.319] CloseHandle (hObject=0x224) returned 1
	[0117.320] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1
	[0117.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.320] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x3c
	[0117.320] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpFilePart=0x0) returned 0x3d
	[0117.320] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.328] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.328] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.329] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xe03, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1
	[0117.329] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1
	[0117.330] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1
	[0117.331] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1
	[0117.331] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0
	[0117.332] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.335] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x3c
	[0117.335] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\", lpFilePart=0x0) returned 0x3d
	[0117.335] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.338] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.338] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.339] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xe03, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1
	[0117.339] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1
	[0117.340] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1
	[0117.340] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1
	[0117.341] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.341] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.344] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0117.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.344] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.348] GetFileType (hFile=0x224) returned 0x1
	[0117.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0117.348] GetFileType (hFile=0x224) returned 0x1
	[0117.348] WriteFile (in: hFile=0x224, lpBuffer=0x278eb08*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x278eb08*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.351] CloseHandle (hObject=0x224) returned 1
	[0117.352] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1
	[0117.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.352] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x44
	[0117.352] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpFilePart=0x0) returned 0x45
	[0117.352] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.353] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.354] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.354] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.355] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x44
	[0117.355] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\", lpFilePart=0x0) returned 0x45
	[0117.355] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.356] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.356] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.357] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.357] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0117.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.357] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\network shortcuts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.358] GetFileType (hFile=0x224) returned 0x1
	[0117.359] GetFileType (hFile=0x224) returned 0x1
	[0117.359] WriteFile (in: hFile=0x224, lpBuffer=0x27927dc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27927dc*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.362] CloseHandle (hObject=0x224) returned 1
	[0117.362] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1
	[0117.362] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x44
	[0117.362] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpFilePart=0x0) returned 0x45
	[0117.363] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.364] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.365] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.365] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.366] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x44
	[0117.366] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\", lpFilePart=0x0) returned 0x45
	[0117.366] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.366] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.367] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.367] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.368] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\Decrypt.txt", lpFilePart=0x0) returned 0x50
	[0117.368] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\printer shortcuts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.369] GetFileType (hFile=0x224) returned 0x1
	[0117.369] GetFileType (hFile=0x224) returned 0x1
	[0117.370] WriteFile (in: hFile=0x224, lpBuffer=0x27964b0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27964b0*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.373] CloseHandle (hObject=0x224) returned 1
	[0117.373] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1
	[0117.373] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x3b
	[0117.374] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpFilePart=0x0) returned 0x3c
	[0117.374] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.375] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.376] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0117.376] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x3f
	[0117.376] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", lpFilePart=0x0) returned 0x40
	[0117.376] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.378] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.378] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.379] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.379] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x3f
	[0117.380] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\", lpFilePart=0x0) returned 0x40
	[0117.380] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.380] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.381] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.381] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.382] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\Decrypt.txt", lpFilePart=0x0) returned 0x4b
	[0117.382] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0117.383] GetFileType (hFile=0x228) returned 0x1
	[0117.383] GetFileType (hFile=0x228) returned 0x1
	[0117.383] WriteFile (in: hFile=0x228, lpBuffer=0x279aa7c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x279aa7c*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0117.386] CloseHandle (hObject=0x228) returned 1
	[0117.387] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.387] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.387] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x3b
	[0117.388] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpFilePart=0x0) returned 0x3c
	[0117.388] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.388] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.389] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16e470d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16e470d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0117.390] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16e470d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16e470d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0117.390] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.390] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Decrypt.txt", lpFilePart=0x0) returned 0x47
	[0117.390] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\privacie\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.391] GetFileType (hFile=0x224) returned 0x1
	[0117.392] GetFileType (hFile=0x224) returned 0x1
	[0117.392] WriteFile (in: hFile=0x224, lpBuffer=0x279db98*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x279db98*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.398] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0117.398] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x39
	[0117.399] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpFilePart=0x0) returned 0x3a
	[0117.399] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.405] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.406] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1
	[0117.406] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x4f
	[0117.406] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpFilePart=0x0) returned 0x50
	[0117.407] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.408] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.409] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x14bb620, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1
	[0117.409] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x14bb620, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 0
	[0117.410] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.410] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x4f
	[0117.410] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\", lpFilePart=0x0) returned 0x50
	[0117.410] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.411] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.411] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x14bb620, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1
	[0117.412] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.412] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.412] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\Decrypt.txt", lpFilePart=0x0) returned 0x5b
	[0117.412] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0117.413] GetFileType (hFile=0x228) returned 0x1
	[0117.413] GetFileType (hFile=0x228) returned 0x1
	[0117.414] WriteFile (in: hFile=0x228, lpBuffer=0x27a2e60*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27a2e60*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0117.417] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1
	[0117.418] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x4c
	[0117.418] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpFilePart=0x0) returned 0x4d
	[0117.418] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.423] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.423] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1
	[0117.424] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc67cc5, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x3c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1
	[0117.425] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1
	[0117.425] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 0
	[0117.425] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.428] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x4c
	[0117.428] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\", lpFilePart=0x0) returned 0x4d
	[0117.428] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.431] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.431] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1
	[0117.432] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc67cc5, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x3c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1
	[0117.432] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1
	[0117.433] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.433] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.435] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\Decrypt.txt", lpFilePart=0x0) returned 0x58
	[0117.435] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0117.439] GetFileType (hFile=0x228) returned 0x1
	[0117.439] GetFileType (hFile=0x228) returned 0x1
	[0117.439] WriteFile (in: hFile=0x228, lpBuffer=0x27a86c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ec94, lpOverlapped=0x0 | out: lpBuffer=0x27a86c4*, lpNumberOfBytesWritten=0x26ec94*=0xa5, lpOverlapped=0x0) returned 1
	[0117.445] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.445] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0117.446] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.446] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x39
	[0117.446] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", lpFilePart=0x0) returned 0x3a
	[0117.446] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.447] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.447] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16e93390, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16e93390, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1
	[0117.448] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16eb94f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16eb94f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1
	[0117.448] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.449] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.449] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.449] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0117.450] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.451] GetFileType (hFile=0x224) returned 0x1
	[0117.451] GetFileType (hFile=0x224) returned 0x1
	[0117.451] WriteFile (in: hFile=0x224, lpBuffer=0x27abef8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27abef8*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.455] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0117.455] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x39
	[0117.455] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpFilePart=0x0) returned 0x3a
	[0117.456] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.462] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.462] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeca9f1ef, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1
	[0117.463] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c45a701, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1
	[0117.463] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xec18bec6, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0117.464] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63dece0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1
	[0117.465] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d802e42, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 1
	[0117.465] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1
	[0117.466] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0
	[0117.466] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.468] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x39
	[0117.468] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\", lpFilePart=0x0) returned 0x3a
	[0117.469] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.472] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.472] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeca9f1ef, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1
	[0117.473] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c45a701, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1
	[0117.473] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xec18bec6, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0117.474] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63dece0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1
	[0117.474] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d802e42, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 1
	[0117.475] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1
	[0117.475] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.475] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.478] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0117.478] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.482] GetFileType (hFile=0x224) returned 0x1
	[0117.482] GetFileType (hFile=0x224) returned 0x1
	[0117.482] WriteFile (in: hFile=0x224, lpBuffer=0x27b1e98*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x27b1e98*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.486] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0117.486] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x3d
	[0117.511] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x3e
	[0117.511] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.512] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.513] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x63dece0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.513] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1
	[0117.513] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x46
	[0117.513] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x47
	[0117.514] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.520] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.520] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1
	[0117.521] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x52
	[0117.521] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x53
	[0117.521] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0117.527] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.527] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1
	[0117.528] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x60
	[0117.528] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x61
	[0117.528] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0117.537] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.538] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0cd7f5, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0117.538] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aadace0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 1
	[0117.539] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a911c5d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1
	[0117.539] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b733f17, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1
	[0117.540] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9f649f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 1
	[0117.540] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9f649f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0
	[0117.541] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0117.543] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x60
	[0117.544] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\", lpFilePart=0x0) returned 0x61
	[0117.544] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0117.547] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.548] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0cd7f5, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0117.548] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aadace0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 1
	[0117.548] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a911c5d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1
	[0117.549] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b733f17, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1
	[0117.550] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9f649f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 1
	[0117.550] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.551] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0117.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0117.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0117.554] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt", lpFilePart=0x0) returned 0x6c
	[0117.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0117.554] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0117.558] GetFileType (hFile=0x230) returned 0x1
	[0117.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0117.559] GetFileType (hFile=0x230) returned 0x1
	[0117.559] WriteFile (in: hFile=0x230, lpBuffer=0x27bada0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x27bada0*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0117.562] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a53d8cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1
	[0117.562] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0117.563] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d655ee8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1
	[0117.563] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dcf29a8, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="Run.lnk", cAlternateFileName="")) returned 1
	[0117.564] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1
	[0117.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0117.565] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x5f
	[0117.565] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x60
	[0117.565] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0117.570] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.570] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddd71ea, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="computer.lnk", cAlternateFileName="")) returned 1
	[0117.571] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd8af29, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 1
	[0117.571] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec119aaf, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0117.571] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6392a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5db, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 1
	[0117.572] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3d87bb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 1
	[0117.572] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3d87bb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0
	[0117.573] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0117.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0117.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0117.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0117.575] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x26e704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x5f
	[0117.575] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", nBufferLength=0x105, lpBuffer=0x26e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\", lpFilePart=0x0) returned 0x60
	[0117.576] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x26e924 | out: lpFindFileData=0x26e924*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5db0
	[0117.578] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.578] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddd71ea, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="computer.lnk", cAlternateFileName="")) returned 1
	[0117.579] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd8af29, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 1
	[0117.579] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec119aaf, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0117.580] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6392a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5db, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 1
	[0117.580] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3d87bb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 1
	[0117.580] FindNextFileW (in: hFindFile=0x5f5db0, lpFindFileData=0x26e97c | out: lpFindFileData=0x26e97c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.580] FindClose (in: hFindFile=0x5f5db0 | out: hFindFile=0x5f5db0) returned 1
	[0117.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec04) returned 1
	[0117.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec10) returned 1
	[0117.583] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x6b
	[0117.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eabc) returned 1
	[0117.583] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x230
	[0117.586] GetFileType (hFile=0x230) returned 0x1
	[0117.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eab8) returned 1
	[0117.587] GetFileType (hFile=0x230) returned 0x1
	[0117.587] WriteFile (in: hFile=0x230, lpBuffer=0x27c2058*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26eb54, lpOverlapped=0x0 | out: lpBuffer=0x27c2058*, lpNumberOfBytesWritten=0x26eb54*=0xa5, lpOverlapped=0x0) returned 1
	[0117.590] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc80587, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0117.590] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc80587, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0
	[0117.591] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0117.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0117.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0117.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.591] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x52
	[0117.591] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\", lpFilePart=0x0) returned 0x53
	[0117.592] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0117.592] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.593] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x16fe9ff0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16fe9ff0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1
	[0117.593] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a53d8cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x0, dwReserved1=0x0, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1
	[0117.593] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0117.594] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d655ee8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1
	[0117.594] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dcf29a8, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="Run.lnk", cAlternateFileName="")) returned 1
	[0117.594] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x170362b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x170362b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1
	[0117.595] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc80587, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1
	[0117.595] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.595] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0117.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0117.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0117.596] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0117.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0117.596] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0117.598] GetFileType (hFile=0x22c) returned 0x1
	[0117.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0117.598] GetFileType (hFile=0x22c) returned 0x1
	[0117.598] WriteFile (in: hFile=0x22c, lpBuffer=0x27c7154*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x27c7154*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.601] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1
	[0117.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.601] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x5b
	[0117.601] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x5c
	[0117.602] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0117.602] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.603] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.603] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0117.604] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0117.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0117.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0117.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.604] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x5b
	[0117.604] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\", lpFilePart=0x0) returned 0x5c
	[0117.604] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0117.605] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.605] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.606] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.606] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0117.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0117.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0117.606] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt", lpFilePart=0x0) returned 0x67
	[0117.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0117.606] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0117.607] GetFileType (hFile=0x22c) returned 0x1
	[0117.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0117.608] GetFileType (hFile=0x22c) returned 0x1
	[0117.608] WriteFile (in: hFile=0x22c, lpBuffer=0x27cba58*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x27cba58*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.611] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.611] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1
	[0117.612] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6392a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1
	[0117.613] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1
	[0117.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.613] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x52
	[0117.613] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x53
	[0117.613] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0117.614] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.614] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec165d69, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0117.615] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd3ec69, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help.lnk", cAlternateFileName="")) returned 1
	[0117.615] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd3ec69, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help.lnk", cAlternateFileName="")) returned 0
	[0117.616] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0117.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0117.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0117.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.616] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x52
	[0117.616] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\", lpFilePart=0x0) returned 0x53
	[0117.616] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0117.617] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.617] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec165d69, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0117.617] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd3ec69, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help.lnk", cAlternateFileName="")) returned 1
	[0117.618] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.618] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0117.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0117.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0117.618] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt", lpFilePart=0x0) returned 0x5e
	[0117.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0117.619] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0117.619] GetFileType (hFile=0x22c) returned 0x1
	[0117.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0117.620] GetFileType (hFile=0x22c) returned 0x1
	[0117.620] WriteFile (in: hFile=0x22c, lpBuffer=0x27d0ce0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x27d0ce0*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.624] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1
	[0117.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.624] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x4e
	[0117.624] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x4f
	[0117.624] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0117.625] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.625] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.626] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0117.626] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0117.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0117.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0117.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.627] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x26e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x4e
	[0117.628] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x26e778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x4f
	[0117.628] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x26e9c4 | out: lpFindFileData=0x26e9c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d70
	[0117.628] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.629] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.629] FindNextFileW (in: hFindFile=0x5f5d70, lpFindFileData=0x26ea1c | out: lpFindFileData=0x26ea1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.629] FindClose (in: hFindFile=0x5f5d70 | out: hFindFile=0x5f5d70) returned 1
	[0117.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eca4) returned 1
	[0117.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecb0) returned 1
	[0117.630] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt", lpFilePart=0x0) returned 0x5a
	[0117.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb5c) returned 1
	[0117.630] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c
	[0117.631] GetFileType (hFile=0x22c) returned 0x1
	[0117.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb58) returned 1
	[0117.631] GetFileType (hFile=0x22c) returned 0x1
	[0117.632] WriteFile (in: hFile=0x22c, lpBuffer=0x27d520c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ebf4, lpOverlapped=0x0 | out: lpBuffer=0x27d520c*, lpNumberOfBytesWritten=0x26ebf4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.635] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.635] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.635] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x26e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x46
	[0117.635] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x26e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x47
	[0117.636] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x26ea64 | out: lpFindFileData=0x26ea64*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5d30
	[0117.636] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.636] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x170362b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x170362b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1
	[0117.637] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1705c410, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1705c410, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1
	[0117.637] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.637] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1
	[0117.637] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6392a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1
	[0117.638] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x17082570, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x17082570, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1
	[0117.638] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x170a86d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x170a86d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1
	[0117.638] FindNextFileW (in: hFindFile=0x5f5d30, lpFindFileData=0x26eabc | out: lpFindFileData=0x26eabc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x170a86d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x170a86d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 0
	[0117.638] FindClose (in: hFindFile=0x5f5d30 | out: hFindFile=0x5f5d30) returned 1
	[0117.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed44) returned 1
	[0117.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed50) returned 1
	[0117.638] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e708, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt", lpFilePart=0x0) returned 0x52
	[0117.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebfc) returned 1
	[0117.639] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228
	[0117.640] GetFileType (hFile=0x228) returned 0x1
	[0117.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ebf8) returned 1
	[0117.640] GetFileType (hFile=0x228) returned 0x1
	[0117.646] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.646] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.646] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x3d
	[0117.647] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\", lpFilePart=0x0) returned 0x3e
	[0117.647] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.647] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.647] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x63dece0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.647] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x170a86d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x170a86d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1
	[0117.647] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x170a86d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x170a86d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0
	[0117.648] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.648] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Decrypt.txt", lpFilePart=0x0) returned 0x49
	[0117.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.648] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.660] GetFileType (hFile=0x224) returned 0x1
	[0117.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0117.660] GetFileType (hFile=0x224) returned 0x1
	[0117.663] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0117.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.663] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x3c
	[0117.663] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x3d
	[0117.664] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.664] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.665] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.665] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.665] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x3c
	[0117.666] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\", lpFilePart=0x0) returned 0x3d
	[0117.666] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.666] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.666] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0117.666] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.667] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Decrypt.txt", lpFilePart=0x0) returned 0x48
	[0117.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.667] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\templates\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.668] GetFileType (hFile=0x224) returned 0x1
	[0117.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0117.668] GetFileType (hFile=0x224) returned 0x1
	[0117.671] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0117.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.671] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x39
	[0117.671] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x3a
	[0117.671] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.672] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.672] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff982e02, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x0, dwReserved1=0x0, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 1
	[0117.672] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff982e02, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x0, dwReserved1=0x0, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0
	[0117.672] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.673] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x26e8e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x39
	[0117.673] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", nBufferLength=0x105, lpBuffer=0x26e8b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\", lpFilePart=0x0) returned 0x3a
	[0117.673] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x26eb04 | out: lpFindFileData=0x26eb04*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cf0
	[0117.674] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.674] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff982e02, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x0, dwReserved1=0x0, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 1
	[0117.674] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x26e79c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x51
	[0117.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec90) returned 1
	[0117.674] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0117.676] GetFileType (hFile=0x228) returned 0x1
	[0117.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec8c) returned 1
	[0117.676] GetFileType (hFile=0x228) returned 0x1
	[0117.677] GetFileSize (in: hFile=0x228, lpFileSizeHigh=0x26ed98 | out: lpFileSizeHigh=0x26ed98*=0x0) returned 0x9b944
	[0117.747] ReadFile (in: hFile=0x228, lpBuffer=0x35d54d0, nNumberOfBytesToRead=0x9b944, lpNumberOfBytesRead=0x26ed44, lpOverlapped=0x0 | out: lpBuffer=0x35d54d0*, lpNumberOfBytesRead=0x26ed44*=0x9b944, lpOverlapped=0x0) returned 1
	[0117.789] CloseHandle (hObject=0x228) returned 1
	[0117.790] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.KEKW", lpFilePart=0x0) returned 0x56
	[0117.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc4) returned 1
	[0117.790] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.KEKW" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228
	[0117.792] GetFileType (hFile=0x228) returned 0x1
	[0117.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ecc0) returned 1
	[0117.792] GetFileType (hFile=0x228) returned 0x1
	[0117.793] WriteFile (in: hFile=0x228, lpBuffer=0x25deb94*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26ece8, lpOverlapped=0x0 | out: lpBuffer=0x25deb94*, lpNumberOfBytesWritten=0x26ece8*=0x10, lpOverlapped=0x0) returned 1
	[0117.796] CloseHandle (hObject=0x228) returned 1
	[0117.796] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x26e8bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x51
	[0117.796] DeleteFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 1
	[0117.816] FindNextFileW (in: hFindFile=0x5f5cf0, lpFindFileData=0x26eb5c | out: lpFindFileData=0x26eb5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.816] FindClose (in: hFindFile=0x5f5cf0 | out: hFindFile=0x5f5cf0) returned 1
	[0117.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ede4) returned 1
	[0117.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edf0) returned 1
	[0117.817] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e7a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\Decrypt.txt", lpFilePart=0x0) returned 0x45
	[0117.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec9c) returned 1
	[0117.817] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x224
	[0117.818] GetFileType (hFile=0x224) returned 0x1
	[0117.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ec98) returned 1
	[0117.818] GetFileType (hFile=0x224) returned 0x1
	[0117.818] WriteFile (in: hFile=0x224, lpBuffer=0x25e12c4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ed34, lpOverlapped=0x0 | out: lpBuffer=0x25e12c4*, lpNumberOfBytesWritten=0x26ed34*=0xa5, lpOverlapped=0x0) returned 1
	[0117.821] CloseHandle (hObject=0x224) returned 1
	[0117.822] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.822] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0117.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0117.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0117.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0117.823] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x26e984, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x32
	[0117.823] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x26e958, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x33
	[0117.823] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x26eba4 | out: lpFindFileData=0x26eba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5cb0
	[0117.824] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.824] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x16cca310, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16cca310, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0117.825] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16cf0470, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16cf0470, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1
	[0117.825] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16d889f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16d889f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1
	[0117.826] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16dfae10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16dfae10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1
	[0117.826] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x16dfae10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16dfae10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1
	[0117.827] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x16e20f70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16e20f70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1
	[0117.828] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16e470d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16e470d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1
	[0117.828] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x16edf650, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16edf650, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0117.829] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x16f2b910, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16f2b910, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0117.830] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x170f4990, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x170f4990, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0117.830] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x170f4990, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x170f4990, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0117.831] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x17271750, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x17271750, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0117.832] FindNextFileW (in: hFindFile=0x5f5cb0, lpFindFileData=0x26ebfc | out: lpFindFileData=0x26ebfc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x17271750, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x17271750, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0
	[0117.832] FindClose (in: hFindFile=0x5f5cb0 | out: hFindFile=0x5f5cb0) returned 1
	[0117.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee84) returned 1
	[0117.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee90) returned 1
	[0117.833] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Decrypt.txt", lpFilePart=0x0) returned 0x3e
	[0117.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed3c) returned 1
	[0117.833] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x220
	[0117.834] GetFileType (hFile=0x220) returned 0x1
	[0117.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ed38) returned 1
	[0117.834] GetFileType (hFile=0x220) returned 0x1
	[0117.834] WriteFile (in: hFile=0x220, lpBuffer=0x25e51e8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26edd4, lpOverlapped=0x0 | out: lpBuffer=0x25e51e8*, lpNumberOfBytesWritten=0x26edd4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.837] CloseHandle (hObject=0x220) returned 1
	[0117.837] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.838] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0117.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0117.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0117.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0117.838] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x26ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2a
	[0117.838] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x26e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x2b
	[0117.839] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x26ec44 | out: lpFindFileData=0x26ec44*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c70
	[0117.839] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.840] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16a8ee70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16a8ee70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0117.840] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16ab4fd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16ab4fd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1
	[0117.841] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x16b99810, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16b99810, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0117.841] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16be5ad0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16be5ad0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1
	[0117.842] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16c7e050, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16c7e050, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1
	[0117.842] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x172978b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x172978b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0117.843] FindNextFileW (in: hFindFile=0x5f5c70, lpFindFileData=0x26ec9c | out: lpFindFileData=0x26ec9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x172978b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x172978b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0
	[0117.843] FindClose (in: hFindFile=0x5f5c70 | out: hFindFile=0x5f5c70) returned 1
	[0117.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef24) returned 1
	[0117.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef30) returned 1
	[0117.844] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Decrypt.txt", lpFilePart=0x0) returned 0x36
	[0117.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eddc) returned 1
	[0117.844] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x208
	[0117.845] GetFileType (hFile=0x208) returned 0x1
	[0117.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26edd8) returned 1
	[0117.845] GetFileType (hFile=0x208) returned 0x1
	[0117.845] WriteFile (in: hFile=0x208, lpBuffer=0x25e8758*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ee74, lpOverlapped=0x0 | out: lpBuffer=0x25e8758*, lpNumberOfBytesWritten=0x26ee74*=0xa5, lpOverlapped=0x0) returned 1
	[0117.848] CloseHandle (hObject=0x208) returned 1
	[0117.848] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.849] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0117.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0117.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0117.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0117.849] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming", lpFilePart=0x0) returned 0x20
	[0117.849] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x21
	[0117.849] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0117.850] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.850] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16a68d10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16a68d10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1
	[0117.851] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x172978b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x172978b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0117.851] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x172978b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x172978b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0
	[0117.852] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0117.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0117.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0117.852] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0117.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0117.853] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\roaming\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0117.854] GetFileType (hFile=0x204) returned 0x1
	[0117.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0117.854] GetFileType (hFile=0x204) returned 0x1
	[0117.854] WriteFile (in: hFile=0x204, lpBuffer=0x25eb680*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x25eb680*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0117.857] CloseHandle (hObject=0x204) returned 1
	[0117.857] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.858] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0117.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0117.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0117.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0117.858] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData", lpFilePart=0x0) returned 0x18
	[0117.858] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\", lpFilePart=0x0) returned 0x19
	[0117.859] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0117.859] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.860] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x169844d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x169844d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0117.860] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x16a1ca50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x16a1ca50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1
	[0117.861] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x172bda10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x172bda10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1
	[0117.861] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x172bda10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x172bda10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0
	[0117.862] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0117.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0117.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0117.862] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0117.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0117.862] CreateFileW (lpFileName="C:\\Users\\Default\\AppData\\Decrypt.txt" (normalized: "c:\\users\\default\\appdata\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0117.863] GetFileType (hFile=0x200) returned 0x1
	[0117.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0117.863] GetFileType (hFile=0x200) returned 0x1
	[0117.864] WriteFile (in: hFile=0x200, lpBuffer=0x25ee4c0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25ee4c0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.867] CloseHandle (hObject=0x200) returned 1
	[0117.868] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0117.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0117.868] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Application Data", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Application Data", lpFilePart=0x0) returned 0x21
	[0117.868] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Application Data\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Application Data\\", lpFilePart=0x0) returned 0x22
	[0117.868] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0117.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0117.872] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1
	[0117.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0117.873] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Contacts", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Contacts", lpFilePart=0x0) returned 0x19
	[0117.873] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Contacts\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Contacts\\", lpFilePart=0x0) returned 0x1a
	[0117.873] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Contacts\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0117.874] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.875] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1
	[0117.875] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.876] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0117.876] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0117.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0117.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0117.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0117.877] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Contacts", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Contacts", lpFilePart=0x0) returned 0x19
	[0117.877] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Contacts\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Contacts\\", lpFilePart=0x0) returned 0x1a
	[0117.877] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Contacts\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0117.878] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.878] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1
	[0117.879] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.880] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.880] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0117.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0117.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0117.881] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Contacts\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Contacts\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0117.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0117.881] CreateFileW (lpFileName="C:\\Users\\Default\\Contacts\\Decrypt.txt" (normalized: "c:\\users\\default\\contacts\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0117.882] GetFileType (hFile=0x200) returned 0x1
	[0117.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0117.882] GetFileType (hFile=0x200) returned 0x1
	[0117.882] WriteFile (in: hFile=0x200, lpBuffer=0x25f27d8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25f27d8*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.885] CloseHandle (hObject=0x200) returned 1
	[0117.885] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0117.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0117.886] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Cookies", lpFilePart=0x0) returned 0x18
	[0117.886] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Cookies\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Cookies\\", lpFilePart=0x0) returned 0x19
	[0117.886] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0117.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0117.890] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0117.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0117.890] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Desktop", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop", lpFilePart=0x0) returned 0x18
	[0117.890] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Desktop\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop\\", lpFilePart=0x0) returned 0x19
	[0117.890] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0117.891] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.893] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.894] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0117.895] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0117.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0117.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0117.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0117.897] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Desktop", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop", lpFilePart=0x0) returned 0x18
	[0117.897] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Desktop\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop\\", lpFilePart=0x0) returned 0x19
	[0117.897] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0117.897] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.898] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.899] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.899] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0117.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0117.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0117.899] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Desktop\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0117.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0117.900] CreateFileW (lpFileName="C:\\Users\\Default\\Desktop\\Decrypt.txt" (normalized: "c:\\users\\default\\desktop\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0117.900] GetFileType (hFile=0x200) returned 0x1
	[0117.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0117.901] GetFileType (hFile=0x200) returned 0x1
	[0117.901] WriteFile (in: hFile=0x200, lpBuffer=0x25f6578*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25f6578*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.904] CloseHandle (hObject=0x200) returned 1
	[0117.905] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0117.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0117.905] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents", lpFilePart=0x0) returned 0x1a
	[0117.905] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\", lpFilePart=0x0) returned 0x1b
	[0117.905] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0117.915] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.916] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.916] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0117.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0117.917] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Music", lpFilePart=0x0) returned 0x23
	[0117.917] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Music\\", lpFilePart=0x0) returned 0x24
	[0117.917] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0117.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef80) returned 1
	[0117.921] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0117.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0117.922] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Pictures", lpFilePart=0x0) returned 0x26
	[0117.922] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x27
	[0117.922] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0117.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef80) returned 1
	[0117.926] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0117.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0117.927] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Videos", lpFilePart=0x0) returned 0x24
	[0117.927] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x25
	[0117.927] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0117.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef80) returned 1
	[0117.931] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0117.931] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0117.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0117.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0117.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0117.934] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents", lpFilePart=0x0) returned 0x1a
	[0117.934] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\", lpFilePart=0x0) returned 0x1b
	[0117.935] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0117.937] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.938] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0117.938] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0117.940] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0117.940] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0117.941] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0
	[0117.941] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0117.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0117.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0117.944] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0117.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0117.944] CreateFileW (lpFileName="C:\\Users\\Default\\Documents\\Decrypt.txt" (normalized: "c:\\users\\default\\documents\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0117.948] GetFileType (hFile=0x200) returned 0x1
	[0117.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0117.948] GetFileType (hFile=0x200) returned 0x1
	[0117.948] WriteFile (in: hFile=0x200, lpBuffer=0x25fbaf4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25fbaf4*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0117.951] CloseHandle (hObject=0x200) returned 1
	[0117.951] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0117.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0117.952] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Downloads", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads", lpFilePart=0x0) returned 0x1a
	[0117.952] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Downloads\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads\\", lpFilePart=0x0) returned 0x1b
	[0117.952] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0117.953] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0117.954] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.045] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0118.045] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.046] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Downloads", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads", lpFilePart=0x0) returned 0x1a
	[0118.046] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Downloads\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads\\", lpFilePart=0x0) returned 0x1b
	[0118.046] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.047] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.047] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.048] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.048] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.049] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Downloads\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0118.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.049] CreateFileW (lpFileName="C:\\Users\\Default\\Downloads\\Decrypt.txt" (normalized: "c:\\users\\default\\downloads\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.050] GetFileType (hFile=0x200) returned 0x1
	[0118.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.051] GetFileType (hFile=0x200) returned 0x1
	[0118.051] WriteFile (in: hFile=0x200, lpBuffer=0x25ff13c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25ff13c*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.055] CloseHandle (hObject=0x200) returned 1
	[0118.055] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0118.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.056] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites", lpFilePart=0x0) returned 0x1a
	[0118.056] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\", lpFilePart=0x0) returned 0x1b
	[0118.057] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.067] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.067] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.068] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0118.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.068] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Links", lpFilePart=0x0) returned 0x20
	[0118.069] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Links\\", lpFilePart=0x0) returned 0x21
	[0118.069] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0118.070] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.070] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.071] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1
	[0118.071] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0
	[0118.072] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0118.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0118.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0118.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.072] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Links", lpFilePart=0x0) returned 0x20
	[0118.072] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Links\\", lpFilePart=0x0) returned 0x21
	[0118.073] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0118.073] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.074] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.074] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1
	[0118.074] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.075] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0118.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0118.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0118.075] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Links\\Decrypt.txt", lpFilePart=0x0) returned 0x2c
	[0118.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0118.076] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Decrypt.txt" (normalized: "c:\\users\\default\\favorites\\links\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0118.077] GetFileType (hFile=0x204) returned 0x1
	[0118.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0118.077] GetFileType (hFile=0x204) returned 0x1
	[0118.077] WriteFile (in: hFile=0x204, lpBuffer=0x26035c8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x26035c8*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0118.080] CloseHandle (hObject=0x204) returned 1
	[0118.080] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1
	[0118.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.081] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x2d
	[0118.081] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x2e
	[0118.081] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0118.089] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.090] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1
	[0118.090] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1
	[0118.091] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1
	[0118.092] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1
	[0118.092] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1
	[0118.093] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0
	[0118.093] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0118.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0118.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0118.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.096] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x2d
	[0118.097] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x2e
	[0118.097] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0118.100] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.100] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1
	[0118.101] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1
	[0118.101] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1
	[0118.101] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1
	[0118.102] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1
	[0118.102] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.103] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0118.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0118.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0118.105] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Decrypt.txt", lpFilePart=0x0) returned 0x39
	[0118.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0118.106] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Decrypt.txt" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0118.109] GetFileType (hFile=0x204) returned 0x1
	[0118.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0118.110] GetFileType (hFile=0x204) returned 0x1
	[0118.110] WriteFile (in: hFile=0x204, lpBuffer=0x2608898*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2608898*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0118.113] CloseHandle (hObject=0x204) returned 1
	[0118.113] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1
	[0118.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.114] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x27
	[0118.114] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x28
	[0118.114] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0118.126] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.126] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1
	[0118.128] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1
	[0118.128] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1
	[0118.129] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1
	[0118.129] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1
	[0118.130] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1
	[0118.130] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0
	[0118.131] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0118.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0118.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0118.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.133] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x27
	[0118.133] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x28
	[0118.134] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0118.136] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.137] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1
	[0118.137] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1
	[0118.138] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1
	[0118.138] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1
	[0118.139] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1
	[0118.139] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1
	[0118.139] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.140] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0118.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0118.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0118.142] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\MSN Websites\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0118.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0118.143] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\Decrypt.txt" (normalized: "c:\\users\\default\\favorites\\msn websites\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0118.146] GetFileType (hFile=0x204) returned 0x1
	[0118.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0118.146] GetFileType (hFile=0x204) returned 0x1
	[0118.147] WriteFile (in: hFile=0x204, lpBuffer=0x260d9bc*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x260d9bc*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0118.150] CloseHandle (hObject=0x204) returned 1
	[0118.150] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1
	[0118.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.151] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x27
	[0118.151] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Windows Live\\", lpFilePart=0x0) returned 0x28
	[0118.151] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0118.165] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.166] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1
	[0118.166] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1
	[0118.167] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1
	[0118.167] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1
	[0118.168] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0
	[0118.168] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0118.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0118.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0118.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.172] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x27
	[0118.172] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Windows Live\\", lpFilePart=0x0) returned 0x28
	[0118.172] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0118.175] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.176] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1
	[0118.176] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1
	[0118.176] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1
	[0118.177] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1
	[0118.178] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.178] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0118.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0118.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0118.181] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Windows Live\\Decrypt.txt", lpFilePart=0x0) returned 0x33
	[0118.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0118.181] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Decrypt.txt" (normalized: "c:\\users\\default\\favorites\\windows live\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0118.185] GetFileType (hFile=0x204) returned 0x1
	[0118.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0118.185] GetFileType (hFile=0x204) returned 0x1
	[0118.185] WriteFile (in: hFile=0x204, lpBuffer=0x2612480*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x2612480*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0118.189] CloseHandle (hObject=0x204) returned 1
	[0118.189] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.190] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.190] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites", lpFilePart=0x0) returned 0x1a
	[0118.191] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\", lpFilePart=0x0) returned 0x1b
	[0118.191] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.191] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.192] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.192] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x174d2d50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x174d2d50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0118.193] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1751f010, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1751f010, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1
	[0118.194] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x17591430, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x17591430, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1
	[0118.194] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x175dd6f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x175dd6f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1
	[0118.195] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x175dd6f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x175dd6f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0
	[0118.195] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.196] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites\\Decrypt.txt", lpFilePart=0x0) returned 0x26
	[0118.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.196] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Decrypt.txt" (normalized: "c:\\users\\default\\favorites\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.197] GetFileType (hFile=0x200) returned 0x1
	[0118.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.197] GetFileType (hFile=0x200) returned 0x1
	[0118.197] WriteFile (in: hFile=0x200, lpBuffer=0x261575c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x261575c*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.200] CloseHandle (hObject=0x200) returned 1
	[0118.200] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0118.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.201] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Links", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links", lpFilePart=0x0) returned 0x16
	[0118.201] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Links\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\", lpFilePart=0x0) returned 0x17
	[0118.201] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.207] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.207] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.208] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1
	[0118.208] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1
	[0118.209] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1
	[0118.209] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0
	[0118.210] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.213] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Links", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links", lpFilePart=0x0) returned 0x16
	[0118.213] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Links\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\", lpFilePart=0x0) returned 0x17
	[0118.213] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.216] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.217] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.217] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1
	[0118.218] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1
	[0118.218] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1
	[0118.219] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.219] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.223] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Links\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0118.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.223] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Decrypt.txt" (normalized: "c:\\users\\default\\links\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.226] GetFileType (hFile=0x200) returned 0x1
	[0118.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.227] GetFileType (hFile=0x200) returned 0x1
	[0118.227] WriteFile (in: hFile=0x200, lpBuffer=0x2619718*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2619718*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.230] CloseHandle (hObject=0x200) returned 1
	[0118.230] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1
	[0118.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.231] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Local Settings", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Local Settings", lpFilePart=0x0) returned 0x1f
	[0118.231] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Local Settings\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Local Settings\\", lpFilePart=0x0) returned 0x20
	[0118.231] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0118.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0118.235] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0118.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.236] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music", lpFilePart=0x0) returned 0x16
	[0118.236] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music\\", lpFilePart=0x0) returned 0x17
	[0118.236] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.237] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.238] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.238] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0118.239] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.239] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music", lpFilePart=0x0) returned 0x16
	[0118.239] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music\\", lpFilePart=0x0) returned 0x17
	[0118.240] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.240] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.241] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.241] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.241] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.242] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0118.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.242] CreateFileW (lpFileName="C:\\Users\\Default\\Music\\Decrypt.txt" (normalized: "c:\\users\\default\\music\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.243] GetFileType (hFile=0x200) returned 0x1
	[0118.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.243] GetFileType (hFile=0x200) returned 0x1
	[0118.244] WriteFile (in: hFile=0x200, lpBuffer=0x261d4e8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x261d4e8*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.246] CloseHandle (hObject=0x200) returned 1
	[0118.247] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1
	[0118.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.247] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\My Documents", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\My Documents", lpFilePart=0x0) returned 0x1d
	[0118.247] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\My Documents\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\My Documents\\", lpFilePart=0x0) returned 0x1e
	[0118.248] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0118.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0118.251] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1
	[0118.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.253] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NetHood", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NetHood", lpFilePart=0x0) returned 0x18
	[0118.253] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NetHood\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NetHood\\", lpFilePart=0x0) returned 0x19
	[0118.253] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0118.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0118.257] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1
	[0118.257] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1
	[0118.258] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x674ac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1
	[0118.259] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1
	[0118.259] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1
	[0118.260] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1
	[0118.260] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1
	[0118.261] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1
	[0118.261] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0118.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.262] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures", lpFilePart=0x0) returned 0x19
	[0118.262] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\", lpFilePart=0x0) returned 0x1a
	[0118.262] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.263] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.264] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.264] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0118.265] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.265] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures", lpFilePart=0x0) returned 0x19
	[0118.265] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\", lpFilePart=0x0) returned 0x1a
	[0118.266] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.266] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.267] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.267] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.267] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.268] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0118.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.268] CreateFileW (lpFileName="C:\\Users\\Default\\Pictures\\Decrypt.txt" (normalized: "c:\\users\\default\\pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.269] GetFileType (hFile=0x200) returned 0x1
	[0118.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.269] GetFileType (hFile=0x200) returned 0x1
	[0118.270] WriteFile (in: hFile=0x200, lpBuffer=0x2622784*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2622784*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.272] CloseHandle (hObject=0x200) returned 1
	[0118.273] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1
	[0118.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.273] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\PrintHood", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\PrintHood", lpFilePart=0x0) returned 0x1a
	[0118.273] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\PrintHood\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\PrintHood\\", lpFilePart=0x0) returned 0x1b
	[0118.273] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0118.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0118.277] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0118.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.278] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent", lpFilePart=0x0) returned 0x17
	[0118.278] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent\\", lpFilePart=0x0) returned 0x18
	[0118.278] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0118.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0118.282] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1
	[0118.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.283] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games", lpFilePart=0x0) returned 0x1c
	[0118.283] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games\\", lpFilePart=0x0) returned 0x1d
	[0118.283] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.284] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.285] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.285] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0118.285] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.286] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games", lpFilePart=0x0) returned 0x1c
	[0118.286] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games\\", lpFilePart=0x0) returned 0x1d
	[0118.286] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.287] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.287] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.288] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.288] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.288] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games\\Decrypt.txt", lpFilePart=0x0) returned 0x28
	[0118.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.289] CreateFileW (lpFileName="C:\\Users\\Default\\Saved Games\\Decrypt.txt" (normalized: "c:\\users\\default\\saved games\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.290] GetFileType (hFile=0x200) returned 0x1
	[0118.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.290] GetFileType (hFile=0x200) returned 0x1
	[0118.290] WriteFile (in: hFile=0x200, lpBuffer=0x2626eb0*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2626eb0*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.294] CloseHandle (hObject=0x200) returned 1
	[0118.294] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1
	[0118.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.295] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Searches", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches", lpFilePart=0x0) returned 0x19
	[0118.295] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Searches\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches\\", lpFilePart=0x0) returned 0x1a
	[0118.295] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.300] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.301] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.301] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1
	[0118.302] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1
	[0118.303] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0
	[0118.303] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.306] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Searches", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches", lpFilePart=0x0) returned 0x19
	[0118.306] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Searches\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches\\", lpFilePart=0x0) returned 0x1a
	[0118.306] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.309] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.309] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.310] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1
	[0118.310] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1
	[0118.311] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.311] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.315] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Searches\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Searches\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0118.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.315] CreateFileW (lpFileName="C:\\Users\\Default\\Searches\\Decrypt.txt" (normalized: "c:\\users\\default\\searches\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.319] GetFileType (hFile=0x200) returned 0x1
	[0118.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.319] GetFileType (hFile=0x200) returned 0x1
	[0118.319] WriteFile (in: hFile=0x200, lpBuffer=0x262adc8*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x262adc8*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.322] CloseHandle (hObject=0x200) returned 1
	[0118.323] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0118.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.323] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\SendTo", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\SendTo", lpFilePart=0x0) returned 0x17
	[0118.323] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\SendTo\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\SendTo\\", lpFilePart=0x0) returned 0x18
	[0118.323] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0118.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0118.327] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0118.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.328] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Start Menu", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Start Menu", lpFilePart=0x0) returned 0x1b
	[0118.328] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Start Menu\\", lpFilePart=0x0) returned 0x1c
	[0118.328] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0118.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0118.332] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0118.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.332] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Templates", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Templates", lpFilePart=0x0) returned 0x1a
	[0118.333] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Templates\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Templates\\", lpFilePart=0x0) returned 0x1b
	[0118.333] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0118.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f020) returned 1
	[0118.337] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0118.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.337] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos", lpFilePart=0x0) returned 0x17
	[0118.337] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\", lpFilePart=0x0) returned 0x18
	[0118.338] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.339] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.339] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.340] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0118.340] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.341] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos", lpFilePart=0x0) returned 0x17
	[0118.341] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\", lpFilePart=0x0) returned 0x18
	[0118.341] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.342] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.342] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.343] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.343] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.344] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos\\Decrypt.txt", lpFilePart=0x0) returned 0x23
	[0118.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.344] CreateFileW (lpFileName="C:\\Users\\Default\\Videos\\Decrypt.txt" (normalized: "c:\\users\\default\\videos\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.345] GetFileType (hFile=0x200) returned 0x1
	[0118.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.345] GetFileType (hFile=0x200) returned 0x1
	[0118.346] WriteFile (in: hFile=0x200, lpBuffer=0x262fba4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x262fba4*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.348] CloseHandle (hObject=0x200) returned 1
	[0118.349] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.349] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0118.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0118.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0118.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0118.349] GetFullPathNameW (in: lpFileName="C:\\Users\\Default", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default", lpFilePart=0x0) returned 0x10
	[0118.350] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\", lpFilePart=0x0) returned 0x11
	[0118.350] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0118.350] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.351] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x172bda10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x172bda10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0118.351] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0118.352] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x17309cd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x17309cd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1
	[0118.352] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0118.353] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1732fe30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1732fe30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0118.354] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x173a2250, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x173a2250, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0118.354] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x174acbf0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x174acbf0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0118.355] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x17603850, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x17603850, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0118.355] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1764fb10, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1764fb10, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1
	[0118.356] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1
	[0118.356] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x17675c70, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x17675c70, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0118.356] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1
	[0118.357] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1
	[0118.357] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1
	[0118.358] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT", nBufferLength=0x105, lpBuffer=0x26eabc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT", lpFilePart=0x0) returned 0x1b
	[0118.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb0) returned 1
	[0118.358] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x200
	[0118.359] GetFileType (hFile=0x200) returned 0x1
	[0118.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efac) returned 1
	[0118.359] GetFileType (hFile=0x200) returned 0x1
	[0118.359] GetFileSize (in: hFile=0x200, lpFileSizeHigh=0x26f0b8 | out: lpFileSizeHigh=0x26f0b8*=0x0) returned 0xc0000
	[0118.365] ReadFile (in: hFile=0x200, lpBuffer=0x3670e30, nNumberOfBytesToRead=0xc0000, lpNumberOfBytesRead=0x26f064, lpOverlapped=0x0 | out: lpBuffer=0x3670e30*, lpNumberOfBytesRead=0x26f064*=0xc0000, lpOverlapped=0x0) returned 1
	[0118.409] CloseHandle (hObject=0x200) returned 1
	[0118.409] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.KEKW", nBufferLength=0x105, lpBuffer=0x26eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT.KEKW", lpFilePart=0x0) returned 0x20
	[0118.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efe4) returned 1
	[0118.409] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.KEKW" (normalized: "c:\\users\\default\\ntuser.dat.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x200
	[0118.411] GetFileType (hFile=0x200) returned 0x1
	[0118.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efe0) returned 1
	[0118.411] GetFileType (hFile=0x200) returned 0x1
	[0118.411] WriteFile (in: hFile=0x200, lpBuffer=0x26333e4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26f008, lpOverlapped=0x0 | out: lpBuffer=0x26333e4*, lpNumberOfBytesWritten=0x26f008*=0x10, lpOverlapped=0x0) returned 1
	[0118.414] CloseHandle (hObject=0x200) returned 1
	[0118.414] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT", nBufferLength=0x105, lpBuffer=0x26ebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NTUSER.DAT", lpFilePart=0x0) returned 0x1b
	[0118.415] DeleteFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat")) returned 1
	[0118.435] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1
	[0118.436] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x674ac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1
	[0118.436] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1
	[0118.436] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1
	[0118.437] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1
	[0118.437] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1
	[0118.438] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1
	[0118.438] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x176c1f30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x176c1f30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0118.438] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1
	[0118.439] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1
	[0118.439] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x176e8090, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x176e8090, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1
	[0118.441] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x17734350, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x17734350, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1
	[0118.441] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1
	[0118.442] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1
	[0118.442] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0118.443] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1775a4b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1775a4b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0118.444] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1775a4b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1775a4b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0
	[0118.444] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0118.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0118.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0118.444] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Decrypt.txt", lpFilePart=0x0) returned 0x1c
	[0118.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.445] CreateFileW (lpFileName="C:\\Users\\Default\\Decrypt.txt" (normalized: "c:\\users\\default\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0118.446] GetFileType (hFile=0x1fc) returned 0x1
	[0118.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0118.446] GetFileType (hFile=0x1fc) returned 0x1
	[0118.446] WriteFile (in: hFile=0x1fc, lpBuffer=0x2637b10*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x2637b10*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0118.449] CloseHandle (hObject=0x1fc) returned 1
	[0118.450] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1
	[0118.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0118.450] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User", lpFilePart=0x0) returned 0x15
	[0118.450] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User\\", lpFilePart=0x0) returned 0x16
	[0118.451] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0118.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0c0) returned 1
	[0118.455] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.455] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1
	[0118.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0118.456] GetFullPathNameW (in: lpFileName="C:\\Users\\Public", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf
	[0118.456] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\", lpFilePart=0x0) returned 0x10
	[0118.456] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0118.457] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.457] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0118.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.458] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17
	[0118.458] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\", lpFilePart=0x0) returned 0x18
	[0118.458] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.459] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.460] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x7e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1
	[0118.460] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.461] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1
	[0118.461] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1
	[0118.462] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0
	[0118.462] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.463] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17
	[0118.463] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\", lpFilePart=0x0) returned 0x18
	[0118.463] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.464] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.465] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x7e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1
	[0118.465] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.465] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1
	[0118.466] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1
	[0118.466] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.467] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.467] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop\\Decrypt.txt", lpFilePart=0x0) returned 0x23
	[0118.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.467] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Decrypt.txt" (normalized: "c:\\users\\public\\desktop\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.471] GetFileType (hFile=0x200) returned 0x1
	[0118.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.471] GetFileType (hFile=0x200) returned 0x1
	[0118.471] WriteFile (in: hFile=0x200, lpBuffer=0x263ca40*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x263ca40*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.474] CloseHandle (hObject=0x200) returned 1
	[0118.475] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.476] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0118.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.476] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19
	[0118.477] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\", lpFilePart=0x0) returned 0x1a
	[0118.477] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.478] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.478] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.479] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0118.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.479] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music", lpFilePart=0x0) returned 0x22
	[0118.479] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music\\", lpFilePart=0x0) returned 0x23
	[0118.480] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0118.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef80) returned 1
	[0118.483] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0118.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.484] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25
	[0118.484] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x26
	[0118.484] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0118.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef80) returned 1
	[0118.489] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0118.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.489] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos", lpFilePart=0x0) returned 0x23
	[0118.489] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x24
	[0118.489] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
	[0118.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef80) returned 1
	[0118.493] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.493] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.494] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19
	[0118.494] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\", lpFilePart=0x0) returned 0x1a
	[0118.494] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.495] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.495] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.496] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
	[0118.496] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
	[0118.497] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
	[0118.498] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0
	[0118.498] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.499] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0118.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.499] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\Decrypt.txt" (normalized: "c:\\users\\public\\documents\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.616] GetFileType (hFile=0x200) returned 0x1
	[0118.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.616] GetFileType (hFile=0x200) returned 0x1
	[0118.616] WriteFile (in: hFile=0x200, lpBuffer=0x2641fa4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2641fa4*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.619] CloseHandle (hObject=0x200) returned 1
	[0118.620] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0118.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.620] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19
	[0118.621] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads\\", lpFilePart=0x0) returned 0x1a
	[0118.621] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.622] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.622] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.623] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0118.623] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.624] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19
	[0118.624] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads\\", lpFilePart=0x0) returned 0x1a
	[0118.624] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.624] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.630] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.631] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.632] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.632] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0118.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.632] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\Decrypt.txt" (normalized: "c:\\users\\public\\downloads\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.633] GetFileType (hFile=0x200) returned 0x1
	[0118.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.634] GetFileType (hFile=0x200) returned 0x1
	[0118.634] WriteFile (in: hFile=0x200, lpBuffer=0x264557c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x264557c*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.637] CloseHandle (hObject=0x200) returned 1
	[0118.637] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0118.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.637] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites", lpFilePart=0x0) returned 0x19
	[0118.637] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites\\", lpFilePart=0x0) returned 0x1a
	[0118.638] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Favorites\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.639] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.639] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0118.639] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.640] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites", lpFilePart=0x0) returned 0x19
	[0118.640] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites\\", lpFilePart=0x0) returned 0x1a
	[0118.640] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Favorites\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.641] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.642] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0118.642] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.642] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Favorites\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Favorites\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0118.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.643] CreateFileW (lpFileName="C:\\Users\\Public\\Favorites\\Decrypt.txt" (normalized: "c:\\users\\public\\favorites\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.644] GetFileType (hFile=0x200) returned 0x1
	[0118.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.644] GetFileType (hFile=0x200) returned 0x1
	[0118.644] WriteFile (in: hFile=0x200, lpBuffer=0x2648810*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x2648810*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.647] CloseHandle (hObject=0x200) returned 1
	[0118.648] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1
	[0118.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.648] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries", lpFilePart=0x0) returned 0x19
	[0118.648] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\", lpFilePart=0x0) returned 0x1a
	[0118.649] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.649] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.650] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2839e1d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2839e1d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288f9359, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x58, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.651] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1
	[0118.651] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0
	[0118.652] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.652] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries", lpFilePart=0x0) returned 0x19
	[0118.652] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\", lpFilePart=0x0) returned 0x1a
	[0118.652] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.653] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.653] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2839e1d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2839e1d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288f9359, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x58, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.654] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1
	[0118.654] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0118.655] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0118.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0118.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0118.655] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries\\Decrypt.txt", lpFilePart=0x0) returned 0x25
	[0118.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0118.655] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\Decrypt.txt" (normalized: "c:\\users\\public\\libraries\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0118.661] GetFileType (hFile=0x200) returned 0x1
	[0118.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0118.662] GetFileType (hFile=0x200) returned 0x1
	[0118.662] WriteFile (in: hFile=0x200, lpBuffer=0x264c284*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x264c284*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0118.665] CloseHandle (hObject=0x200) returned 1
	[0118.665] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0118.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0118.666] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15
	[0118.666] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\", lpFilePart=0x0) returned 0x16
	[0118.666] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0118.667] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.668] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.668] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1
	[0118.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.669] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music", lpFilePart=0x0) returned 0x22
	[0118.669] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\", lpFilePart=0x0) returned 0x23
	[0118.669] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0118.679] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.679] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.680] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kalimba.mp3", cAlternateFileName="")) returned 1
	[0118.680] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be5ebf7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maid with the Flaxen Hair.mp3", cAlternateFileName="MAIDWI~1.MP3")) returned 1
	[0118.681] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 1
	[0118.681] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 0
	[0118.682] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0118.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0118.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0118.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0118.684] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music", lpFilePart=0x0) returned 0x22
	[0118.684] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\", lpFilePart=0x0) returned 0x23
	[0118.685] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0118.688] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0118.689] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0118.689] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kalimba.mp3", cAlternateFileName="")) returned 1
	[0118.689] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", lpFilePart=0x0) returned 0x2e
	[0118.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0118.690] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0118.694] GetFileType (hFile=0x208) returned 0x1
	[0118.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0118.694] GetFileType (hFile=0x208) returned 0x1
	[0118.694] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x8064f1
	[0118.810] ReadFile (in: hFile=0x208, lpBuffer=0x3730e50, nNumberOfBytesToRead=0x8064f1, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x3730e50*, lpNumberOfBytesRead=0x26ef24*=0x8064f1, lpOverlapped=0x0) returned 1
	[0119.637] CloseHandle (hObject=0x208) returned 1
	[0119.638] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.KEKW", lpFilePart=0x0) returned 0x33
	[0119.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0119.638] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.KEKW" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0119.640] GetFileType (hFile=0x208) returned 0x1
	[0119.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0119.641] GetFileType (hFile=0x208) returned 0x1
	[0119.641] WriteFile (in: hFile=0x208, lpBuffer=0x2650a54*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x2650a54*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0119.644] CloseHandle (hObject=0x208) returned 1
	[0119.644] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", lpFilePart=0x0) returned 0x2e
	[0119.644] DeleteFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3")) returned 1
	[0119.649] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be5ebf7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maid with the Flaxen Hair.mp3", cAlternateFileName="MAIDWI~1.MP3")) returned 1
	[0119.649] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", lpFilePart=0x0) returned 0x40
	[0119.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0119.650] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0119.650] GetFileType (hFile=0x208) returned 0x1
	[0119.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0119.650] GetFileType (hFile=0x208) returned 0x1
	[0119.651] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x3ec5d2
	[0119.709] ReadFile (in: hFile=0x208, lpBuffer=0x3f37360, nNumberOfBytesToRead=0x3ec5d2, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x3f37360*, lpNumberOfBytesRead=0x26ef24*=0x3ec5d2, lpOverlapped=0x0) returned 1
	[0120.636] CloseHandle (hObject=0x208) returned 1
	[0120.636] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.KEKW", lpFilePart=0x0) returned 0x45
	[0120.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0120.636] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.KEKW" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0120.638] GetFileType (hFile=0x208) returned 0x1
	[0120.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0120.638] GetFileType (hFile=0x208) returned 0x1
	[0120.639] WriteFile (in: hFile=0x208, lpBuffer=0x25deb58*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25deb58*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0120.642] CloseHandle (hObject=0x208) returned 1
	[0120.642] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", lpFilePart=0x0) returned 0x40
	[0120.642] DeleteFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3")) returned 1
	[0120.668] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 1
	[0120.669] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", lpFilePart=0x0) returned 0x31
	[0120.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0120.669] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0120.670] GetFileType (hFile=0x208) returned 0x1
	[0120.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0120.670] GetFileType (hFile=0x208) returned 0x1
	[0120.670] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x49e459
	[0120.709] ReadFile (in: hFile=0x208, lpBuffer=0x35d54d0, nNumberOfBytesToRead=0x49e459, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x35d54d0*, lpNumberOfBytesRead=0x26ef24*=0x49e459, lpOverlapped=0x0) returned 1
	[0121.015] CloseHandle (hObject=0x208) returned 1
	[0121.015] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.KEKW", lpFilePart=0x0) returned 0x36
	[0121.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0121.016] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.KEKW" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.017] GetFileType (hFile=0x208) returned 0x1
	[0121.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0121.017] GetFileType (hFile=0x208) returned 0x1
	[0121.017] WriteFile (in: hFile=0x208, lpBuffer=0x25e16a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25e16a4*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0121.020] CloseHandle (hObject=0x208) returned 1
	[0121.020] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", lpFilePart=0x0) returned 0x31
	[0121.020] DeleteFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3")) returned 1
	[0121.038] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0121.039] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0121.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0121.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0121.039] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music\\Decrypt.txt", lpFilePart=0x0) returned 0x2e
	[0121.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0121.039] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Decrypt.txt" (normalized: "c:\\users\\public\\music\\sample music\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0121.040] GetFileType (hFile=0x204) returned 0x1
	[0121.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0121.040] GetFileType (hFile=0x204) returned 0x1
	[0121.041] WriteFile (in: hFile=0x204, lpBuffer=0x25e3d3c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x25e3d3c*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0121.043] CloseHandle (hObject=0x204) returned 1
	[0121.044] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0121.044] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0121.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0121.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0121.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0121.044] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15
	[0121.045] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\", lpFilePart=0x0) returned 0x16
	[0121.045] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0121.045] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0121.046] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0121.046] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x190cafd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x190cafd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1
	[0121.047] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x190cafd0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x190cafd0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0
	[0121.047] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0121.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0121.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0121.048] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Decrypt.txt", lpFilePart=0x0) returned 0x21
	[0121.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0121.048] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Decrypt.txt" (normalized: "c:\\users\\public\\music\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0121.049] GetFileType (hFile=0x200) returned 0x1
	[0121.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0121.049] GetFileType (hFile=0x200) returned 0x1
	[0121.049] WriteFile (in: hFile=0x200, lpBuffer=0x25e6c14*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25e6c14*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0121.052] CloseHandle (hObject=0x200) returned 1
	[0121.052] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0121.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0121.053] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18
	[0121.053] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\", lpFilePart=0x0) returned 0x19
	[0121.053] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0121.054] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0121.054] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0121.055] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1
	[0121.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0121.055] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures", lpFilePart=0x0) returned 0x28
	[0121.055] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\", lpFilePart=0x0) returned 0x29
	[0121.056] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0121.063] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0121.063] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrysanthemum.jpg", cAlternateFileName="CHRYSA~1.JPG")) returned 1
	[0121.064] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.jpg", cAlternateFileName="")) returned 1
	[0121.064] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0121.065] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hydrangeas.jpg", cAlternateFileName="HYDRAN~1.JPG")) returned 1
	[0121.065] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jellyfish.jpg", cAlternateFileName="JELLYF~1.JPG")) returned 1
	[0121.066] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Koala.jpg", cAlternateFileName="")) returned 1
	[0121.066] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lighthouse.jpg", cAlternateFileName="LIGHTH~1.JPG")) returned 1
	[0121.067] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Penguins.jpg", cAlternateFileName="")) returned 1
	[0121.067] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulips.jpg", cAlternateFileName="")) returned 1
	[0121.068] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulips.jpg", cAlternateFileName="")) returned 0
	[0121.068] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0121.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0121.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0121.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0121.071] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures", lpFilePart=0x0) returned 0x28
	[0121.071] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\", lpFilePart=0x0) returned 0x29
	[0121.071] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0121.074] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0121.075] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrysanthemum.jpg", cAlternateFileName="CHRYSA~1.JPG")) returned 1
	[0121.076] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", lpFilePart=0x0) returned 0x3a
	[0121.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0121.076] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.077] GetFileType (hFile=0x208) returned 0x1
	[0121.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0121.078] GetFileType (hFile=0x208) returned 0x1
	[0121.078] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xd6b22
	[0121.160] ReadFile (in: hFile=0x208, lpBuffer=0x3a73948, nNumberOfBytesToRead=0xd6b22, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x3a73948*, lpNumberOfBytesRead=0x26ef24*=0xd6b22, lpOverlapped=0x0) returned 1
	[0121.186] CloseHandle (hObject=0x208) returned 1
	[0121.186] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.KEKW", lpFilePart=0x0) returned 0x3f
	[0121.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0121.187] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.KEKW" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.188] GetFileType (hFile=0x208) returned 0x1
	[0121.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0121.188] GetFileType (hFile=0x208) returned 0x1
	[0121.189] WriteFile (in: hFile=0x208, lpBuffer=0x25ecaac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25ecaac*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0121.191] CloseHandle (hObject=0x208) returned 1
	[0121.192] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", lpFilePart=0x0) returned 0x3a
	[0121.192] DeleteFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg")) returned 1
	[0121.240] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.jpg", cAlternateFileName="")) returned 1
	[0121.241] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", lpFilePart=0x0) returned 0x33
	[0121.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0121.241] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.242] GetFileType (hFile=0x208) returned 0x1
	[0121.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0121.242] GetFileType (hFile=0x208) returned 0x1
	[0121.242] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xce875
	[0121.464] ReadFile (in: hFile=0x208, lpBuffer=0x35d54d0, nNumberOfBytesToRead=0xce875, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x35d54d0*, lpNumberOfBytesRead=0x26ef24*=0xce875, lpOverlapped=0x0) returned 1
	[0121.506] CloseHandle (hObject=0x208) returned 1
	[0121.507] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.KEKW", lpFilePart=0x0) returned 0x38
	[0121.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0121.507] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.KEKW" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.508] GetFileType (hFile=0x208) returned 0x1
	[0121.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0121.508] GetFileType (hFile=0x208) returned 0x1
	[0121.509] WriteFile (in: hFile=0x208, lpBuffer=0x25deb00*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25deb00*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0121.512] CloseHandle (hObject=0x208) returned 1
	[0121.512] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", lpFilePart=0x0) returned 0x33
	[0121.513] DeleteFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg")) returned 1
	[0121.580] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0121.580] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hydrangeas.jpg", cAlternateFileName="HYDRAN~1.JPG")) returned 1
	[0121.581] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", lpFilePart=0x0) returned 0x37
	[0121.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0121.581] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.586] GetFileType (hFile=0x208) returned 0x1
	[0121.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0121.586] GetFileType (hFile=0x208) returned 0x1
	[0121.586] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x91554
	[0121.590] ReadFile (in: hFile=0x208, lpBuffer=0x36a3d68, nNumberOfBytesToRead=0x91554, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x36a3d68*, lpNumberOfBytesRead=0x26ef24*=0x91554, lpOverlapped=0x0) returned 1
	[0121.622] CloseHandle (hObject=0x208) returned 1
	[0121.623] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.KEKW", lpFilePart=0x0) returned 0x3c
	[0121.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0121.623] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.KEKW" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.624] GetFileType (hFile=0x208) returned 0x1
	[0121.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0121.624] GetFileType (hFile=0x208) returned 0x1
	[0121.625] WriteFile (in: hFile=0x208, lpBuffer=0x25e198c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25e198c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0121.628] CloseHandle (hObject=0x208) returned 1
	[0121.628] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", lpFilePart=0x0) returned 0x37
	[0121.628] DeleteFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg")) returned 1
	[0121.645] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jellyfish.jpg", cAlternateFileName="JELLYF~1.JPG")) returned 1
	[0121.645] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", lpFilePart=0x0) returned 0x36
	[0121.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0121.646] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.651] GetFileType (hFile=0x208) returned 0x1
	[0121.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0121.651] GetFileType (hFile=0x208) returned 0x1
	[0121.651] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xbd616
	[0121.658] ReadFile (in: hFile=0x208, lpBuffer=0x37352d8, nNumberOfBytesToRead=0xbd616, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x37352d8*, lpNumberOfBytesRead=0x26ef24*=0xbd616, lpOverlapped=0x0) returned 1
	[0121.698] CloseHandle (hObject=0x208) returned 1
	[0121.698] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.KEKW", lpFilePart=0x0) returned 0x3b
	[0121.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0121.699] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.KEKW" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.700] GetFileType (hFile=0x208) returned 0x1
	[0121.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0121.700] GetFileType (hFile=0x208) returned 0x1
	[0121.700] WriteFile (in: hFile=0x208, lpBuffer=0x25e4510*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25e4510*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0121.703] CloseHandle (hObject=0x208) returned 1
	[0121.703] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", lpFilePart=0x0) returned 0x36
	[0121.703] DeleteFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg")) returned 1
	[0121.723] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Koala.jpg", cAlternateFileName="")) returned 1
	[0121.724] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", lpFilePart=0x0) returned 0x32
	[0121.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0121.724] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.724] GetFileType (hFile=0x208) returned 0x1
	[0121.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0121.725] GetFileType (hFile=0x208) returned 0x1
	[0121.725] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xbea1f
	[0121.732] ReadFile (in: hFile=0x208, lpBuffer=0x37f2910, nNumberOfBytesToRead=0xbea1f, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x37f2910*, lpNumberOfBytesRead=0x26ef24*=0xbea1f, lpOverlapped=0x0) returned 1
	[0121.773] CloseHandle (hObject=0x208) returned 1
	[0121.773] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.KEKW", lpFilePart=0x0) returned 0x37
	[0121.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0121.773] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.KEKW" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.774] GetFileType (hFile=0x208) returned 0x1
	[0121.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0121.775] GetFileType (hFile=0x208) returned 0x1
	[0121.775] WriteFile (in: hFile=0x208, lpBuffer=0x25ea330*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25ea330*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0121.781] CloseHandle (hObject=0x208) returned 1
	[0121.782] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", lpFilePart=0x0) returned 0x32
	[0121.782] DeleteFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg")) returned 1
	[0121.802] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lighthouse.jpg", cAlternateFileName="LIGHTH~1.JPG")) returned 1
	[0121.803] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", lpFilePart=0x0) returned 0x37
	[0121.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0121.803] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.806] GetFileType (hFile=0x208) returned 0x1
	[0121.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0121.806] GetFileType (hFile=0x208) returned 0x1
	[0121.806] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x8907c
	[0121.811] ReadFile (in: hFile=0x208, lpBuffer=0x38b1350, nNumberOfBytesToRead=0x8907c, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x38b1350*, lpNumberOfBytesRead=0x26ef24*=0x8907c, lpOverlapped=0x0) returned 1
	[0121.859] CloseHandle (hObject=0x208) returned 1
	[0121.859] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.KEKW", lpFilePart=0x0) returned 0x3c
	[0121.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0121.860] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.KEKW" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.861] GetFileType (hFile=0x208) returned 0x1
	[0121.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0121.861] GetFileType (hFile=0x208) returned 0x1
	[0121.862] WriteFile (in: hFile=0x208, lpBuffer=0x25edf1c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25edf1c*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0121.865] CloseHandle (hObject=0x208) returned 1
	[0121.866] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", lpFilePart=0x0) returned 0x37
	[0121.866] DeleteFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg")) returned 1
	[0121.886] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Penguins.jpg", cAlternateFileName="")) returned 1
	[0121.886] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", lpFilePart=0x0) returned 0x35
	[0121.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0121.886] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.887] GetFileType (hFile=0x208) returned 0x1
	[0121.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0121.887] GetFileType (hFile=0x208) returned 0x1
	[0121.887] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0xbde6b
	[0121.893] ReadFile (in: hFile=0x208, lpBuffer=0x393a3e8, nNumberOfBytesToRead=0xbde6b, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x393a3e8*, lpNumberOfBytesRead=0x26ef24*=0xbde6b, lpOverlapped=0x0) returned 1
	[0121.936] CloseHandle (hObject=0x208) returned 1
	[0121.936] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.KEKW", lpFilePart=0x0) returned 0x3a
	[0121.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0121.936] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.KEKW" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0121.938] GetFileType (hFile=0x208) returned 0x1
	[0121.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0121.938] GetFileType (hFile=0x208) returned 0x1
	[0121.938] WriteFile (in: hFile=0x208, lpBuffer=0x25f0a60*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25f0a60*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0121.941] CloseHandle (hObject=0x208) returned 1
	[0121.942] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", lpFilePart=0x0) returned 0x35
	[0121.942] DeleteFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg")) returned 1
	[0122.192] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulips.jpg", cAlternateFileName="")) returned 1
	[0122.192] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", nBufferLength=0x105, lpBuffer=0x26e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", lpFilePart=0x0) returned 0x33
	[0122.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee70) returned 1
	[0122.193] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0122.193] GetFileType (hFile=0x208) returned 0x1
	[0122.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee6c) returned 1
	[0122.194] GetFileType (hFile=0x208) returned 0x1
	[0122.194] GetFileSize (in: hFile=0x208, lpFileSizeHigh=0x26ef78 | out: lpFileSizeHigh=0x26ef78*=0x0) returned 0x97958
	[0122.269] ReadFile (in: hFile=0x208, lpBuffer=0x35d54d0, nNumberOfBytesToRead=0x97958, lpNumberOfBytesRead=0x26ef24, lpOverlapped=0x0 | out: lpBuffer=0x35d54d0*, lpNumberOfBytesRead=0x26ef24*=0x97958, lpOverlapped=0x0) returned 1
	[0122.300] CloseHandle (hObject=0x208) returned 1
	[0122.300] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.KEKW", nBufferLength=0x105, lpBuffer=0x26e9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.KEKW", lpFilePart=0x0) returned 0x38
	[0122.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea4) returned 1
	[0122.301] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.KEKW" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.kekw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x208
	[0122.302] GetFileType (hFile=0x208) returned 0x1
	[0122.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eea0) returned 1
	[0122.302] GetFileType (hFile=0x208) returned 0x1
	[0122.303] WriteFile (in: hFile=0x208, lpBuffer=0x25de5f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x26eec8, lpOverlapped=0x0 | out: lpBuffer=0x25de5f0*, lpNumberOfBytesWritten=0x26eec8*=0x10, lpOverlapped=0x0) returned 1
	[0122.306] CloseHandle (hObject=0x208) returned 1
	[0122.306] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", nBufferLength=0x105, lpBuffer=0x26ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", lpFilePart=0x0) returned 0x33
	[0122.307] DeleteFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg")) returned 1
	[0122.327] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0122.327] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0122.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0122.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0122.331] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0122.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0122.331] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Decrypt.txt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0122.332] GetFileType (hFile=0x204) returned 0x1
	[0122.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0122.332] GetFileType (hFile=0x204) returned 0x1
	[0122.332] WriteFile (in: hFile=0x204, lpBuffer=0x25e0ca4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x25e0ca4*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0122.335] CloseHandle (hObject=0x204) returned 1
	[0122.335] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0122.336] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0122.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0122.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0122.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0122.336] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18
	[0122.336] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\", lpFilePart=0x0) returned 0x19
	[0122.337] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0122.337] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.338] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0122.339] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x19d241f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19d241f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1
	[0122.339] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x19d241f0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19d241f0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0
	[0122.340] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0122.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0122.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0122.340] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Decrypt.txt", lpFilePart=0x0) returned 0x24
	[0122.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0122.341] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Decrypt.txt" (normalized: "c:\\users\\public\\pictures\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0122.341] GetFileType (hFile=0x200) returned 0x1
	[0122.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0122.342] GetFileType (hFile=0x200) returned 0x1
	[0122.342] WriteFile (in: hFile=0x200, lpBuffer=0x25e3c28*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25e3c28*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0122.345] CloseHandle (hObject=0x200) returned 1
	[0122.345] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1
	[0122.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0122.346] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV", lpFilePart=0x0) returned 0x1b
	[0122.346] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\", lpFilePart=0x0) returned 0x1c
	[0122.346] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0122.347] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.348] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0122.348] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 1
	[0122.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0122.349] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media", lpFilePart=0x0) returned 0x28
	[0122.349] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media\\", lpFilePart=0x0) returned 0x29
	[0122.349] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0122.350] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.350] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0122.351] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x0, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 1
	[0122.351] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x0, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 0
	[0122.352] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0122.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0122.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0122.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0122.352] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media", lpFilePart=0x0) returned 0x28
	[0122.352] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media\\", lpFilePart=0x0) returned 0x29
	[0122.353] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0122.353] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.354] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0122.355] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x0, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 1
	[0122.355] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0122.356] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0122.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0122.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0122.356] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Sample Media\\Decrypt.txt", lpFilePart=0x0) returned 0x34
	[0122.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0122.356] CreateFileW (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\Decrypt.txt" (normalized: "c:\\users\\public\\recorded tv\\sample media\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0122.357] GetFileType (hFile=0x204) returned 0x1
	[0122.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0122.358] GetFileType (hFile=0x204) returned 0x1
	[0122.358] WriteFile (in: hFile=0x204, lpBuffer=0x25e8458*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x25e8458*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0122.360] CloseHandle (hObject=0x204) returned 1
	[0122.361] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0122.361] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0122.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0122.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0122.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0122.362] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV", lpFilePart=0x0) returned 0x1b
	[0122.362] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\", lpFilePart=0x0) returned 0x1c
	[0122.362] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0122.362] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.363] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0122.363] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x19d704b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19d704b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 1
	[0122.364] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x19d704b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19d704b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 0
	[0122.364] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0122.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0122.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0122.365] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Recorded TV\\Decrypt.txt", lpFilePart=0x0) returned 0x27
	[0122.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0122.365] CreateFileW (lpFileName="C:\\Users\\Public\\Recorded TV\\Decrypt.txt" (normalized: "c:\\users\\public\\recorded tv\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0122.366] GetFileType (hFile=0x200) returned 0x1
	[0122.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0122.366] GetFileType (hFile=0x200) returned 0x1
	[0122.366] WriteFile (in: hFile=0x200, lpBuffer=0x25eb438*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25eb438*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0122.369] CloseHandle (hObject=0x200) returned 1
	[0122.369] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0122.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0122.370] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16
	[0122.370] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\", lpFilePart=0x0) returned 0x17
	[0122.370] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0122.371] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.371] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0122.372] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1
	[0122.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0122.373] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos", lpFilePart=0x0) returned 0x24
	[0122.373] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos\\", lpFilePart=0x0) returned 0x25
	[0122.373] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0122.374] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.374] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0122.375] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 1
	[0122.375] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 0
	[0122.376] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0122.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0122.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0122.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0122.376] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos", nBufferLength=0x105, lpBuffer=0x26eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos", lpFilePart=0x0) returned 0x24
	[0122.376] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\", nBufferLength=0x105, lpBuffer=0x26ea98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos\\", lpFilePart=0x0) returned 0x25
	[0122.376] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x26ece4 | out: lpFindFileData=0x26ece4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5c30
	[0122.377] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.378] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0122.378] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 1
	[0122.379] FindNextFileW (in: hFindFile=0x5f5c30, lpFindFileData=0x26ed3c | out: lpFindFileData=0x26ed3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0122.379] FindClose (in: hFindFile=0x5f5c30 | out: hFindFile=0x5f5c30) returned 1
	[0122.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efc4) returned 1
	[0122.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efd0) returned 1
	[0122.379] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26e988, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos\\Decrypt.txt", lpFilePart=0x0) returned 0x30
	[0122.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee7c) returned 1
	[0122.380] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Decrypt.txt" (normalized: "c:\\users\\public\\videos\\sample videos\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x204
	[0122.380] GetFileType (hFile=0x204) returned 0x1
	[0122.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ee78) returned 1
	[0122.381] GetFileType (hFile=0x204) returned 0x1
	[0122.381] WriteFile (in: hFile=0x204, lpBuffer=0x25ef878*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26ef14, lpOverlapped=0x0 | out: lpBuffer=0x25ef878*, lpNumberOfBytesWritten=0x26ef14*=0xa5, lpOverlapped=0x0) returned 1
	[0122.384] CloseHandle (hObject=0x204) returned 1
	[0122.384] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0122.385] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0122.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0122.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0122.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0122.386] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x26eb64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16
	[0122.386] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\", nBufferLength=0x105, lpBuffer=0x26eb38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\", lpFilePart=0x0) returned 0x17
	[0122.386] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x26ed84 | out: lpFindFileData=0x26ed84*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bf0
	[0122.387] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.387] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0122.388] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x19d96610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19d96610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1
	[0122.388] FindNextFileW (in: hFindFile=0x5f5bf0, lpFindFileData=0x26eddc | out: lpFindFileData=0x26eddc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x19d96610, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19d96610, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0
	[0122.389] FindClose (in: hFindFile=0x5f5bf0 | out: hFindFile=0x5f5bf0) returned 1
	[0122.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f064) returned 1
	[0122.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f070) returned 1
	[0122.389] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Decrypt.txt", lpFilePart=0x0) returned 0x22
	[0122.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef1c) returned 1
	[0122.390] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Decrypt.txt" (normalized: "c:\\users\\public\\videos\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x200
	[0122.391] GetFileType (hFile=0x200) returned 0x1
	[0122.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26ef18) returned 1
	[0122.391] GetFileType (hFile=0x200) returned 0x1
	[0122.391] WriteFile (in: hFile=0x200, lpBuffer=0x25f2794*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26efb4, lpOverlapped=0x0 | out: lpBuffer=0x25f2794*, lpNumberOfBytesWritten=0x26efb4*=0xa5, lpOverlapped=0x0) returned 1
	[0122.394] CloseHandle (hObject=0x200) returned 1
	[0122.395] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0122.395] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0122.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0122.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0122.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0122.395] GetFullPathNameW (in: lpFileName="C:\\Users\\Public", nBufferLength=0x105, lpBuffer=0x26ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf
	[0122.396] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\", nBufferLength=0x105, lpBuffer=0x26ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\", lpFilePart=0x0) returned 0x10
	[0122.396] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x26ee24 | out: lpFindFileData=0x26ee24*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5bb0
	[0122.396] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.397] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1788afb0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x1788afb0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1
	[0122.397] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0122.398] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x178d7270, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x178d7270, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1
	[0122.398] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x17a2ded0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x17a2ded0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1
	[0122.399] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x17a54030, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x17a54030, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1
	[0122.400] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x17a54030, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x17a54030, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1
	[0122.400] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x190f1130, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x190f1130, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1
	[0122.401] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x19d4a350, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19d4a350, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1
	[0122.401] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x19d704b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19d704b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1
	[0122.402] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x19dbc770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19dbc770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1
	[0122.402] FindNextFileW (in: hFindFile=0x5f5bb0, lpFindFileData=0x26ee7c | out: lpFindFileData=0x26ee7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x19dbc770, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19dbc770, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0
	[0122.403] FindClose (in: hFindFile=0x5f5bb0 | out: hFindFile=0x5f5bb0) returned 1
	[0122.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f104) returned 1
	[0122.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f110) returned 1
	[0122.403] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eac8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Decrypt.txt", lpFilePart=0x0) returned 0x1b
	[0122.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efbc) returned 1
	[0122.406] CreateFileW (lpFileName="C:\\Users\\Public\\Decrypt.txt" (normalized: "c:\\users\\public\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1fc
	[0122.407] GetFileType (hFile=0x1fc) returned 0x1
	[0122.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26efb8) returned 1
	[0122.407] GetFileType (hFile=0x1fc) returned 0x1
	[0122.407] WriteFile (in: hFile=0x1fc, lpBuffer=0x25f5b1c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f054, lpOverlapped=0x0 | out: lpBuffer=0x25f5b1c*, lpNumberOfBytesWritten=0x26f054*=0xa5, lpOverlapped=0x0) returned 1
	[0122.410] CloseHandle (hObject=0x1fc) returned 1
	[0122.410] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0122.411] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0122.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0122.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0122.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0122.411] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x26eca4, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8
	[0122.412] GetFullPathNameW (in: lpFileName="C:\\Users\\", nBufferLength=0x105, lpBuffer=0x26ec78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\", lpFilePart=0x0) returned 0x9
	[0122.412] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x26eec4 | out: lpFindFileData=0x26eec4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5f5af0
	[0122.412] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0122.413] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf78e790, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0xf78e790, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1
	[0122.414] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1
	[0122.414] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x17864e50, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x17864e50, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1
	[0122.415] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1
	[0122.415] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0122.417] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x19de28d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19de28d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1
	[0122.417] FindNextFileW (in: hFindFile=0x5f5af0, lpFindFileData=0x26ef1c | out: lpFindFileData=0x26ef1c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x19de28d0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19de28d0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0
	[0122.418] FindClose (in: hFindFile=0x5f5af0 | out: hFindFile=0x5f5af0) returned 1
	[0122.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1a4) returned 1
	[0122.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f1b0) returned 1
	[0122.418] GetFullPathNameW (in: lpFileName="C:\\Users\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eb68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Decrypt.txt", lpFilePart=0x0) returned 0x14
	[0122.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f05c) returned 1
	[0122.418] CreateFileW (lpFileName="C:\\Users\\Decrypt.txt" (normalized: "c:\\users\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f0
	[0122.420] GetFileType (hFile=0x1f0) returned 0x1
	[0122.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f058) returned 1
	[0122.420] GetFileType (hFile=0x1f0) returned 0x1
	[0122.420] WriteFile (in: hFile=0x1f0, lpBuffer=0x25f8a6c*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f0f4, lpOverlapped=0x0 | out: lpBuffer=0x25f8a6c*, lpNumberOfBytesWritten=0x26f0f4*=0xa5, lpOverlapped=0x0) returned 1
	[0122.423] CloseHandle (hObject=0x1f0) returned 1
	[0122.423] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0122.424] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
	[0122.426] FindClose (in: hFindFile=0x5f5ab0 | out: hFindFile=0x5f5ab0) returned 1
	[0122.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x26f244) returned 1
	[0122.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x26f250) returned 1
	[0122.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f23c) returned 1
	[0122.427] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x26ed44, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0122.427] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x26ed18, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
	[0122.428] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x26ef64 | out: lpFindFileData=0x26ef64*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf2b66ab0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf2b66ab0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5f5ab0
	[0122.430] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xf304f810, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf304f810, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0122.430] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0122.431] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1
	[0122.431] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xf3075970, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3075970, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1
	[0122.432] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0122.432] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0122.433] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf3916930, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf3916930, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1
	[0122.433] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0122.434] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf393ca90, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf393ca90, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1
	[0122.436] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe55086e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe55086e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0122.436] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1
	[0122.437] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x15bfa7b0, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x15bfa7b0, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1
	[0122.437] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7c093f0, ftLastAccessTime.dwHighDateTime=0x1d60298, ftLastWriteTime.dwLowDateTime=0xf7c093f0, ftLastWriteTime.dwHighDateTime=0x1d60298, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0122.437] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1
	[0122.438] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x19e08a30, ftLastAccessTime.dwHighDateTime=0x1d60299, ftLastWriteTime.dwLowDateTime=0x19e08a30, ftLastWriteTime.dwHighDateTime=0x1d60299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0122.438] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0122.439] FindNextFileW (in: hFindFile=0x5f5ab0, lpFindFileData=0x26efbc | out: lpFindFileData=0x26efbc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0
	[0122.439] FindClose (in: hFindFile=0x5f5ab0 | out: hFindFile=0x5f5ab0) returned 1
	[0122.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x26f244) returned 1
	[0122.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x26f250) returned 1
	[0122.440] GetFullPathNameW (in: lpFileName="C:\\Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26ec08, lpFilePart=0x0 | out: lpBuffer="C:\\Decrypt.txt", lpFilePart=0x0) returned 0xe
	[0122.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f0fc) returned 1
	[0122.440] CreateFileW (lpFileName="C:\\Decrypt.txt" (normalized: "c:\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f4
	[0122.443] GetFileType (hFile=0x1f4) returned 0x1
	[0122.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x26f0f8) returned 1
	[0122.443] GetFileType (hFile=0x1f4) returned 0x1
	[0122.444] WriteFile (in: hFile=0x1f4, lpBuffer=0x25fc194*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f194, lpOverlapped=0x0 | out: lpBuffer=0x25fc194*, lpNumberOfBytesWritten=0x26f194*=0xa5, lpOverlapped=0x0) returned 1
	[0122.447] CloseHandle (hObject=0x1f4) returned 1
	[0122.448] GetFullPathNameW (in: lpFileName="Decrypt.txt", nBufferLength=0x105, lpBuffer=0x26eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Decrypt.txt", lpFilePart=0x0) returned 0x31
	[0122.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26f19c) returned 1
	[0122.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Decrypt.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\decrypt.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x1f4
	[0122.450] GetFileType (hFile=0x1f4) returned 0x1
	[0122.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x26f198) returned 1
	[0122.450] GetFileType (hFile=0x1f4) returned 0x1
	[0122.450] WriteFile (in: hFile=0x1f4, lpBuffer=0x25fe6f4*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x26f234, lpOverlapped=0x0 | out: lpBuffer=0x25fe6f4*, lpNumberOfBytesWritten=0x26f234*=0xa5, lpOverlapped=0x0) returned 1
	[0122.453] CloseHandle (hObject=0x1f4) returned 1
	[0122.501] LocalAlloc (uFlags=0x0, uBytes=0x18) returned 0x5fcb38
	[0133.085] LocalFree (hMem=0x5fc7b8) returned 0x0
	[0133.085] LocalFree (hMem=0x5fcb38) returned 0x0
	[0133.233] CoGetContextToken (in: pToken=0x26fcb0 | out: pToken=0x26fcb0) returned 0x0
	[0133.234] CObjectContext::QueryInterface () returned 0x0
	[0133.234] CObjectContext::GetCurrentThreadType () returned 0x0
	[0133.234] Release () returned 0x0
	[0133.236] CoGetContextToken (in: pToken=0x26f9cc | out: pToken=0x26f9cc) returned 0x0
	[0133.236] CObjectContext::QueryInterface () returned 0x0
	[0133.236] CObjectContext::GetCurrentThreadType () returned 0x0
	[0133.236] Release () returned 0x0
	[0133.239] CoGetContextToken (in: pToken=0x26f9cc | out: pToken=0x26f9cc) returned 0x0
	[0133.239] CObjectContext::QueryInterface () returned 0x0
	[0133.239] CObjectContext::GetCurrentThreadType () returned 0x0
	[0133.239] Release () returned 0x0
	[0133.245] CoGetContextToken (in: pToken=0x26f9cc | out: pToken=0x26f9cc) returned 0x0
	[0133.245] CObjectContext::QueryInterface () returned 0x0
	[0133.257] CObjectContext::GetCurrentThreadType () returned 0x0
	[0133.257] Release () returned 0x0
	[0133.261] CoGetContextToken (in: pToken=0x26f9e4 | out: pToken=0x26f9e4) returned 0x0
	[0133.261] CObjectContext::QueryInterface () returned 0x0
	[0133.261] CObjectContext::GetCurrentThreadType () returned 0x0
	[0133.261] Release () returned 0x0
	[0133.262] CoUninitialize () 

Thread:
	id = 2
	os_tid = 0x208


Thread:
	id = 3
	os_tid = 0x418

	[0054.111] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0133.238] EtwEventUnregister () returned 0x0
	[0133.251] CloseHandle (hObject=0x384) returned 1
	[0133.260] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) 

Thread:
	id = 4
	os_tid = 0x408


Thread:
	id = 5
	os_tid = 0x60c

	[0082.503] CoGetContextToken (in: pToken=0x4d1f71c | out: pToken=0x4d1f71c) returned 0x0
	[0082.504] CObjectContext::QueryInterface () returned 0x0
	[0082.504] CObjectContext::GetCurrentThreadType () returned 0x0
	[0082.504] Release () returned 0x0

Thread:
	id = 6
	os_tid = 0xa20


Thread:
	id = 7
	os_tid = 0xa30


Thread:
	id = 8
	os_tid = 0x5e4


Thread:
	id = 9
	os_tid = 0xa7c

	[0122.522] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
	[0124.295] ShellExecuteExW (in: pExecInfo=0x25ff7f8*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="notepad.exe", lpParameters="Decrypt.txt", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25ff7f8*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="notepad.exe", lpParameters="Decrypt.txt", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x384)) returned 1
	[0132.608] CoGetContextToken (in: pToken=0x529f7b0 | out: pToken=0x529f7b0) returned 0x0
	[0132.615] CoUninitialize () 

Process:
	id = "2"
	image_name = "notepad.exe"
	filename = "c:\\windows\\syswow64\\notepad.exe"
	page_root = "0x44af6000"
	os_pid = "0xb9c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x6fc"
	cmd_line = "\"C:\\Windows\\System32\\notepad.exe\" Decrypt.txt"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 10
	os_tid = 0xa64